How Your Car Might Be Sharing Data Without You Knowing

Contrary to what you may have heard, your car isn’t necessarily beaming all sorts of info directly to your insurer. Connected cars can collect information like your location, how you drive, devices connected to your car and the condition of your car. Consent requirements vary by situation across Canada.

To understand this topic better, we looked into the Office of the Privacy Commissioner of Canada’s connected-vehicle evidence, its guidance for Internet-of-Things manufacturers, its consent guidance, and its guide to private-sector privacy laws across Canada.

Is Your Car Sharing Data, And Can Your Insurer See It?

Your vehicle may have the ability to collect or transmit information using a connected services account, an in-vehicle cellular connection, a connected device, or downloaded apps. Your auto insurer does not automatically receive all of this information.

Insurer access may follow a program you joined, an authorized disclosure, a legal process, a claim investigation or a documented data-sharing arrangement. Data sharing is subject to your vehicle’s year/make/model/trim level, connected services account and the province.

If you replaced the vehicle and noticed a change in the premium, it doesn’t necessarily mean the insurer had access to your vehicle’s information. Premiums can increase or decrease based on approved rating factors such as the vehicle’s theft or repair costs and usage.

Cars And Data Sharing At A Glance

Telematics technology can collect and transmit information about how you drive.

• Different types of users (vehicle owners, primary drivers, occasional drivers and passengers) may have varying levels of account access and privacy options.
• Deleting a paired phone from a vehicle does not delete the automaker account or vehicle profile. This also doesn’t delete data that’s stored remotely.
• Turning off a particular privacy option may not stop the sharing of data for safety, service, emergency, or legally required situations.

What Is Telematics And How Does It Work?

Some auto insurers offer telematics programs you can opt into, allowing you to share your driving data in exchange for a potential discount.

Before opting into a telematics program, consider how much information the insurer collects, how it assigns trips to individuals, how long it stores that information, and what happens to it when you opt out.

Read More: See How TAG Vehicle Tracking Works

Is Your Car Insurance Data Being Shared Without Consent?

Consent does not have to look one way. Under Canada’s privacy laws, a single opt-in checkbox is not the only valid form of consent. The form of consent depends on the sensitivity of the information, individuals’ reasonable expectations, and the risk posed by the processing. The law also recognizes certain situations where an organization can process personal information without consent.

When it comes to your car insurance policy, make sure you understand how your personal information is used, who it’s shared with, and why.

The federal Privacy Commissioner cautioned that connected cars may collect very personal information about their drivers and passengers, including their whereabouts, daily routines, and other connected devices. It indicated that safety-related data may still need to be processed, while meaningful choice may apply to secondary uses.

Read More: See How Usage-Based Car Insurance Works

What Canadian Law Says

PIPEDA regulates many private-sector businesses, including privacy practices that cross provincial or international lines. However, three provinces, Alberta, British Columbia, and Quebec, have substantially similar laws that regulate many private-sector privacy practices within the province.

Therefore, not all complaints belong with the same regulator. Where to send a complaint depends on the organization, the activity and the province.

What Could Go Wrong?

• A trip may be attributed to the wrong driver, which can affect family disputes or some car insurance programs.
• Used cars not properly reset could include prior owners’ data, including contacts, destinations, accounts, garage openers, etc. Rental cars could be returned with renters’ contacts, destinations, or phone calls.
• Someone gaining access to your account could learn where your car is or gain access to connected features if your password isn’t secure or has been compromised. Use a unique user ID/password combination for connected services, and turn on multi-factor authentication if available.
• Turning off connected services, GPS, or the cellular modem may disable updates, theft recovery, emergency calling, remote commands, and connected features. Check whether any features depend on location services or connectivity before making changes.

What You Can Do To Protect Yourself

For A Vehicle You Own

• Make a list of apps, accounts, plug-in dongles, phones, insurer’s connected vehicle programs, etc., associated with your vehicle.
• Find the vehicle’s settings for connectivity and privacy and make a list of settings, so you’ll remember where you started. Then make changes.
• Read the privacy notice for your model year. Look for these words: collect, disclose, insurer, analytics, location, retention, delete, withdraw. Make a list of the data the automaker collects or uses.
• Ask the automaker and insurer what happens when features are turned off, especially for emergency and security.
• If it’s still unclear what personal information is being associated with you, submit an access request for your information.

Before Selling, Returning Or Renting A Vehicle

• Unpair your phone from the vehicle and delete any personal information, including messages, contacts, user profiles, Wi-Fi networks, favourite locations, navigation destinations or garage door opener programming. Follow the instructions to perform a privacy or factory reset on the vehicle.
• Sign out of any accounts, including connected or media accounts. Follow your service provider’s instructions for removing the vehicle from any connected services/app. Note that resetting the vehicle’s screen may not delete data stored on a server or accessible from an app.
• If buying a used vehicle, ask the dealer/seller to verify that the former owner has been removed so you can register.
• When renting, limit what information you connect to the vehicle and verify it’s been removed before returning.

A Short Privacy Request You Can Send

Use the organization’s secure channel. Provide only the information the organization needs to identify your account. What personal information do you hold about me or this account? Where did it come from? For what purposes has it been used, and to whom has it been disclosed? How can I correct inaccurate information, withdraw optional consent and delete information that no longer needs to be retained? What services will stop if I do so?

Keep a copy of the request, their response, and the date(s) of communication. If you’re not satisfied with their response, you may wish to continue through the organization’s privacy complaint process. If that doesn’t lead to a solution, determine whether the federal, Alberta, British Columbia or Quebec privacy office has jurisdiction.

Read More: Review Wider Cyber-Security Threats That Can Affect Personal Data