What your car knows about you — and what it's telling others

For generations, marketers told us one can learn a lot about a person from the car they drive. Now, it's the cars that can tell manufacturers a lot about the people who drive them.  

Many drivers may not know it, but the latest in connected car technology in their new ride isn't just improving their comfort and safety. It may also be logging — and sharing — data from each journey. 

This has privacy advocates raising a red flag, calling for greater transparency around the collection and ownership of the information being collected from drivers and their cars. 

"How do we have the control over our personal information?" said Vincent Gogolek, former executive director of the B.C. Freedom of Information and Privacy Association (FIPA).

"Not that [consumers] want to have Model T Fords again and drive nothing. They like having all of this equipment and these services and the toys. But they want to know that they're not being spied on; they have some sort of ability to limit what information is being shared and where it goes.

"And it's not really clear that that's the way this is working."

Companies today know a lot about your vehicle and how you drive it thanks to telematics technology, the pairing of telecommunications and information processing.

This has transformed what it's like when behind the wheel.

It means things like turn-by-turn navigation, automated emergency calling, remote access, and vehicle diagnostics and maintenance notifications. Today's vehicles also come equipped with infotainment systems, including video players, internet and music streaming. What's more, connected cars are capable of collecting and transmitting a lot of data.

And they're gathering a lot, it seems.

Bill Hanvey, president of the Auto Care Association, wrote in the New York Times last May, "they know how fast we drive, where we live, how many children we have." 

"Connect a phone to a car, and it knows who we call and who we text."

The question, as he puts it, is who owns and controls that data? What's being done with it?

North of the border, Gogolek has questions, too.

Earlier this year, FIPA released his report, Connected Car Update: Who is the Driver's Seat? It's a followup on the association's 2015 study on privacy and onboard vehicle telematics technology.

The report found telematics systems have become much more prevalent. It also found the privacy policies of car companies have also changed — "generally for the better" — and are available online.

Gogolek, however, found the policies are still inadequate, a conclusion that spurred FIPA to make a formal complaint to the Privacy Commissioner of Canada. 

The Vancouver-based association told the privacy commissioner that the purposes for collecting personal information remain vague and excessively broad in many instances.

Reliance on implied consent

It also raised concerns about ambiguities with respect to the protection of personal information, sharing with third parties, and the ability to opt out of data collection.

"What we found was that there is still considerable reliance on what's called implied consent," Gogolek said.

"By turning the thing on and using it, you've agreed."

CBC News reviewed a number of privacy policies and also found examples where it doesn't appear clear what will happen to vehicle data or set very broad parameters.

One says the data can be used for "other marketing programs." Another says the company will collect the data in order to meet "our legal obligations and other legitimate business interests."

The policies also suggest a wide range of data could be gathered — from the destination punched into the mapping software, to how long the drive took, to which radio station was on during the trip.

The Canadian Vehicle Manufacturers' Association (CVMA) says on its website that data privacy is "integral" to the connected vehicle technologies and that protection of customer privacy is implemented "in every stage of vehicle design and manufacturing."     

CBC News reached out to representatives of Fiat Chrysler Canada, Hyundai and Honda for comment on their privacy policies, as well as the CVMA. Only Hyundai responded with a statement.  

Hyundai said it is collecting select information through its connected car service and it uses that data for research and development. It says the primary purpose is to benefit the driver, including providing maintenance notifications.

Hyundai also says it complies with all Canadian privacy regulations and there is a way to opt out.

How to opt out unclear

But with many car companies, Gogolek said, how to opt out isn't very clear. Furthermore, if drivers opt out of data-sharing, they may also lose some of their vehicles' connected features.

If all of this seems a bit murky, one thing appears clear: the data's value.

Last year, the Detroit Free Press reported that data could be what Ford sells next as it looks for new revenue. The newspaper also reported that GM, during a three-month test, used in-car Wi-Fi to track driving habits to see whether there is a relationship between what drivers listen to and what they buy.

Privacy advocates aren't the only ones with concerns about who controls the data. Those who maintain and repair vehicles outside of dealerships are also keeping a watchful eye.

For them, it's an issue of who owns the data when it's time for a fix.

"We often say that data is the new oil," said Jean-François Champagne, president of the Automotive Industries Association of Canada.

Data monopoly leading to limited servicing options?

Champagne says AIA Canada, which represents companies like Canadian Tire and 3M Automotive, wants to ensure consumers control their data and can choose to share it.

If car companies are allowed to create a data monopoly, he says, it could limit consumers' choices of where and how their car is serviced.

"Canadians are not well aware of the type of information their car currently captures," Champagne said.

Drivers who want to learn more about the data being collected and how it's being used can always check out the privacy policies of their vehicles' manufacturer posted on the company's website.

For some, the sharing of data is no big deal and, in this age of connected tech, practically unavoidable anyway -— although for others, this new road is one to be viewed with caution and one policymakers, drivers and car companies will have to navigate carefully.

"We need clear rules for us as consumers ... but also for the for the industry, because cars are expensive — they cost a lot to develop," Gogolek says.

"These things should be as privacy protected as possible and it shouldn't be something that they're trying to add later as complaints are filed or somebody finds that something's gone wrong. It should be baked in at the very beginning."