Vehicle Data Privacy: Industry and Federal Efforts Under Way but NHTSA Needs to Define Its Role

The prevalence of connected vehicles—those with technology that wirelessly transmits and receives data—has raised questions about how the collection, use, and sharing of these data affect consumer privacy.

GAO was asked to review consumer privacy issues related to connected vehicles. This report: (1) examines the types, use, and sharing of data collected by connected vehicles; (2) determines the extent to which selected automakers' privacy policies for these data align with leading practices; and (3) evaluates related federal roles and efforts, among other objectives. GAO interviewed relevant industry associations, organizations that work on consumer privacy issues, and a non-generalizable sample of 16 automakers selected based on their U.S. passenger vehicle sales. In addition, GAO analyzed selected automakers' privacy policies (written notices and reported practices) against a set of leading privacy practices determined to be relevant to connected vehicles. To identify these practices, GAO reviewed a variety of privacy frameworks developed by federal agencies and others. GAO reviewed relevant federal statutes, regulations, and reports, and interviewed agency officials, including those from DOT, the Department of Commerce, and FTC.

Thirteen of the 16 selected automakers in GAO's review offer connected vehicles, and those 13 reported collecting, using, and sharing data from connected vehicles, such as data on a car's location and its operations (e.g., tire pressure). All 13 automakers described doing so on a relatively limited basis. For example, they reported using data to provide requested services to consumers and for research and development. None of the 13 reported sharing or selling data that could be linked to a consumer for unaffiliated third parties' use. However, as connected vehicles become more commonplace, the extent of data collection, use, and sharing will likely grow.

Automakers have taken steps, including signing onto a set of privacy principles, to address privacy issues. In comparing selected automakers' reported privacy policies to leading privacy practices, GAO found that these automakers' policies at least partially reflected each of the leading privacy practices, for example:

Transparency : All 13 selected automakers' written privacy notices were easily accessible, but none was written clearly.

Focused data use : Most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices.

Individual control : All 13 selected automakers reported obtaining explicit consumer consent before collecting data, but offered few options besides opting out of all connected vehicle services to consumers who did not want to share their data.

The Federal Trade Commission (FTC) and the Department of Transportation's (DOT) National Highway Traffic Safety Administration (NHTSA) are primarily responsible for protecting consumers and ensuring passenger vehicles' safety, respectively. FTC has the authority to protect consumer privacy and has issued reports and guidance and conducted workshops on the topic generally as well as on connected vehicles specifically. NHTSA has broad authority over the safety of passenger vehicles and considers the privacy effects and implications of its regulations and guidance. FTC and NHTSA have coordinated on privacy issues related to connected vehicles. However, NHTSA has not clearly defined its roles and responsibilities as they relate to the privacy of vehicle data. In response to emerging vehicle technologies, NHTSA included privacy requirements in a related rulemaking and included privacy expectations in voluntary guidance. Because of these actions, selected automakers and others said NHTSA's role in data privacy was unclear. NHTSA officials acknowledged that some stakeholders may be uncertain about its authority to address privacy issues. Federal standards for internal control require, among other things, that agencies define and communicate key roles and responsibilities. By clearly defining, documenting, and communicating NHTSA's roles and responsibilities in vehicle data privacy, NHTSA would be better positioned to coordinate with other federal agencies and to effectively oversee emerging vehicle technologies.

GAO recommends that NHTSA define, document, and externally communicate its roles and responsibilities related to the privacy of data generated by and collected from vehicles. NHTSA concurred with our recommendation.

Passenger vehicles sold in the United States today are increasingly  equipped with technologies that offer consumers a range of safety,  security, and convenience services, including roadside assistance and  systems that monitor vehicles remotely. As with other everyday objects  that are part of the expanding Internet of Things, these “connected  vehicles” can wirelessly monitor, collect, and transmit information about  their internal and external environment. For example, these vehicles can  collect and share data about where drivers go and how they drive,  information that used to be impossible or very difficult to collect. As the  number of connected vehicles grows, private companies, including  automakers, are considering how to use this data to generate revenue.  According to a 2016 industry report, the estimated worldwide revenue  from connected vehicle data could add up to between $450 billion and  $750 billion by 2030. As vehicles generate, collect, and transmit more  data, members of Congress, the Federal Trade Commission (FTC), and  others have recognized the potential for risks to consumers’ privacy. For  example, in 2015, FTC staff reported that information collected by  connected devices, such as vehicles, pose risks to consumers’ privacy  due to the volume of data collected and the lack of consumers’ control  over the practice.

