GM, LexisNexis Sued For (Nontransparent) Sale Of Driver Behavior Data To Insurers
from the pass-a-privacy-law-already,-nitwits dept
Last week the New York Times published a story confirming what everybody assumed was already happening. Automakers collect reams of personal behavior, phone, and other data (without making it clear to consumers) then sell it to a long list of companies. Including insurance companies, who are now jacking up insurance rates if they see behavior in the dataset they don’t like.
The absolute bare minimum you could could expect from the auto industry here is that they’re doing this in a way that’s clear to car owners. But of course they aren’t; they’re burying “consent” deep in the mire of some hundred-page end user agreement nobody reads, usually not related to the car purchase itself but the apps consumers now use to manage roadside assistance and other programs.
Unsurprisingly, one of the folks who was being tracked in this way has now filed suit (see: complaint) against both General Motors and Lexis Nexis, which the insurance industry uses to digest driver data and then create driver behavior reports used to impact insurance rates. And again, it’s the failure to be transparent with consumers that got the companies into trouble:
“What no one can tell me is how I enrolled in it,” Mr. Chicco told The Times in an interview this month. “You can tell me how many times I hard-accelerated on Jan. 30 between 6 a.m. and 8 a.m., but you can’t tell me how I enrolled in this?”
A report last month by Mozilla highlighted how the auto industry was the absolute worst industry the organization tracks on privacy practices, routinely over-collecting and failing to adequately protect or encrypt broad swaths of data. Not just data from the vehicle; but troves of data collected from your phone every time you sync it with your car’s infotainment and navigation systems.
It’s another giant mess made possible, in part, by a corrupt Congress’ absolute refusal to pass a meaningful privacy law for the internet era, despite a steady parade of stories just like this one. Yes, automakers should be transparent, but consumers should also be empowered to opt out of punitive surveillance and data collection without losing features or seeing entirely new, annoying restrictions.
Filed Under: car, data brokers, insurance, lexisnexis, privacy, security, tracking, vehicle
Comments on “GM, LexisNexis Sued For (Nontransparent) Sale Of Driver Behavior Data To Insurers”
At what point does all this data collection become a violation of the 4th amendment? (protections of search and seizure –not just from the government, but 3rd parties)
I’m generally curious why the 1st is invoked by the businesses on collecting this data stuff and yet no one, individually, is allowed to consider it a violation of their personal papers, house, and or effects?
If I sell you a coffee mug, it doesn’t give me the right to rifle through your kitchen to see how you use your mixer (to be absurd) –why / how has this intrusion been allowed without invasion of privacy being considered over the “needs” of the DCMA (which is where I assume tracking is covered by automakers)?
Not trying to be a smart ass…genuinely curious
Re:
Much like the 1st amendment it only matters when the government does it.
Re:
Maybe it is a business version of the law enforcement Qualified Immunity.
Re: Re:
I can hear the fucking argument already. The customer absolutely opted-in, but forgot due to excited delirium over the deals we presented.
Re:
This has nothing to do with the 4th Amendment because it’s not the government collecting it.
It’s not. Ever.
You’re starting from a position of not understanding how the Constitution works, and then asking questions that don’t make sense based on that misunderstanding.
Re: Re: Driver data
As far as I concerned these are private companies and people consent before using the services provided.
Re: Re: Re:
Did you read the fucking article?
People don’t even know it’s happening.
Re:
A couple of reasons, as I see it:
1: Companies tend to invoke the 1st Amendment EVERY time they’re defending a shady business practice, whether it’s relevant or not (in this case, I don’t think it is).
2: The fact that you clicked “I Accept” on a 900-page document where Page 899 says “we get to spy on you whenever we want and own that data until the end of time” means you TECHNICALLY agreed to it.
3: Even it were legally ruled to be a 4th Amendment violation, good luck getting the government to actually enforce it…
Re: Re:
But this is a car. Is there any car that refuses to let people drive it till they click through an agreement?
Re: Re: Re:
I haven’t bought a new car in a while but I’m assuming the infotainment system has you click some sort of “i agree” the first time you use it. Also, the article mentions connected phone apps and those definitely do have user agreements.
Re: Re: Re:2
Sure, but I’d expect a car to still drivable if its “infotainment” system were permanently showing the license agreement. Or permanently except when it’s showing the rear-view camera—that has to be visible within 2 seconds of turning on the car, and I don’t think federal law allows it to be blocked because someone didn’t agree.
As for the phone apps, those as far as I know are always completely optional.
Re: Re: Re:3
So? You shouldn’t have to hobble the functionality of a car you just paid tens of thousands of dollars for just to keep the manufacturer from spying on you.
