Privacy, data protection and connected cars Lilian Edwards, Professor of Internet Law University of Strathclyde Researcher in Residence, Digital Catapult February 2016

Fear, uncertainty and doubt in the IoT "Your smart watch will reveal your lack of exercise to your health insurance company, your car will tell your insurer of your frequent speeding, and your dustbin will tell your local council that you are not following local recycling regulations. This is the “internet of stool pigeons”, and though it may sound far-fetched, it’s already happening" Guardian,11 March “Bentham’s Panopticon is child’s play compared to surveillance in a fully functioning IoT”. Wisman

Sensitivity of location data  Art 29 WP “movement patterns of owners.. provide a very intimate insight into the private lives of owners”  US FTC 2013: “mobile devices typically personal to individual, almost always on, and with the user” -> highly sensitive data  Recent O2 tube example  “will track an estimated one million journeys a day made by O2 customers within London's Zone One… [also] tracks which apps customers are using and the types of web pages visited, aggregating the information to sell to advertising companies and big brands” -> targeted ads to mobiles (Telegraph, 11 Feb 2016)

Legality? 02 Underground Service Terms and Conditions  “10. By signing up to the service you consent to us using your personal data (including data in relation to your O2 contract and data in relation to your use of O2 WiFi) to verify who you are and to provide you with access to the service.  “…26. By using the services you are providing your consent to use your personal information together with other information for the following purposes: a. profiling your usage and viewing; b. personalising your experience of the services based on your usage and viewing profile; and c. improving and developing the services.  27. We may share with third parties information about your use of the services in an aggregated form which will not personally identify you. This aggregated data may be used by those third parties for their marketing purposes (e.g. to improve their targeting of advertising based on user preferences). “

Industry trust principles and suggestions  US - Consumer Privacy Protection Principles For Vehicle Technologies and Services  (1) transparency (2) choice (3) respect for context (4) data minimization, de-identification and retention (5) data security (6) integrity and access; and (7) accountability.  Largely subsumed in Europe by data protection law (?)  EU- German Federal and State Data Protection Authorities - “Data Protection in the Car” 2014Data Protection in the Car”  Article 29 Working Party published its Opinion on the Internet of Things (2014).  Non-industry: Future of Privacy Forum’s white paper, The Connected Car and Privacy: Navigating New Data Issues

Is consent required by law to collection of location data? a. DP principles (8) apply to processing of personal data Personal Data shall be processed lawfully and fairly 1. Consent 2. “Legitimate interests of data controller” so long as not infringing fundamental rights and freedoms of data subject 3. Others eg necessary for completion of contract b. Privacy and Electronic Communications Directive 2002 (PECD) amended Prior consent needed to collection of “data.. indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service” - Many queries if this actually includes data collected by connected cars? “Uber” or single-owner model?

Quality of consent needed?  DPD, Art 2 “any freely given, specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”  GDPR changes  Who has to give consent to collection of their location?  owner/leaser of car  family/friends of such a sole user?  Anyone who rides in a CC via some kind of hire or app? (“Uber”/taxi paradigm)  What will be known about passengers?  Out may be to claim that personal data is not collected, or if it is, that it is anonymised

Issues for trust in privacy protection  What personal data did I consent to disclose using a connected car?  How will consent of riders other than prime owner/leaser be gathered  Will it be meaningful (informed, unpressurised) consent?  What grounds other than consent might be used eg “legitimate interests”?  If data is collected on basis of being non personal, or collected and aggregated - > anonymous data, is my privacy really safe?  Mosaic theory  Reidentification work