You asked us to examine privacy issues related to data collected by and  transmitted from vehicles sold domestically. This report examines:  1.  the types of data collected by connected vehicles and transmitted to  automakers and how, if at all, selected automakers use and share  these data;  2.  the extent to which selected automakers’ privacy policies for  connected vehicles align with leading practices;  3.  selected experts’ views on privacy issues related to the commercial  use of data collected by connected vehicles; and  4.  federal roles and efforts related to the privacy of data collected by  connected vehicles.

This report focuses on privacy issues posed by services offered by  automakers to consumers who buy new connected passenger vehicles.  We did not focus on privacy issues related to consumers’ use of  smartphones that link with vehicles through interfaces such as Android  Auto and Apple CarPlay or aftermarket devices that collect and transmit  data—such as devices offered by insurance providers to track drivers’  behavior or that connect older vehicles to services such as roadside  assistance or vehicle diagnostics (e.g., Hum by Verizon). We also did not  focus on privacy issues related to event data recorders or that may  emerge as new connected vehicle technologies—such as automated  vehicles, vehicle-to-vehicle technology, or vehicle-to-infrastructure  technology—become more common.

To address our objectives, we reviewed applicable federal statutes and  regulations, our prior work, and reports by other federal agencies,  academics, and research organizations on privacy and connected  technologies. We also interviewed representatives of three organizations  that advocate protecting the privacy of consumers’ data and eight industry  associations representing automakers, automotive suppliers, application  developers, and telecommunication companies.

To determine the types of data collected from connected vehicles and  how, if at all, these data are used, we interviewed representatives of 16  automakers and 3 other industry stakeholders. We selected automakers  that sell passenger vehicles in the United States and identified them using  the membership lists of two automotive industry trade associations. We  identified and selected one additional automaker, which is not a member  of these automotive industry trade associations, due to its growing market  share and high profile in the connected vehicle market. We identified and  selected the other industry stakeholders based on their industry roles  (e.g., telecommunication companies, “telematics” service providers, and application developers). After interviewing selected automakers, we  summarized and analyzed their responses to identify themes relevant to  our research objectives. The views and information gathered through our  interviews with selected automakers and industry stakeholders cannot be  generalized to the industry as a whole. However, the 16 selected  automakers we interviewed produce over 25 vehicle brands and  represented around 90 percent of the U.S. passenger vehicle sales  market share in 2015.

To determine the extent to which selected automakers’ privacy policies  for connected vehicles reflect leading practices, we reviewed several  widely recognized privacy frameworks developed by the Organisation for  Economic Co-operation and Development and several federal agencies,  and from these frameworks identified a set of six leading practices that  we determined apply to the privacy of data collected by connected  vehicles for the purposes of this report. Those leading practices include:  transparency, focused data use, data security, data accuracy and access,  individual control, and accountability. We obtained information on the  reported privacy policies of the selected automakers by reviewing their  written privacy notices and interviewing their representatives about their  companies’ privacy practices. We then compared these privacy policies to  the six leading practices. We did not evaluate the extent to which  selected automakers followed their reported privacy policies.

To identify selected experts’ views on privacy issues related to connected  vehicles, we interviewed 16 subject matter experts. We selected subject  matter experts based on eight factors, including their backgrounds in  connected vehicles and privacy issues, relevant publications, experience,  and presentations. Interviews with selected experts covered a range of  issues related to privacy and data collected from connected vehicles. As  part of these interviews, we presented these experts with general privacy  concerns about the commercial use of data we identified from GAO and  other federal agencies’ reports and interviews with organizations that  advocate protecting the privacy of consumers’ data. After interviewing  selected experts, we summarized and analyzed their responses to  identify themes relevant to our research objectives. The views and  information gathered through our interviews with subject matter experts  cannot be generalized to all such experts, but they do provide insights  into relevant privacy concerns and solutions.

