Maintaining privacy and security with connected cars | The TechTank Podcast

CO-HOST DARRELL WEST: [00:00:00] Thanks for joining our Brookings TechTank podcast. I’m Darrell West, a senior fellow in the Center for Technology Innovation at the Brookings Institution. It is an eventful time in the history of transportation. Both cars and trucks are being digitally connected through online sensors, safety features, and entertainment systems. Some observers even refer to vehicles now as, quote, “smartphones on wheels” due to their around-the-clock connectivity. This situation offers tremendous convenience for drivers and passengers. People can access digital resources whenever they’re on the road, and avail themselves of a range of entertainment options. At the same time, though, the ubiquitous connections raise questions about privacy, legal liability, and consumer protection. To help us understand this situation, we are pleased to be joined by Ian Barlow. He is Of Counsel at the Wiley Law Firm, where he focuses on consumer protection, privacy, and advertising. Previously, he was deputy director of the Federal Trade Commission’s Office of Policy Planning, and also had senior roles in its Bureau of Consumer Protection. He holds a JD from the George Washington School of Law. Ian, welcome to our Brookings TechTank podcast.

GUEST IAN BARLOW: Thanks so much for having me. Very happy to be here today, Darrell, and appreciate the opportunity to talk with you.

CO-HOST DARRELL WEST: I know that you have considerable expertise on connected cars through, both your law firm affiliation, as well as your background at the Federal Trade Commission. So perhaps we can start with an overview of the current situation. How are cars being connected?

GUEST IAN BARLOW: Sure. Cars today are connected in many ways. They have sensors, telematics, hardware, and wireless communication technology that, allow them to send and receive data in real time, communicating with other cars, traffic signals, cloud [00:02:00] platforms, car manufacturers’ servers, and drivers’ own smartphones simultaneously. And you mentioned that in many ways cars today are like giant cell phones or rolling cell phones. They have embedded systems that connect to the manufacturer’s servers using cellular service, and some cars also may connect directly to third-party apps like Google Maps or Spotify. If you think about this, in the big picture, this makes a ton of sense that cars today are connected, in all these ways, as so many of us spend more time in our cars than any place outside of the house or our office. And most of us want connectivity all the time.

CO-HOST DARRELL WEST: What are the benefits that this creates for consumers?

GUEST IAN BARLOW: So, there are a lot of benefits. One primary benefit is over-the-air updates that manufacturers, car manufacturers, can do remotely so that- drivers or owners don’t have to bring their cars in for service. And, anything that can help me not have to take my car into the shop or the dealership is a huge win. Another benefit is connectivity enables all kinds of driver, assisted driving technology. Modern cars gather information as we drive about our speed, road conditions, distance from other cars, that fuel, no pun intended, driver assistance technology. And, so in an environment where more drivers than ever are driving while distracted, it’s incredible to have automated safety systems that help us, stay in the lane, brake when necessary, a- and all of that is, made possible because of this connectivity. And I’ll share another benefit that’s unique to my personal life. We have a 16-year-old new driver in our family. She has her permit now and still has to drive with a [00:04:00] parent, but in a few months she’ll be out there on her own with a full license. And connected cars allow parents and guardians to monitor their teenager’s driving behavior, like hard acceleration or braking, while they’re driving out on their own, a- and also to put in geofencing alerts when teenage drivers drive outside of certain specific areas. So these are just a few of the different, consumer benefits, and there’s also features in the car itself like remote start and many others that are only possible because of this connectivity.

CO-HOST DARRELL WEST: Yeah, I’m sure a lot of those, systems, do make parents feel much more assured as their, kids are getting out on the road. I’m not sure how the teenagers feel about this kind of, parental oversight, but it certainly is an important new feature of the, connected car, world. And you mentioned the, vehicle-to-vehicle communications, and so of course there are systems where vehicles can communicate directly with other cars that are on the road and share information about navigational obstacles, traffic patterns, road conditions, and traffic signals. How does that work, and how is that affecting the safety situation?

GUEST IAN BARLOW: V2V, or vehicle-to-v-vehicle communications, have been talked about for years, and there have been regulations a- about them that have been proposed for decades now. early on these systems worked by transmitting information via dedicated short-range communications that are like a form of radio waves, and they used a dedicated band, but there wasn’t a ton of implementation. Today these systems operate, more via 5G cellular or cellular service. there are obviously huge potential s- safety benefits from cars receiving real-time information from each other. Particularly where a visual line of sight is blocked. You can [00:06:00] imagine you’re on the highway behind a large truck, you can’t see the car in front of that truck, right? And so when the car in front of the truck stops short, perhaps the truck in front of you doesn’t notice or stop, but your car still can get an alert via V2V, communications that the car in front of the truck has braked hard, and your car may implement automatic braking systems to avoid colliding with the truck. These systems haven’t been as widely implemented as other types of connected features, and to work the best, they really probably require very widespread implementation. But there’s still a lot of potential safety benefits there.

