Data Generated by Connected and Autonomous Vehicles: Ownership, - - PowerPoint PPT Presentation

Data Generated by Connected and Autonomous Vehicles: Ownership, Exploitation, Security, and Privacy

Daniel A. Crane Frederick Paul Furth, Sr. Professor of Law, University of Michigan Counsel: Paul, Weiss, Rifkind, Wharton & Garrison LLP (New York) January 19, 2017

Roadmap

• Connected and Autonomous

Vehicles (“CAV”): Anxieties and Opportunities

• How to get there: Ongoing

initiatives in my world

• Technology and Terminology
• Applications and Use Cases
• Six Big Questions Around CAV

Data

University of Michigan Mobility Transformation Center (“MTC”)

• A world transformed
• Connected and automated mobility leads us to reset the objectives for our transportation

system:

• Motor vehicle fatalities and injuries reduced by a factor of 10.
• Annual lives saved U.S.: 35,000.
• Annual lives saved Germany: 3,200
• Annual lives saved World: 1.2 million (triple number of worldwide deaths from malaria)
• Motor vehicle energy efficiency increased by a factor of 10.
• Contribute to major reductions of carbon emissions.
• New transportation economy startups increased by a factor of 10.
• System user time reduced by a factor of 2.
• Freight transportation costs reduced by a factor of 3.
• Use of infrastructure capacity increased by a factor of 5.
• Need for parking reduced by a factor of 5.
• Physical proximity to transportation enhanced by as much as a factor of 2.
• Land use for mobility, including parking, reduced by a factor of 2.
• Effects beyond cars: Redeployment of land for housing, greenspaces, parks, public or private buildings,
• etc. on massive scale.

How to Get There

Mcity (opened 2015)

Willow Run Test Facility

• 335-acre facility
• Groundbreaking Nov 2016
• Goal: self-certification with CAV

industry standards.

• (Aside: how standards will be

set raises huge IP and competition law questions).

Technology and Terminology

• V2R
• Society of Automotive Engineers

Levels 1-5

• I.e., Google’s Waymo self-driving

car (using LIDAR—light from a laser—to detect surroundings)

Technology and Technology

• V2V
• DOT NPRM 2016
• Dedicated short-range

communications (“DSRC”)

Technology and Terminology

• V2I
• DSRC – pilot projects in U.S.,

Japan, Germany, etc.

Technology and Terminology

• V2C, V2X
• Uber, Lyft
• Technology and deployment are

in development.

CAV Data Privacy and Security– What kind of connection, what kind of data, what use cases?

• V2R is unilateral, single-car

navigation mechanism.

• Autonomous, not connected.
• Data has obvious commercial

value (diagnostic, insurance, etc.)

• Ownership and privacy is

straightforward: data is function

• f single vehicle; data ownership

tracks vehicle ownership

CAV Data Privacy and Security– What kind of connection, what kind of data, what use cases?

Mercedes/Bosch initiative Parking space scanning using external cameras

• Currently being tested in

Stuttgart

• To be rolled out this year on E-

class

• Mercedes cars will be

“connected” (BMW soon also).

• Data ownership remains with

OEMs, vertical licensing.

CAV Data Privacy and Security– What kind of connection, what kind of data, what use cases?

DSRC (limit 300 meters) Telematics

DSRC

• Basic Safety Message:
• Part 1: Core data elements

(vehicle size, position, speed, heading acceleration, brake system status)

• Part 2: Variable set of data

elements depending on vehicle (i.e., ABS activation)

• No on-vehicle BSM storage of

BSM data

• But, can be captured through

V2I infrastructure and transmitted via back-haul comms network to local back end for storage.

• NPRM: Must be stripped of VIN

when collected at head end.

• Not inevitable!

Ann Arbor Connected Vehicle Safety Pilot Model Deployment

Features

• 2012-2016, $31 million
• 3,000 private cars, trucks, and buses

connected V2V and V2I via 5.9 GHz DSRC

• Equipped infrastructure (V2I):
• 45 intersections
• 3 curve-related sites
• 12 freeway sites
• Security and privacy protocols

developed by USDOT and Collision Avoidance Metrics (CAMP) partnership Implications (?)