To examine federal roles and efforts related to the privacy of data  collected from connected vehicles, we reviewed documents and  interviewed officials from four federal agencies—FTC, Department of  Transportation (DOT), the Department of Commerce, and the Federal  Communications Commission—that we identified as having privacy and  consumer protection responsibilities that could relate to connected  vehicles. Because of DOT’s role in overseeing motor vehicles, we  compared DOT’s efforts to reevaluate and define key agency roles and  responsibilities as new vehicle technologies emerge with pertinent  Standards for Internal Control in the Federal Government and practices  identified in our prior work on agency collaboration. Further details  about our scope and methodology are in appendix I.

We conducted this performance audit from April 2016 to July 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Connected vehicles offer services and features to consumers through  wireless communication systems. Technologies, such as in-vehicle  sensors and global positioning systems, generate data that are  transmitted through two-way communication between a vehicle and a  central computer system or a call center. As shown in figure 1,  automakers use third parties to provide connectivity (e.g., enable a  vehicle to transmit and receive voice and data communications) and  typically contract with third parties to provide support for the services  offered in connected vehicles (“connected vehicle services”). For  example, automakers may contract with:  telecommunication companies to connect a vehicle to the internet or a  wireless network,  telematics service providers to provide connected vehicle services by  staffing calling centers and processing data, and  content providers to provide optional applications, similar to those  available on a smartphone, that consumers can access through their  vehicle’s console.

Connected vehicles can offer consumers a range of safety, security, and  convenience services. For example, roadside assistance and automatic  crash notification services allow for voice and data communication  between a vehicle and a person at a call center. In providing these  services, connected vehicles generate, transmit, and receive various  types of data, such as a car’s location. In this report, we categorized data  that are collected or that could be collected by connected vehicles into six  categories as defined and described in figure 2.

Personal information includes identifying information such as a  consumer’s name, address, e-mail or other information that directly links  back to an individual as well as other information that can be reasonably  linked to a specific consumer, computer, or device. For example, in the  connected vehicle context, data (e.g., GPS coordinates or airbag status)  that can be linked to a vehicle owner is often treated as personal  information. Personal information collected from vehicles varies in its  sensitivity. As reported by FTC staff, some personal information, such as  data on precise geolocation, is considered sensitive due to what it can  reveal about someone (e.g., routines).

There is no federal comprehensive privacy law governing the collection,  use, and sale of personal information by private sector companies.  Rather, federal statutes and regulations addressing privacy issues in the  private sector are generally tailored to specific purposes, situations, types  of information, or sectors or entities. For example, the Health Insurance  Portability and Accountability Act governs the use and disclosure of an  individual’s health information by certain entities. Federal law also does  not require all companies to have a privacy policy or to notify consumers  of their privacy practices. While no single federal agency oversees data  privacy issues, FTC is a law enforcement agency with a mission to  promote consumer protection and prevent business practices that are  anticompetitive, deceptive, or unfair to consumers. The National Highway  Traffic Safety Administration (NHTSA) within DOT is responsible for  vehicle safety.

Many organizations and governments have used the Fair Information  Practice Principles (FIPPs) to guide their privacy practices. The  Organisation for Economic Co-Operation and Development developed a  version of the FIPPs—a set of internationally recognized principles for  protecting the privacy and security of personal information—in 1980 that  has been widely adopted and was updated in 2013. While the FIPPs are  principles, not legal requirements, they provide a framework for balancing  privacy protections with other interests. Like other industries, the  automobile industry recently developed a set of privacy principles—the  Consumer Privacy Protection Principles: Privacy Principles for Vehicle  Technologies and Services (“Consumer Privacy Protection Principles”).  These principles are a self-regulatory framework influenced by the FIPPs  and were adopted by most automakers with vehicle sales in the United  States. The Consumer Privacy Protection Principles went into effect  January 2, 2016.

Selected Automakers Collect Different Types of Data from Connected Vehicles and Reported Limited Use and Sharing

Availability of Connected Vehicles Varies, but Selected Automakers Plan to Increase Offerings

Nearly all selected automakers offer connected vehicles or plan to offer  them in the next 5 or more years. Specifically, 13 of the 16 automakers  we interviewed sell new vehicles that met our definition of a connected  vehicle—ones that come equipped with technologies and services that  transmit and receive data wirelessly (see fig. 3). Four of these  automakers currently provide connected services in all of their vehicles;  most of the remaining automakers reported increases in their production  of connected vehicles over the last 5 years.

Of the 12 automakers we interviewed that do not currently offer  connectivity in all of their new vehicles, all but 1 told us they plan to do so.  Three plan to offer all connected vehicles in the next 3 to 4 years, and 8  plan to offer all connected vehicles in 5 or more years. Several  automakers noted that consumer demand will influence when they will  offer all connected vehicles.