CO-HOST DARRELL WEST: I know I always hate it when I’m stuck behind a large truck and not able to see what is going on in the highway right ahead, so these, V2V, features certainly offer some, significant safety advantages. But what are the risks for consumers with all these digital connections? What kind of privacy concerns are developing, and how are people reacting to them?

GUEST IAN BARLOW: So I think the concerns are very similar to concerns about a wide range of technology, all, all our devices, all our technology, and, concerns focus around privacy and data security, and these are balances that happen with all emerging new technology. But, here in the context of connected cars, the primary privacy concerns have been about sharing of driver’s location data history, and also what’s been called their driver behavior, data about, how drivers brake, accelerate, how fast they take a turn. And we’ve seen several government enforcement actions and significant private litigation about these issues. In particular, there have been [00:08:00] allegations that car manufacturers collected and sold consumers’ driver behavior data to insurance companies, sometimes through a dedicated data broker acting as a middleman, and the allegations are that this was done without consumers’ knowledge or consent. And, according to these lawsuits and enforcement actions, some consumers then had their insurance rates increase or lost coverage as a result. But, we’ve seen that this has been addressed by regulators. It’s being addressed through litigation, and, we’ll see how that plays out. Data security is also a risk. There’s a risk whenever data is collected. There’s a risk that bad actors will try and access it, and the information cars collect is no different. Here, there is a little bit of concern because of- the danger that can present itself if bad actors are able to access computer systems that are used for assisted driving technology. As a result, of some of these concerns, the Federal Communications Commission and the Department of Commerce have both been active here in addressing the use of vehicle connectivity hardware and software produced by companies under the control or jurisdiction of certain foreign nation states.

CO-HOST DARRELL WEST: So I know there are questions about legal liability in cases of accidents or highway fatalities. Can people’s online vehicular information be used against them in legal settings?

GUEST IAN BARLOW: First of all, the, behavior data about the past events, like how I drove for the last five years, or how somebody involved in an accident has a history [00:10:00] of driving, that’s subject to the same kinds of evidentiary rules most likely as any sort of pattern or behavior evidence is used where one party tries to introduce it in court or in litigation as evidence that somebody’s acting in conformity with their past habits. And there are longstanding evidentiary rules that apply to that, just like any other context. So I think in terms of, legal use regarding accidents, I think the legal system has really longstanding and, well-developed practices in place to address that.

CO-HOST DARRELL WEST: So earlier, you mentioned the issue of insurance companies, so I’m just curious how companies are using online data to possibly set insurance rates.

GUEST IAN BARLOW: Insurance companies are always going to try and get the most accurate data about drivers to set rates and underwrite policies. And if you think about it, there, there’s a lot of generalizations that, insurance companies use to set prices for car insurance using demographics that may not be as accurate on an individual basis, right? For years, companies factor into their equation where people live, how old they are, what their gender is, particularly with younger drivers, and a lot of factors that insurance companies think are indicative of how somebody might drive. But with that data, they might get a very accurate picture of how often somebody comes to a short stop and appears they weren’t paying attention, or how often they quickly accelerate. So, insurance companies obviously want that data, but there are a lot of legal risks those companies are balancing now. [00:12:00] And, I talked about some of those legal risks a minute a- two ago. But I think one thing we might see more of is companies asking their customers if they want a potential discount for voluntarily providing access to their driving behavior data. Without commenting too much on my own driving style, I’ll say when I bought a, new car a couple of years ago, my insurance company did ask me if I would consent to this, if I was interested, and I personally declined. but many people may opt in and say, “Look, I’m a safe driver, and I think this will, lower my rates.” And, many people have multiple reasons for declining, not just that they think they’re n-not a good driver. But I do think that may be one way we see this arise more in the future, with companies just directly asking, if they wanna opt in, if they want a discount for voluntarily providing access to that behavior data. I do think in the wake of recent enforcement and private litigation, there will be much less use of data without explicit customer permission when it comes to, driver behavior data about how people drive.

CO-HOST DARRELL WEST: No, I think that, discount rate, issue is an interesting, one, in the sense that… My sense is a lotta consumers have no idea the wealth of digital data that is available through the car because of all the applications, third-party, apps, and other, people who have access to that information, the role of data brokers in buying and selling information. So it may be that people are willing to accept the discount on the insurance rates, but not knowing the full extent of the data and how that potentially could be used against them in the future. So I think that is an important thing for consumers to, think about.

GUEST IAN BARLOW: Yeah, absolutely.