Especially when they’re deliberately obscuring the fact that they’re doing it.
Re: Re: Re:4
Yeah. But if the manufacturers are to be sued for this, it may be necessary to find some class of people whose privacy was invaded who did not give up their right to sue, and did not (even in hundreds of pages of fine print) “agree” to it.
Re: Re: Re:5
Perhaps a larger class would be people who bought used cars. People who never clicked “I agree” or were aware of any agreement, even if the previous owner agreed.
Re: Re: Re:5
Not a lawyer here, but apparently that “you agreed to it” thingy some lean upon is not a slam dunk.
Re: Re: Re:2
And? That’s like arguing that someone’s Samsung phone should be blocked because they didn’t click ‘I agree’ on Google Play (preferring to sideload apps).
Re: Re: Re:3
Isn’t that exactly the situation on iPhones and iPads? Fortunately, the U.S. announced an anti-trust lawsuit against Apple today. But till that’s resolved—and maybe after, depending on how it goes—my understanding is that people who don’t agree to the terms can’t use them.
Re: Re: Re:4
No, because Alphabet hasn’t tied its app market to Android devices the way crApple have with theirs. Nice try at obfuscation, though.
Re: Re:
From a non-paywalled version of the article:
No sign-up, no clickwrap agreement. Next time, read either the article or an accessible version of it before commenting.
So what? Why do you have an expectation of privacy while driving?
Also, banning someone who reports on driving on public roads would violate that person or company’s rights. I can drive around with a dash cam and record bad drivers and their license plates and sell that to insurance companies. Should that be illegal too?
Re:
If you don’t think there’s a difference between someone walking/driving around in public and videotaping what they see and a car that’s set up to record detailed telematic data, then it’s honestly not worth explaining it to you.
Re:
Do I think that my detailed driving habits are not recorded and sold? Yes.
You could put up a dash cam. But unless you follow me like a stalker then it isn’t the same thing
Re:
there is a difference between casually driving near someone and always following a driver everywhere they go.
Re: Re:
As a journalist, I am in my rights to report on bad drivers. I could sell my reporting to anyone, including insurance companies. I could even report them to the police.
What if a company flies an aircraft or even a satellite and uses a video tracker to record driving habits? Or a local news helicopter following a car chase?
The key here is driving on PUBLIC roads. I can think of a million ways you could get that data.
Again, you do not have privacy driving on public roads.
Re: Re: Re:
“Again, you do not have privacy”
Agreed, and yer cool with it.
Re: Re: Re:
At most you can follow one driver, not everyone who happens to drive car. Plus, if you are a “journalist” that sells information to insurance companies you aren’t a journalist anymore and you loose the “this is newsworthy information” defense.
What about alien probes secretly inserted into individuals rectums to track their driving habits? That works too, right?
No, you can’t because all your examples hinges on devoting manpower to tracking one individual. Now, are any of your examples even remotely realistic when we are talking about millions of drivers?
What you gloss over in your defense of car manufacturers hoovering up information and how it isn’t such a big deal, is that much of that information has nothing to do with driving behavior.
It seems you have never come across something called “reasonable expectation of privacy”, something that exists even when someone is in public. If you actually were a journalist you would know this, journalists and press have been sued and had to pay up because they infringed on others “reasonable expectation of privacy” – it’s usually referred to as intrusion.
Re: Re: Re:
As a journalist, have you fact-checked whether people are only tracked on public roads? It seems like a dubious claim (nevermind that it completely ignores stuff like non-driving data being hoovered up from phones). It would require the car to know whether it’s on public or private property at any given time, which it almost certainly doesn’t.
I know people who sometimes drive on private tracks for fun. If their insurance companies looked at data like “hard-acceleration” without knowing the context, they’d probably never be able to get insurance again.
Re: Re: Re:2
Data and information without context are largely useless.
Re: Re: Re:3
So why are data brokers so successful in selling it?
Re:
“Why do you have an expectation of privacy in your own home? After all, there’s public space around it.”
That’s the level of logic you’re applying here.
Re: Re:
Well, it’s legal for someone so stand on the sidewalk and photograph your house, so obviously you shouldn’t have a problem with someone installing a camera in your bedroom and selling the videos…
Re: Re: Re:
Not at all the same thing. Courts have ruled that you do have an expectation of privacy in your own home.
Please explain what a private driving habit is? Driving habits on a public road cannot in anyway be considered private.
Re: Re: Re:2
Do you always wait until a court has ruled on something before you decide if it makes sense or not?
The way you drive your car and where you go. As long as the way you drive isn’t illegal, it should be nobody’s business but yours.