While most automakers offer connected vehicles and services, not all  consumers with access to these services use them. Based on our  interviews with automakers, the percentage of customers who use these  services ranges from less than 50 percent up to 100 percent. Selected  automakers differed in how they offer these services to consumers. For  example, some automakers offer free trials for 3 months, 6 months, or 1  year, while other automakers offer these services at no additional cost.

The 3 automakers that do not offer connected vehicles or connected  vehicles services told us they do not collect any data from their vehicles.  Our discussion below focuses on the 13 automakers that offer connected  vehicles and services.

Collected Data Include Location, Vehicle Health, Driver Behavior, and Infotainment Data

Based on interviews with the 13 selected automakers that offer connected  vehicles, the types of data they collect from those vehicles vary. All 13  reported collecting vehicle health and location data (see fig. 4). However,  fewer automakers reported collecting driver behavior and infotainment  data, such as music selections and mobile applications used. These 13  automakers did not report collecting data related to vehicle occupants’  health or personal communications.

Selected Automakers Reported Using Collected Data Primarily to Provide Services to Consumers and for Research and Development

According to the 13 selected automakers that offer connected vehicles,  they currently use data collected from connected vehicles to provide  connected vehicle services, and some use the data for research and  development and marketing.

Connected Vehicle Services: According to all of these 13 automakers,  collected data are used to provide services, such as automatic crash  notification or roadside assistance, to customers. Providing these  services typically requires location, vehicle health, and for some  services, driver behavior data. For example, sensors in a connected  vehicle may detect that an airbag deployed. The connected vehicle  transmits this information to the automaker or the provider operating  the automatic crash notification service. The provider uses a vehicle’s  location, status of airbag deployment, rollover status, and other  pertinent information to inform and request assistance from  emergency responders.

Research and Development: All but 1 of these 13 automakers told us  they also use collected data for research and development,  specifically to improve their vehicles’ safety and performance. For  example, automakers may use vehicle health data (e.g., diagnostic  trouble codes) to identify an issue with a certain model or component  within their vehicles. Twelve of these 13 automakers also told us they  use these data to improve connected vehicle services they offer. For  example, these collected data allow them to see which services or  features consumers actually use and how they use them.

Marketing: Five of these 13 automakers reported using collected data  to market products and services to consumers, for example using  vehicle health data to target advertisements to specific consumers for  specific vehicle service or maintenance offers.

These 13 selected automakers differed on who owns data collected from  their connected vehicles. Specifically, 7 told us ownership of these data is  legally unclear or they do not yet have a position. Of the remaining  automakers, 3 said the vehicle owner owns the data, but the automaker  has a license to use them; 2 said the automaker owns the data, and 1  said the automaker owns anonymized data and the customer owns  personal data (e.g., data tied to a vehicle identification number). As we  reported in 2016, data ownership is a potential challenge to achieving  gains in transportation safety and efficiency. In the context of connected  vehicles, data ownership can determine who or what entity controls  access to the data and how they can be used.

Selected Automakers Reported Sharing Data on a Limited Basis

All 13 selected automakers that offer connected vehicles said they  typically do not share collected data with unaffiliated third parties. For  example, none of these automakers reported sharing collected data with  firms that collect and sell information (data brokers). When automakers  do share collected data, they said they typically do so with explicit  consumer consent, at the request of a consumer, or to comply with a valid  court order. Specifically, all of these automakers said they would share  collected data with law enforcement in response to a valid court order or  in exigent circumstances. Seven automakers said they share collected  data, specifically vehicle health data, with dealerships to aide in vehicle  servicing. Two automakers reported sharing collected data with  insurance companies to enable consumers to participate in insurance plans that base premiums on driving behavior. Several automakers  reported sharing and using collected data that has been de-identified  more widely than they do data that can be linked back to a vehicle or  vehicle owner. For example, one automaker discussed sharing de- identified vehicle health data with university-based researchers to  examine vehicle structural integrity after crashes. Other automakers  mentioned sharing de-identified location data with traffic services to  improve their accuracy. Some automakers we spoke with emphasized  that their current use and sharing of data may change as the industry  evolves and data collection expands.

