During the pandemic, I bought my first car in a long time so I could avoid the public transport I usually embraced when going to band practice or taking my kid to an appointment. I got a 2016 Skoda, for a bunch of reasons: I scored a good deal; I live in an apartment and Berlin’s streets didn’t yet have enough charging infrastructure for an electric; the Skoda Rapid was spacious and reasonably fuel-efficient; buying a Czech vehicle meant I could legitimately claim to have a Bohemian ride; and the thing was just old enough to not be fitted with internet connectivity and assorted privacy-busting technologies.
That last factor was really driven home (sorry) today with the release of an absolutely damning report from Mozilla. The Firefox maker looked at 25 car brands’ privacy and security and found all of them severely lacking. Cars turned out to be “the worst product category we have ever reviewed for privacy,” Mozilla’s team wrote:
“While we worried that our doorbells and watches that connect to the internet might be spying on us, car brands quietly entered the data business by turning their vehicles into powerful data-gobbling machines. Machines that, because of...all those brag-worthy bells and whistles, have an unmatched power to watch, listen, and collect information about what you do and where you go in your car.”
How bad are we talking? Kia’s privacy policy for owners (so, not just for visitors to its website) says the company may have collected and sold to third parties information about its customers’ “sex life or sexual orientation.” Nissan’s policy also says it will collect information on sexual orientation and “sexual activity,” which it may then use for targeted marketing and other purposes. Most of the car brands are happy to share information with government and law enforcement in response to a mere “request” rather than a court order and, as for security, Mozilla noted it remains unclear whether any of the cars even encrypt the data that’s stored on them.
I asked Kia why it needs to collect information about drivers’ sex lives and to whom it transmits such data; I got sent a link to a letter that the auto industry just wrote to U.S. congressional leaders via its Alliance for Automotive Innovation. The letter sings the praises of privacy principles that automakers adopted in 2014, saying they “continue to distinguish the auto industry from other industries as one dedicated to safeguarding consumer privacy.” But how is collecting information on someone’s sex life consistent with the principle of “collecting and retaining identifiable information only as needed for legitimate business purposes”?
The automakers claim their principles are so strong that they should provide the basis for that mythical beast, a federal U.S. privacy law. However, look at Kia’s European privacy policy and you will find nary a mention of collecting and selling sexual information. That might be because the EU has an actual strong privacy law in the General Data Protection Regulation, which doesn’t allow such sensitive data to be gathered without the individual’s explicit consent. The GDPR also says companies must let users delete their data, which only two of the companies Mozilla reviewed (Renault and Dacia) do, and only in Europe.
So yeah, the U.S. should by all means get a federal privacy law, but maybe automakers aren’t the ones who should write it. More news below.
Want to send thoughts or suggestions to Data Sheet? Drop a line here.
David Meyer