• Currently teaching

interdisciplinary problem-solving class.

• Graduate students from law,

engineering, business, public policy.

• Challenge: Commercial and

regulatory use cases for the data?

DSRC Data: Synergistic Regulatory and Business Interests?

What we’re hearing

• Local governments want V2I

infrastructure but can’t afford it

• Believe that V2I could be made

to pay for itself if data can be monetized.

• Lots of companies (i.e.,

insurance, marketing, OEMs) interested in access to the data.

What we’re fearing

• Next step to Big Brother

watching all the time?

• Hacking, hijacking, malware.
• Commercial interests driving

regulatory uses.

Telematics/V2C/V2X

Features

• Vehicles connected to local or

remote network.

• Merger of automation and

connectivity?

• Vehicles “driven” by the

network?

Ride Sharing Fleet Implications

• Goodbye to individual vehicle
• wnership?
• Does data ownership correlate

with vehicle ownership?

Six Big Questions About CAV Data

• 1. Should there be privacy in vehicle data?
• 2. Will privacy track ownership?
• 3. Will privacy and security rules be

contractual or constitutional?

• 4. Will privacy and security be property

rights or liability rights?

• 5. Is elective privacy realistic?
• 6. Are the most interesting privacy and

security questions temporary or permanent?

1.Should there be privacy in vehicle data?

• Cars are inherently dangerous

machines traversing public roadways.

• Airplane pilots and ship captains don’t

have strong privacy case.

• Public has obvious interest in

knowing who is driving them and how they are driving.

• Perhaps disclosure should be a

condition of risky participation in public infrastructure.

• Or not!

• 2. Will Privacy Track

Ownership?

• With full networked automation,

who will still want to own their own car?

• In U.S., at least, expectations of

privacy diminish as property rights fade.

• Personal data on employer’s server.
• Passengers in someone else’s car.
• Overnight guest in someone else’s

home.

• Will the vehicle sharing economy

mean weaker privacy rights in vehicle data?

• 3. Will privacy and

security rules be contractual or mandatory?

• Can CAV data privacy and security issues

be adequately addressed through vertical contracting and inter-firm competition?

• Are there risks of consumer injury that

private contracting will not adequately address?

• Would a mandatory/regulatory approach

stifle opportunities for innovation, choice, and realization of major CAV benefits?

• Keeping in mind that wide-scale adoption
• f CAV technology may depend

economically on commercial exploitation

• f CAV data.

Alliance of Automobile Manufacturers, Inc./Ass’n

• f Global Automakers

Consumer Privacy Protection Principles (2014)

• Transparency
• Choice
• Respect for Context
• Data Minimization, De-

Identification & Retention

• Data Security

• 4. Will privacy and

security be property rights or liability rights?

• Property right: You can’t use my data

unless I authorize you.

• Liability right: If you use my data, you

have to “pay me” for it.

• e.g., providing enhanced vehicle

performance, insurance premium reduction, etc.

• Liability rights are generally preferable

when there are strong network externalities, as is true with CAV data.

• The more cars are connected, the safer

the transportation network.

• Hold out problems created if strong

property rights are employed.

• 5. Is elective privacy

realistic?

• Privacy: mandatory or elective?
• Usual assumption: privacy is a

waivable right.

• If users have the right to disclose,

do they “out” others who don’t choose to disclose?

• In other words, does silence

become disclosure?

Example: The Reverse Lemons Problem

• Assumption: Individual drivers

can choose to disclose or not to disclose their data to insurer.

• Top 50% lower their fee through

disclosure.

• Once top half of pool removed,

top half of remaining pool improves position through disclosure; regression all the way down to the worst driver.

• Add optimism/self-serving bias.

• 6. Are the most

interesting privacy and security questions temporary or permanent?

• In a world with vastly diminished

individual car ownership and accidents, is there any interesting data left to collect?

• E.g., insurance value seems to

disappear.

Data Generated by Connected and Autonomous Vehicles: Ownership, Exploitation, Security, and Privacy

Daniel A. Crane Frederick Paul Furth, Sr. Professor of Law, University of Michigan Counsel: Paul, Weiss, Rifkind, Wharton & Garrison LLP (New York) January 19, 2017