Car-tracking devices spark privacy concerns

Privacy advocates are sounding alarm bells over a new device that can record certain driving habits of Canadian motorists. But one of the auto insurance companies offering the product says those fears are misplaced.

"It definitely has ramifications from a privacy point of view because it's a new technology that will involve the collection of new personal information that, up until now, hasn't been done," said lawyer Kris Klein, an expert in privacy law.

"I think one of the concerns is whether or not people completely and fully understand the extent to which their personal information is being collected by these machines."

• Car-tracking device could lower premiums, insurers claim
• Car-insurance device hits speedbump with readers

Clients of Desjardins Insurance, which launched its telematic device program in Ontario and Quebec last month, and Industrial Alliance, which offers the device in Quebec, are given the option of taking part.

The telematic devices, already in use in other parts of the world, attach to the diagnostics port of the car and are able to record the number of kilometres driven annually, the number of times a driver brakes hard or accelerates quickly and the time of day that a car is driven. Based on that information, clients, who can opt out of the program at any point, could be eligible for up to a 25 per cent saving on their rates.

The issue of privacy has been at the forefront recently over the disclosure that the U.S government secretly collects data from telephone and internet services and questions over Canada's own surveillance techniques and what kind of information Ottawa is mining from Canadians.

'Quite impressed'

But on the issue of these telematic devices, Desjardins has received praise from Ontario Privacy Commissioner Ann Cavoukian, She said she was "quite impressed" with the measures the company has put in place and that they have "done a great deal properly to protect customers privacy."

"They require positive consent on the part of the user. So people have to choose to use the Adjusto device and sign up for it," she said. "They have a lot of transparency, they get a lot of information to the user. They say specifically they will only use it for purposes of administrating this program and it won't be used for any other purposes. So they go to great lengths to provide customers with assurance that their privacy will be protected and I applaud them for that."

Cavoukian did note that if the vehicle was involved in an accident, police, armed with a warrant, would be able to access the information on that device.

But John Lawford, executive director and general counsel of the Public Interest Advocacy Centre (PIAC), said it's not just the police who may have access to the information but that it could be used against the driver as part of the discovery process in a lawsuit.

"The first thing I'm going to do when I'm a lawyer from the other side is say 'Oh, you're [insured] with Desjardins? Great. Now I'm going to make a motion to have all of your driving records back to when you started with this to see if you are the really amazing driver that you say you are. Every time you stepped on the brakes hard, every time you sped up fast, I've got that.

"What a beautiful thing for a cross examiner. I'd be in heaven if I had that [information]. Normally you have nothing, an accident report — nothing you can do with that. But this is gold."

Lawford also raised the concerns that the aggregate data gathered by the insurance companies on their clients could be resold for other purposes.

For example, back in 2011, the GPS navigation manufacturer Tom Tom faced blistering criticism after it was discovered the Dutch company had sold some of its customer data to police who were using it to set up speed traps.

Although the clients names would be stripped from that data, or "anonymized," Lawford said marketers and a host of other groups would love to get their hands on it.

"People are interested in this stuff. That's what behaviour targeting and location-based ad delivery is all about," Lawford said.

Difficult to 'anonymize' data

Some academics have warned that it's difficult to completely "anonymize" data, Klein said.

"For sure, the information will be valuable to all sorts of different people. Then the question is will this insurance company be able to anonymize the data before it get used for all these ancillary purposes," he said.

But Desjardins said many of the privacy issues raised should not be a cause for concern.

"We're going to do what we can to protect the client's privacy," said Ken Lindhardsen, vice-president of claims operations and legal counsel for Desjardins Insurance.

Lindhardsen acknowledged that Desjardins would be obligated to comply if law enforcement issued a warrant for client information contained in the telematic device, much like banks and cellular phone companies must provide information to police if ordered to by the courts. He noted, however, that most cars are equipped with event data recorders or "black boxes" that are a greater source of information.

He also questioned how much relevance the data in the telematic device would have in a potential lawsuit.

"They'd have to prove relevance and I think often what the courts look at is what is relevant to that particular case at hand," he said. "Could they request it. I suppose they could. Would they be successful at getting that request granted, I'm not so sure that they would."

As for selling the aggregate anonymized information to others, Lindhardsen said that's not the intention of the program.

"We have no plans to do that. That's not our objective," Lindhardsen said.

Desjardins spokesman Joe Daly added that while the policy may allow for that kind of information to be distributed, he stressed that it would be general information that might be used for accident data and that could not be used against individual clients. 

"Driving information is important because people have accidents, people die, governments want to improve roads. So it may be valuable in that sense," he said. "But there are other sources of that information."

He said the information is ultimately stored at the Montreal-based company, iMetrik. Although Lindhardsen assured that all safety procedures are taken to ensure the data is safe from potential hackers, he was unsure how long the company keeps that data, another concern that has been raised by privacy advocates.

Mandatory installation?

Tamir Israel, staff lawyer with the Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic at the University of Ottawa, said while the device is now optional, there's always a chance its success could lead to mandatory installation.

"The insurance company could say that 'for two years, people have had this in their cars and nothing's gone wrong, let's just make it obligatory," Israel said. "We've seen that happen in other technological scenarios, where it's a pilot project and at first you really are cautious on the privacy side and you put in a lot of protections. You don't make it mandatory but over time it becomes embedded."

But Lindhardsen said they see this device as a "voluntary way" for clients to save money on their insurance and to control their driving habits and that he didn't believe it's been made mandatory in other jurisdictions.