Data Generated by Connected and Autonomous Vehicles: Ownership, - PowerPoint PPT Presentation

Data Generated by Connected and Autonomous Vehicles: Ownership, Exploitation, Security, and Privacy Daniel A. Crane Frederick Paul Furth, Sr. Professor of Law, University of Michigan Counsel: Paul, Weiss, Rifkind, Wharton & Garrison LLP (New York) January 19, 2017

Roadmap • Connected and Autonomous Vehicles (“CAV”): Anxieties and Opportunities • How to get there: Ongoing initiatives in my world • Technology and Terminology • Applications and Use Cases • Six Big Questions Around CAV Data

University of Michigan Mobility Transformation Center (“MTC”) A world transformed • • Connected and automated mobility leads us to reset the objectives for our transportation system: • Motor vehicle fatalities and injuries reduced by a factor of 10. Annual lives saved U.S.: 35,000. • • Annual lives saved Germany: 3,200 • Annual lives saved World: 1.2 million (triple number of worldwide deaths from malaria) Motor vehicle energy efficiency increased by a factor of 10. • Contribute to major reductions of carbon emissions. • New transportation economy startups increased by a factor of 10. • System user time reduced by a factor of 2. • Freight transportation costs reduced by a factor of 3. • Use of infrastructure capacity increased by a factor of 5. • • Need for parking reduced by a factor of 5. • Physical proximity to transportation enhanced by as much as a factor of 2. • Land use for mobility, including parking, reduced by a factor of 2. Effects beyond cars: Redeployment of land for housing, greenspaces, parks, public or private buildings, • etc. on massive scale.

How to Get There

Mcity (opened 2015)

Willow Run Test Facility • 335-acre facility • Groundbreaking Nov 2016 • Goal: self-certification with CAV industry standards. • (Aside: how standards will be set raises huge IP and competition law questions).

Technology and Terminology • V2R • Society of Automotive Engineers Levels 1-5 • I.e., Google’s Waymo self-driving car (using LIDAR—light from a laser—to detect surroundings)

Technology and Technology • V2V • DOT NPRM 2016 • Dedicated short-range communications (“DSRC”)

Technology and Terminology • V2I • DSRC – pilot projects in U.S., Japan, Germany, etc.

Technology and Terminology • V2C, V2X • Uber, Lyft • Technology and deployment are in development.

CAV Data Privacy and Security– What kind of connection, what kind of data, what use cases? • V2R is unilateral, single-car navigation mechanism. • Autonomous, not connected. • Data has obvious commercial value (diagnostic, insurance, etc.) • Ownership and privacy is straightforward: data is function of single vehicle; data ownership tracks vehicle ownership

CAV Data Privacy and Security– What kind of connection, what kind of data, what use cases? Parking space scanning using external Mercedes/Bosch initiative cameras • Currently being tested in Stuttgart • To be rolled out this year on E- class • Mercedes cars will be “connected” (BMW soon also). • Data ownership remains with OEMs, vertical licensing.

CAV Data Privacy and Security– What kind of connection, what kind of data, what use cases? DSRC (limit 300 meters) Telematics

DSRC • Basic Safety Message: • No on-vehicle BSM storage of BSM data • Part 1: Core data elements (vehicle size, position, speed, • But, can be captured through heading acceleration, brake V2I infrastructure and system status) transmitted via back-haul comms network to local back • Part 2: Variable set of data end for storage. elements depending on vehicle (i.e., ABS activation) • NPRM: Must be stripped of VIN when collected at head end. • Not inevitable!