CO-HOST DARRELL WEST: So I’m curious, how did the Biden administration think about the regulation of connected cars and [00:14:00] possible enforcement actions regarding them?

GUEST IAN BARLOW: I, certainly can’t speak to the Biden administration as a whole, but, when I was at the Federal Trade Commission during the Biden era, the FTC did, bring an enforcement action against companies involved in car manufacturer and a data broker involved in collecting consumer driver behavior data and selling it to data brokers, who ultimately then sold it to insurance companies. And this was, a large enforcement action. Many state enforcers, state attorneys general also took similar actions. And I think this is probably a bipartisan area where enforcers across the board want to ensure that consumer privacy is protected, while at the same time, the benefits of connected cars are also preserved, and that there’s not overly burdensome regulation or enforcement that ends up in limiting consumer options. And I think we, we have seen some continuity because that enforcement action that was launched under the Biden administration, we’ve seen similar enforcement actions from, state attorneys general led by conservative states, and, I, I don’t think there’s a ton of controversy amongst enforcers about that approach.

CO-HOST DARRELL WEST: So I’m curious what the Trump administration is doing in this area, and have there been any significant changes, in terms of how it’s handling connected cars compared to the previous administration?

GUEST IAN BARLOW: I do think in one aspect there are some new policy changes, particularly in, with regard to security and data security. And, I don’t know that these are really partisan issues here, but they certainly have occurred more recently. and, that [00:16:00] recent approach under the Trump administration, on data security has been that both the Federal Communications Commission and the Department of Commerce have been active in addressing the use of vehicle connectivity hardware and vehicle connectivity software produced by companies under the control or jurisdiction of certain foreign nations. And this is, this is not, to my knowledge, a highly politicized issue, and I think it’s one where the regulatory approach and enforcement approach has been somewhat more consistent.

CO-HOST DARRELL WEST: Are there any policy or regulatory actions that you feel need to be undertaken in order to protect consumers in this area?

GUEST IAN BARLOW: So I’m not an enforcer anymore, or a government, consumer protection advocate at the government anymore, but I can slip on my policy hat for a minute. And I’ll, say first, there are a lot of existing tools that enforcers and private litigants can use to protect consumers. And, I mentioned those tools at the FTC, Section 5 of the FTC Act, prohibition on unfair and deceptive acts and practices, has been used almost for 100 years now to address a range of emerging and developing technology. There was a time when television ads were new, and the FTC regulated them as a new technology. And today, the FTC looks at deception and unfairness in the newest forms of technology like AI and connected cars. so there’s a, ton of strong existing enforcement tools. So I don’t know that a lot needs to be done. And like I said, I do think even though those tools are powerful, regulators like FTC staff, state attorneys general, are cognizant of preserving [00:18:00] consumer benefits when they enforce. But I, will, without endorsing additional policy or regulatory actions, I will flag another issue that we haven’t talked about yet, where we’ve seen some legislative proposals, just to put that on your radar and on listeners’ radar. And that’s where connected vehicle information is used for repair diagnostics and, involves telematics data. And this brings into play a third party beyond the car owner and the car manufacturer, and that’s independent repair shops. Now, the independent repair shops have been arguing for years they want equal access to this telematics data to be in the same position as dealer repair centers. And let me break that down a little more granularly for you. On a granular level, what that means is connected cars are constantly sharing with the manufacturer data about the vehicle’s emissions, mechanical issues, when it’s time for service, et cetera. The car manufacturer can then use that data to send it to the dealer, who can use it to send customers reminders, “It’s time to service your car.” Now, independent repair shops have been arguing that they should have equal access to this repair data, and they, often present it as a right to repair, consumer’s right to go to individual repair shops. I think it may be, as a technical matter, more of an advertising fairness issue rather than a repair fairness, because as the owner of the car owner is still getting equal access and able to make their own decisions about where to go. And it may be that the repair shops really just want the same access that the dealer or the car [00:20:00] manufacturer gets. But this right to repair issue about telematics data is another one that, should just be on people’s radar as an area where the use of, connected cars technology changes the prior dynamics in the competitive landscape.

CO-HOST DARRELL WEST: No, I think that is an important point, and I know there are a number of, states that have proposed right to repair, laws, and that’s something that consumer advocates, should be, paying attention to. So I wanna thank Ian Barlow for sharing his thoughts with us today. So Ian, it was great to get your insights about this subject, and we appreciate you taking the time to, speak with us.

GUEST IAN BARLOW: Thanks, Darrell. This was great, and I appreciate it.

CO-HOST DARRELL WEST: At Brookings, we write regularly about connected cars and autonomous vehicles, and you can find more information on our Brookings TechTank blog located at brookings.edu. Thank you very much for tuning in.