Still to be done: Federal legislation on the type of information that can be collected, who can access it, how it can be used, and how it can (or cannot) be shared with 3rd parties.

It has two main provisions: A car buyer would have to be notified by the dealer, at the time of purchase, that there is an EDR in the vehicle. Also, the owner’s manual for the new vehicle would have to list an EDR as part of the equipment and state what it records.

Mr. Stout said the bill would also make it clear that the owner of a car has the authority to either release — or not release — the information contained on the black box.

If the lawyer for another driver involved in an accident wanted to get that information, the lawyer would have to ask a judge for a court order to release it.

[via Privacy Digest]

Contrary to expectations, the rules don’t require automakers to install the boxes in every car, but they do require the boxes to record a minimum of 29 pieces of data, more than most black boxes currently record.In a nod to privacy concerns, the rules require automakers to disclose in the owner’s manual when a car has a black box and why it’s there. But privacy advocates say they’re disappointed that the rules don’t limit the amount of data the boxes can record or address concerns about how recorded data can be collected or used.

The article also mentions a troubling court ruling regarding the expectations of privacy with data gathered through such devices:

In New York this year, a defense attorney challenged the admissibility of information gleaned after police removed data from a defendant’s black box before obtaining a search warrant.A judge ruled, however, that the seizure was legal and that the driver had no reasonable expectation of privacy since he’d been on a public highway and exposed his driving behavior to anyone watching.

The judge’s logic violates the contextual integrity of the flow of personal information in the context of highway travel. Read more about the right of “privacy in public” and how the introduction of new vehicle technology might violate that right in my paper “Privacy and the Design of Vehicle Safety Communication Technologies“

Warren Webb at EDN.com has posted a nice summary article on the vehicle black box controversy, “Black Boxes Capture Car-crash Data, Controversy”:

With little fanfare or customer notification, some automobile manufacturers have for years been recording your driving habits. Initially for optimizing subsystem performance, event-data recorders have now evolved into devices that can store multiple data elements, including engine speed, vehicle speed, air-bag deployment, seat-belt use, and the state of the brakes before and during a crash. Although they are a boon to automobile designers, safety experts, insurance companies, and researchers, event recorders have also served as electronic witnesses to send more than one negligent driver to jail.

[...]Documenting driver digressions is the most controversial application of crash-data recorders. For example, recorder data can easily reveal whether a driver was speeding or braking before an accident. Although most experts agree that recorder information belongs to the vehicle owner, it is not always easy to conceal. ACLU (American Civil Liberties Union) lawyers say that most motorists do not even know that their vehicles have the recorders and that disclosure of information from the recorder is an invasion of privacy. ACLU associate director Barry Steinhardt says, “The loss of personal civil liberties always begins with the best intentions of our government,” referring to “in-car surveillance systems.” Yet insurance companies and opposition lawyers have, to the chagrin of many drivers, successfully obtained court orders to extract recorder data after a crash.

Webb also provides an excerpt from a GM Owner’s Manual which addresses the sharing of black box information:

To read this information, special equipment is needed and access to the vehicle or the SDM [sensing and diagnostic module] is required. GM will not access information about a crash event or share it with others other than

• with the consent of the vehicle owner or, if the vehicle is leased, with the consent of the lessee,
• in response to an official request of police or similar government office,
• as part of GM’s defense of litigation through the discovery process, or
• as required by law.

In addition, once GM collects or receives data, GM may

• use the data for GM research needs,
• make it available for research where appropriate confidentially is to be maintained and need is shown, or
• share summary data which is not tied to a specific vehicle with non-GM organizations for research purposes.

As I’ve discussed previously on this topic, the introduction of black boxes into vehicles might violate the contextual integrity of the flow of personal information in the context of highway travel.

One of the concerns regarding new information technologies used in cars is the ownership of the data. This is a particular concern in the case of black boxes, systems that record pre-accident vehicle data, mostly for the benefit of insurance companies. It is good to hear, then, that North Dakota has become the first state to pass legislation giving drivers sole ownership rights in a car’s black box:

The legislature overwhelmingly approved the bill, which also aims at requiring auto manufacturers to notify owners of the presence of black boxes in their vehicles. It would require a court order before any of the information recorded by the box can be used in court, and prohibits insurance companies from making access to the box a condition of obtaining coverage.