Reduce Your Risk of Vehicle Data Breaches: Tips to Keep Your Information Safe
Personal information is harder than ever to protect, and much of it is stored in vehicles themselves. So, how can you protect your company and fleet users’ data?
Andrea Amico, founder and CEO at Privacy4Cars, is passionate about privacy and security, and is chock full of stats and facts on how far-reaching data sharing has become and how many companies have access to personal information. Vehicles themselves collect and store more information than most of us would ever realize, and there is growing history of breaches, warnings, lawsuits, and even settlements. Amico presented all of this in a session at March’s 2022 NAFA Institute & Expo, startling attendees with more than just his blue hair.
Amico first engaged the crowd by handing out USB filters that allow a cell phone to charge without its data being retrieved. The point was to warn attendees to never use other USB sticks, especially given by vendors, “because it’s how bad guys do things.”
Ad Loading...
Then, Amico provided some basic definitions: Security in this case is defined as preventing unauthorized people or companies from having access to personal data, and privacy is the right to have data in the first place.
Chances are you don’t really know how your car works, he said. Car collect data locally (and that data is not stored in a database that has traditional security and privacy) and increasingly they send data out. Consequently, just like with laptops, securing vehicle data must start from protecting the data that is on them... but the more connected they are, the more complex the issue becomes.
Andrea Amico of Privacy4Cars shares some scary and surprising information about just how much data retrived from cell phones connected to vehicles is shared. Here, Amico presents at the 2022 Government Fleet Expo. He delivered a similar presentation to NAFA I&E attendees in March.
Photo: Ross Stewart Photography
When you plug your phone into a car, whether to pair it or charge it via a USB, lots of information from that phone is collected. This can include:
Biometric IDs.
Passwords.
Contacts.
Call logs.
Text messages.
Calendar events.
Downloaded files.
Medical providers.
Navigation history.
Home address.
Garage codes.
Health and credit information.
Third-party apps.
Companies and individuals can buy this data for a steal, too. Amico said the current market price is somewhere between $10 and $60 per person per year.
While most drivers only see directions on their GPS navigation in the car, that geolocation goes much further than the vehicle's infotainment or the manufacturer. It is also shared with firmware providers, component manufacturers, telecom providers, other connected devices, traffic services, weather services, insurance companies, Google, Apple, and more.
“There's a lot of things in which America leads in, but privacy is not one of those things,” Amico said, referencing Europe’s General Data Protection Regulation (GDPR), known as the toughest privacy and security law in the world.
Ad Loading...
In the U.S., without a federal privacy law, data regulation is left up to states. And all 50 states do regulate the personal information collected by vehicles, but not all laws are equal. California, Colorado, Virginia, and Utah, have privacy laws modeled after Europe’s GDPR; while California adds on IoT security laws; and Illinois, Florida, California, Washington, as well as some cities, have biometrics laws. New Jersey was the first state to pass a bill about vehicle telematics and driver monitoring, where companies must tell employees they’re being tracked. If they don't, the company is actually liable.
Biometrics laws, in particular, are under scrutiny, and several companies are facing several lawsuits for violations. In an example, Amico offers this: “You drive a Tesla, it has a camera facing you, it is actually recognizing you, but plaintiff attorneys increasingly are arguing that it is not asking for your consent. In Illinois, for instance, the statutory damages for biometrics violations are $500 a person, so a smart attorney has run the tab and they figure out it's probably worthwhile suing Tesla.”
To help understand the statutes that apply to your state, Privacy4Cars offers a free online resource.
While many companies will issue statements about their ethics, anonymization of data, compliance with GDPR or CCPA, Amico advises digging deeper.
Ad Loading...
What to Read or Ask OEM & Telematics Providers
Privacy policies and terms of service.
Contract and clauses on consent, use, sharing and retention of data.
If they claim geolocation data is anonymized (if so, it’s a red flag as that is hardly possible).
Documentation of compliance with California’s IoT law (even if you’re not in California).
Take the Privacy4Cars fleet risk assessment (below).
Privacy4Cars Fleet Risk Assessment
To take this fleet risk assessment, score each row and total the sum of all rows to find your risk level.
Source: Privacy4Cars
There are steps you can take to protect your data. In 2018, the FTC actually advised fleets to dump the data stored in cars in a message called “Be discreet when you delete your fleet.”
Amico recommends connecting with fleet management companies (FMCs), many of which offer in-vehicle data deletion at the time of sale — Element, Wheels Donlen, and Holman all do, he said.
Actions to Take to Reduce Risk
Read all privacy and service policies.
Ask your FMC what solutions they have in place to help.
Engage legal.
Perform CISO/compliance checks.
Delete all in-vehicle data at handoffs and sale.
Perform a data privacy assessment.
Get vehicles under the same policy policies as other devices (laptops, phones).
Prune! What data do you really need?
Implement robust consent management.
Demand a telematics “kill switch” for off-work hours.
To the last point in the list above, Amico elaborates that in Europe, employees — and any family members — who use a work vehicle for personal use after hours cannot be tracked. California has plans to adopt this rule starting in January, and more states will likely follow suit. Until then, Amico recommends asking your telematics provider how to turn off tracking between shifts.
Ad Loading...
Additionally, consider adding to your fleet policy a clause about shared vehicles and rentals that requires data deletion at handoff.
“As a business, to protect your employees, you need to start protecting yourself,” Amico said.
The legislation would restore vehicle owners’ control over their personal data and give them the freedom to choose who it's shared with and how it’s used.
The rental car industry suppliers form an enterprise that merges the functions of rental fleet operations software with telematics and original tech tools.
Rental car operations will use the data to manage their fleets with advanced predictive maintenance, driver behavior monitoring, and vehicle health insights.
2025 ARN Fact Book Publisher's Corner: When investing in technologies such as AI to make your business more efficient, don't forget that your frontline employees are your brand.
Fleet managers are interested in tracking their vehicles’ location and monitoring status to prevent fraud, theft, and mistreatment. That helps cut operational costs and potentially lowers insurance premiums.