Ann Arbor Connected Vehicle Safety Pilot Model Deployment Features Implications (?) • 2012-2016, $31 million • Currently teaching interdisciplinary problem-solving • 3,000 private cars, trucks, and buses connected V2V and V2I via 5.9 GHz class. DSRC • Graduate students from law, • Equipped infrastructure (V2I): engineering, business, public • 45 intersections policy. • 3 curve-related sites • 12 freeway sites • Challenge: Commercial and • Security and privacy protocols regulatory use cases for the developed by USDOT and Collision Avoidance Metrics (CAMP) data? partnership

DSRC Data: Synergistic Regulatory and Business Interests? What we’re hearing What we’re fearing • Local governments want V2I • Next step to Big Brother infrastructure but can’t afford it watching all the time? • Believe that V2I could be made • Hacking, hijacking, malware. to pay for itself if data can be • Commercial interests driving monetized. regulatory uses. • Lots of companies (i.e., insurance, marketing, OEMs) interested in access to the data.

Telematics/V2C/V2X Features Ride Sharing Fleet Implications • Vehicles connected to local or • Goodbye to individual vehicle remote network. ownership? • Merger of automation and • Does data ownership correlate connectivity? with vehicle ownership? • Vehicles “driven” by the network?

Six Big Questions About CAV Data 1. Should there be privacy in vehicle data? 2. Will privacy track ownership? 3. Will privacy and security rules be contractual or constitutional? 4. Will privacy and security be property rights or liability rights? 5. Is elective privacy realistic? 6. Are the most interesting privacy and security questions temporary or permanent?

1.Should there be • Cars are inherently dangerous privacy in vehicle machines traversing public data? roadways. • Airplane pilots and ship captains don’t have strong privacy case. • Public has obvious interest in knowing who is driving them and how they are driving. • Perhaps disclosure should be a condition of risky participation in public infrastructure. • Or not!

• With full networked automation, 2. Will Privacy Track who will still want to own their own Ownership? car? • In U.S., at least, expectations of privacy diminish as property rights fade. • Personal data on employer’s server. • Passengers in someone else’s car. • Overnight guest in someone else’s home. • Will the vehicle sharing economy mean weaker privacy rights in vehicle data?

3. Will privacy and security rules be • Can CAV data privacy and security issues contractual or be adequately addressed through vertical mandatory? contracting and inter-firm competition? • Are there risks of consumer injury that private contracting will not adequately address? • Would a mandatory/regulatory approach stifle opportunities for innovation, choice, and realization of major CAV benefits? • Keeping in mind that wide-scale adoption of CAV technology may depend economically on commercial exploitation of CAV data.

Alliance of Automobile Manufacturers, Inc./Ass’n of Global Automakers Consumer Privacy Protection Principles (2014) • Transparency • Choice • Respect for Context • Data Minimization, De- Identification & Retention • Data Security

4. Will privacy and security be property rights or liability rights? Property right: You can’t use my data o unless I authorize you. Liability right: If you use my data, you o have to “pay me” for it. e.g., providing enhanced vehicle o performance, insurance premium reduction, etc. Liability rights are generally preferable o when there are strong network externalities, as is true with CAV data. The more cars are connected, the safer o the transportation network. Hold out problems created if strong o property rights are employed.

• Privacy: mandatory or elective? 5. Is elective privacy realistic? • Usual assumption: privacy is a waivable right. • If users have the right to disclose, do they “out” others who don’t choose to disclose? • In other words, does silence become disclosure?

Example: The Reverse Lemons Problem • Assumption: Individual drivers can choose to disclose or not to disclose their data to insurer. • Top 50% lower their fee through disclosure. • Once top half of pool removed, top half of remaining pool improves position through disclosure; regression all the way down to the worst driver. • Add optimism/self-serving bias.

6. Are the most interesting privacy and security questions • In a world with vastly diminished temporary or individual car ownership and permanent? accidents, is there any interesting data left to collect? • E.g., insurance value seems to disappear.

Data Generated by Connected and Autonomous Vehicles: Ownership, Exploitation, Security, and Privacy Daniel A. Crane Frederick Paul Furth, Sr. Professor of Law, University of Michigan Counsel: Paul, Weiss, Rifkind, Wharton & Garrison LLP (New York) January 19, 2017