Re:
You’re skipping over the vast gulf between “anyone on a public road can record whatever they want about me” and “my personal property is reporting information about me.”. It’s the difference between listening to someone’s phone conversation in public and tapping their cell phone whenever they’re outside of their home.
Re:
So what? Why do you have an expectation of privacy while enclosed in your vehicle? So what? Why do you have an expectation of privacy while in your house? Dickhead.
The crux of this is the data being collected is manifold, granular, deeply personal, AND nonconsentual.
Its that last one thats a problem.
i thought all these data collections were “anonymized” and that is what is sold.
this data set is totally different. i hope GM pays for this.
Re:
You can’t even anonymize car location data. Only one person’s car goes between his/her home and work each workday.
Re:
Whenever somebody tells you data has been “anonymized”, they are about as truthful as a peddler selling you snake oil.
Re:
In this case, you thought wrong.
However, as other people have replied already, it takes very little additional effort to de-anonymize data. And once the attached ID has been de-anonymized, it becomes yet another source of non-anonymous data for de-anonymizing yet more data.
So what happens when someone buys information on all police officers driving habits and starts killing them off?
I swear all you corporate ass lickers haven’t thought of all the terrible ways this can go horribly wrong
Re:
Will they be using a car when they start killing off police officers?
I could put together a daily summary of my activities and put it on a website for free. Would the GMs and Lexisnexises try to stop me? Would I be infringing upon their rights? If so how? What if lots of people put their info there for free ..
A friend of mine tried to use the advertised insurance tracking devices that plug into your OBD port and create a detailed report for the promise of a cheaper policy. However a safety feature on his Mercedes-Benz that allows you to give the brake pedal a brief extra press to engage the hold feature. Which is like a hill hold feature it locks up the car from rolling at a light and allows you to relax your leg and take foot off of pedal. Well that extra little push to engage caused him to rack up hard stop reports. Giving him a very poor driving score.
Re:
… which goes along with almost every other hard braking event: the car isn’t in a collision (due to the driver’s awareness), yet the insurance company uses the data as an excuse.
Re:
Which just goes to show they don’t even know how to parse the data in the first place. Color me surprised, i thought the insurance companies always did a good job with with everything.
Inevitable progress
“…but consumers should also be empowered to opt out of punitive surveillance and data collection without losing features or seeing entirely new, annoying restrictions.”
How do you expect the ensshittification of the car driving experience to proceed without these?
Re:
Consumers should be able to opt out of cars with shit in them.
Re: Re:
You can. I’ve found a whole list of such vehicles.
TO LATE
Mentioned before that everything is hacked, either by backdoors to the corps themselves or by Serious Hackers.
Gee, folks, if you have an “expectation of privacy” while driving your car, then I’m surprised that you aren’t driving around in naught but your underwear.
Re:
idk, perhaps it is an expectation of not being lied to?
Or maybe it is learning about all the undisclosed and useless crap included in purchase?
Re: Re:
Demanding anonymity while driving along public streets just ain’t gonna fly; your driver’s license and license plates pretty much assure that officials intend to hold you accountable for your poor driving from the get-go. This is not the hill where any sane person would want to stage their privacy battle.
Before too long I won’t be surprised to see a little black box in every car that’s sold. It’ll do this exact thing… and it’ll [probably] be in your car’s ToS. (Only one of the reasons I want as little electronics in my car as possible.)
Re: Re: Re:
Which isn’t the point at all, the point is that so much more information is gathered and sold to private interests.
Oh really? So why did you say this then:
You know it’s a problem, you have chosen a strategy to deal with it and yet you think it’s “not the hill where any sane person would want to stage their privacy battle”.
So what is it? Either it’s a problem you recognize or it isn’t.
Re:
People have a reasonable expectation of privacy, even in a public place. You are fully within your right to observe people in a public place, but the moment you start doing things that breaches a persons private sphere you’re in trouble.
A person who drives a car expects that their call history and phone contacts are private. They also expect that where they drive is largely private information, they don’t expect that the car manufacturer hoovers up all that and sells it to anyone.
And if you buy a used car with these “features”, you haven’t consented to any data being gathered.
If you care so little that you willingly reduce yourself to a number, please do, but don’t drag the rest of us into that dystopian shithole.
Re:
People do drop their kids off at school in their pajamas, dumbass.
Re: Re:
Added to clarify: the parents are wearing their pajamas, not the kids.
You just jam its transmiszions. Just use a a jammer that jams wireless Internet.
That is not illegal in the United States but is illegal in Canada and Mexico
Just like the kill switch that is coming can be jammed where it can receive transmissions
While jamming a kill switch woukd not break fcc rules, it might break other laws.