Is your car watching your every move? Can the cable company track your DVR habits?
Those two privacy issues are bubbling up in Congress, where lawmakers this week filed bipartisan legislation that would give car owners control over data collected in black box-style recorders that may be required in all cars as soon as next year. The move follows a separate proposal made earlier this month that would block telecommunications companies from tracking viewer activity with new digital video recorders (DVR) technology.
Most new cars already have black boxes, known as event data recorders (EDRs), but manufacturers aren't required to inform vehicle owners about their existence or the data they collect, according to the lawmakers.
"For me, this is a basic issue of privacy," Rep. Mike Capuano (D-MA) said in a statement. "Consumers should have control over the information collected by event data recorders in their own vehicles and they should be able to exercise control over the recording function. Many consumers aren't even aware that this technology is already in most vehicles."
Last year, the National Highway Traffic Safety Administration (NHTSA) proposed a new standard that would require all light passenger vehicles (weighing 8,500 lbs or less) and motorcycles built on or after Sept. 1, 2014, to have EDRs. The recorders, while similar in function to black boxes in airplanes, record far less information.
In response to the proposed new rules, Capuano and Rep. Jim Sensenbrenner (R-WI) filed the "Black Box Privacy Protection Act" to give vehicle owners more control over the information collected through a car or motorcycle EDR. The legislation requires manufacturers to notify consumers if an EDR is installed in their vehicle, to disclose its data collection capabilities, and provide information on how data collected may be used.
The bill also gives vehicle owners control over the data. All data collected by an EDR becomes the property of the vehicle owner under this legislation. The bill would make it illegal for anyone other than the vehicle owner to download or retrieve information without owner consent or a court order.
The legislation also requires manufacturers to give consumers the option of controlling the recording function in future vehicles equipped with event data recorders.
"As a strong supporter of the Fourth Amendment and privacy rights, I believe vehicle owners should have ultimate control over information collected by their vehicle's black box, including what data is recorded and who has access to it," Sensenbrenner said.
According to the NHTSA, however, EDRs do not collect any personal identifying information or record conversations and do not run continuously. What they would record is:
Vehicle speed;
Whether the brakes were activated just before a crash;
Crash forces at the moment of impact;
Information about the state of the engine throttle;
Air bag deployment timing and air bag readiness prior to the crash;
Whether the vehicle occupant's seat belt was buckled.
"EDRs provide critical safety information that might not otherwise be available to NHTSA to evaluate what happened during a crash -- and what future steps could be taken to save lives and prevent injuries," said NHTSA Administrator David Strickland. "A broader EDR requirement would ensure the agency has the safety-related information it needs to determine what factors may contribute to crashes across all vehicle manufacturers."
But lawmakers said many consumers are not aware that this data could be used against them in civil or criminal proceedings, or by their insurer to increase rates.
No federal law exists to clarify the rights of a vehicle owner with respect to this recorded data, according to Capuano.
A bill to stop your DVR from spying on you
On a separate matter, Capuano and Rep. Walter Jones (R-NC), filed the "We Are Watching You Act" in response to reports that national telecommunications companies are exploring technology for DVRs that would record the personal activities of people as they watch television at home.
"This may sound preposterous, but it is neither a joke nor an exaggeration," Capuano said. "These DVRs would essentially observe consumers as they watch television as a way to super-target ads. It is an incredible invasion of privacy."
For example, late last year Verizon patented DVR technology that monitors viewer actions in order to better target advertisements.
Intel has announced plans for a media streaming service and DVR with a camera this year that will track with recognition technology similar to that used in Microsoft's Kinect box. Unlike Kinect, Intel's box won't track motion, it would identify users and bringing up preset configurations on the box, according to Jon Carvill, director of Intel corporate communications.
The "We Are Watching You Act" requires prior consent from the consumer before a behavior-tracking DVR can be installed in a home. The operator of the technology must provide specific details on how collected information will be used, and who will have access to the data.
When the recording device is in use, the words "WE ARE WATCHING YOU" would appear, large enough to be readable from a distance, for as long as the device is recording the viewing area. If consumers opt out of the new technology, companies are required to offer a video service that does not collect this information but is otherwise identical in all respects.
Paul O'Donovan, an analyst with Gartner's Consumer Electronics Research Group, agreed with Capuano that DVRs are indeed becoming a very invasive technology.
It "goes way beyond the service provider monitoring what you're watching in order to offer recommendations or targeted advertising," he said. "That is already common place especially on sites like Amazon. But this is quite different, very invasive.... I'm not at all surprised that it [the legislation] is being proposed."
O'Donovan referenced Microsoft's Kinect motion-sensing game controller systems and how they could be used to track user's activity. But he said it remains unclear how images or audio, especially in the volumes that would be collected by millions of game owners, would be analyzed.
"Are there going to be rooms full of people watching the TV viewers in their homes, deciding what they are doing then deciding which adverts to show them?" he said. "This seems very subjective, expensive and not particularly efficient given the number of subscribers. So I suspect this is a technology that is unlikely to penetrate the market in any kind of volume in the near future."
Capuano, however, said that while DVR technology is in its early stages, it is important that Congress establish clear boundaries now before it becomes reality.
"Right now, there is nothing preventing companies from utilizing the technology, no obligation to notify the consumer before it is used and no obligation to give consumers the chance to opt out," Capuano's office said in a statement.
This article, Lawmakers move to block black box recorders in cars, was originally published at Computerworld.com.
Lucas Mearian covers storage, disaster recovery and business continuity, financial services infrastructure and health care IT for Computerworld. Follow Lucas on Twitter at @lucasmearian or subscribe to Lucas's RSS feed. His e-mail address is lmearian@computerworld.com.
See more by Lucas Mearian on Computerworld.com.
Read more about Privacy in Computerworld's Privacy Topic Center.