Page 25 - Cyber Warnings

Privacy and Security Issues in Autonomous Cars

by David Navetta, Boris Segalis and Kris Kleiner, Norton Rose Fulbright US LLP

As the development of self-driving car technology progresses, the prospect of privately-owned
autonomous vehicles operating on public roads is nearing. Industry experts predict that
autonomous vehicles will be commercially available within the next five-to-ten years. However,
the use of this technology presents significant privacy and security issues that should be
explored and addressed before these vehicles are fully commercialized.

I. Privacy issues
Because autonomous vehicles are largely experimental at this time, it remains unclear what
type of personal information may be collected by these vehicles. Nonetheless, at a minimum,
location data associated with a particular vehicle will be tracked and logged. Location tracking
has already proven to be a lightning rod with respect to mobile phones. Some of the privacy
considerations related to the use of autonomous cars are discussed further below.

a. Owner and Passenger Information
Perhaps the most important information that could be collected, particularly when combined with
other information discussed below, is identifying information about the owner or passenger of
the autonomous vehicle. It is likely that the autonomous vehicle would need to maintain
information about the owner and passengers for a variety of different purposes. For example,
the vehicle would likely need to maintain information about passengers to authenticate
authorized use. Furthermore, information about the passengers would also lend itself to a
variety of conveniences that are common in many cars available today, including customizable
comfort, safety, and entertainment settings. It is likely that cars, based on setting preferences
and other information collected while in use, will be able to identify drivers, passengers and their
activities with a high degree of certainty.

The Drivers’ Privacy Protection Act and other federal statutes, including the Electronic
Communications Privacy Act and Federal Communications Act, could apply to certain aspects
of autonomous vehicle data and communications. Additionally, 47 states and the District of
Columbia have enacted laws applicable to personal information. While these laws are generally
applicable to data breaches, many also include requirements for safeguarding personal
information. Although these laws provide for some protections of various personal information,
because of the type of data involved, the manner of collection, or the entity collecting the data,
some or all of these protections may not be applicable to autonomous vehicles.

b. Location tracking
Location data is something that is necessarily implicated in the use of autonomous vehicles. In
fact, it has been happening for some time now, but additional location information would allow
the ability to provide additional features and benefits to the user. For example, navigation
features available in many modern cars include the option to save specific locations in memory;

25 Cyber Warnings E-Magazine October 2016 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide