If you’re driving a late model car or truck, chances are that the vehicle is mostly computers on wheels, collecting and wirelessly transmitting vast quantities of data to the car manufacturer not just on vehicle performance but personal information, too, such as your weight, the restaurants you visit, your music tastes and places you go.
A car can generate about 25 gigabytes of data every hour and as much as 4,000 gigabytes a day, according to some estimates. The data trove in the hands of car makers could be worth as much as $750 billion by 2030, the consulting firm McKinsey has estimated. But consumer groups, aftermarket repair shops and privacy advocates say the data belongs to the car’s owners and the information should be subject to data privacy laws.
Yet Congress has yet to pass comprehensive federal data privacy legislation. And although Sen. Roger Wicker of Mississippi, chairman of the Senate Committee on Commerce, Science, and Transportation, has said he would like to see federal privacy legislation passed by the end of the year, it is unclear if that goal can be met.
The European Union has already ruled that data generated by cars belongs to their owners and is subject to privacy rules under the EU’s General Data Protection Regulations or GDPR. Automakers, meanwhile, are still trying to shape the outcome of state data privacy laws, including the one in California that goes into effect in January 2020, but might be subject to amendment before then.
The California law’s definition of personal information extends beyond what’s generated by an individual to include household information, and gives consumers the right to obtain data collected on them, to stop third-party sales of that information, and to ask companies to delete their information.
The Auto Alliance, a trade group representing the world’s largest car makers, has appealed to the state’s attorney general, asking that the companies be allowed to provide only summary information to consumers as opposed to “specific pieces of personal information a business has collected about them,” as the law requires.
Car companies track data by the vehicle identification number or VIN and “may have little insight into who was driving the vehicle at the time information was collected,” the Alliance said in a March 8 letter to the California Justice Department.