Selected Automakers’ Reported Policies Partially Reflected Leading Privacy Practices Relevant to Connected Vehicle Data Privacy Automakers’ Reported Policies Partially Reflected Six Identified Leading Practices

As mentioned above, for the purposes of this report we identified six  leading practices most relevant to connected vehicle data privacy, based  on our analysis of the FIPPs and other policy frameworks (see table 1).

To assess the extent to which selected automakers’ reported privacy  policies reflected each leading practice, we identified multiple elements  for each practice. We then reviewed selected automakers’ written privacy  notice(s) and their responses to interview questions about their privacy  practices. We did not evaluate the extent to which selected automakers  follow their reported privacy policies. Although the leading practices are  interrelated, we focused our assessments on how fully the automakers’  practices met each leading practice.

We found that most selected automakers’ reported privacy policies at  least partially reflected each of the six identified leading practices.  Although we saw some variation among automakers, they tended to  reflect and not reflect the same leading practice elements. For example,  most automakers reported limiting the sharing of data and using  safeguards to protect data security. However, none of the automakers’  written notices were in plain language, and their reported data collection,  use, and sharing practices generally were more limited than suggested in  their notices. Automakers reported obtaining consent before collecting  data from vehicles, but they offered few options besides opting in and  opting out of sharing data.

Transparency: All 13 selected automakers’ written privacy notices were  readily accessible from their public websites, but based on our analysis,  none of the notices was clearly written. As we have previously reported,  FTC and others have recommended that privacy notices should be  readily accessible, clearly written, and describe all the purposes for which  personal data are collected and shared. All of the automakers’ notices  discussed the types of data collected; the potential purposes for collecting  the data, such as to provide the connected services; and some conditions  when data might be shared with third parties. However, none of the  notices was written in plain language, a lack that could make them difficult  for consumers to understand. In addition, most notices did not describe all  of the types and purposes of the connected vehicle data that were being  collected, but instead used broad language to describe this process. For  example, of the 15 notices, only 2 included a list with all of the actual  purposes for which the automaker collects data, and only 1 included a list  with all of the types of personal data collected. Two notices clearly  stated that the purposes identified for data collection were not exhaustive.  Although the use of broad language is common for privacy notices and is  not specific to the auto industry, it does not promote transparency.  Several automakers discussed their other efforts to increase  transparency. For example, one automaker reported revising its website  to offer a consumer-friendly privacy portal after signing onto the  Consumer Protection Privacy Principles. Three other automakers told us  that they display their privacy policies on in-vehicle displays. Two  automakers told us that a recently issued consumer guide could help  promote understanding about this issue. In January 2017, the National  Automobile Dealers Association and Future of Privacy Forum issued a  consumer guide outlining types of vehicle data, practices governing their  collection and use, and potential consumer options; the guide is to be  available at auto dealerships.

Focused Data Use: Most selected automakers reported limiting their data  collection, use, retention and sharing, but their policies varied. Most  written notices did not clearly identify data sharing and use practices. In  interviews, all 13 selected automakers reported limiting the data collected  from connected vehicles, with some (4 of 13) noting that they only collect  the specific data they need to provide the consumer with services. With  regard to data use, as discussed previously, all 13 automakers reported  they use collected data to provide direct consumer services, such as  roadside assistance, but some automakers (5 of 13) reported they use  such data for marketing other services. Also, all 13 automakers told us  that they use de-identified data when possible, such as when the data are  being used for research and development purposes. Most automakers  (12 of 13) also told us that they limit data retention, but policies varied.  For example, of the 12 automakers that limit retention, 8 told us that their  retention time frames depend on the type of data, while one of them  specified that it retains all connected vehicle data for 6 years regardless  of data type. Two automakers also told us that they are still developing  their policies, so their retention time frames may change. With regard to  data sharing, as mentioned previously, all 13 automakers told us that they  do not typically share collected data with unaffiliated third parties.  However, most automakers’ written privacy notices used vague language  and did not consistently reflect their relatively limited data collection, use,  retention, and sharing. For example, none of the notices stated that the  automaker would not use data for reasons other than those listed in the  policy, and only one notice specified the automaker’s data retention time  frame. In another example, less than half of the notices (6 of 15) stated  that data would not be shared with or sold to non-affiliated third parties,  such as data brokers. Similarly, less than half of the notices (7 of 15)  stated that location and driving behavior data would not be shared with  any parties besides service providers without first obtaining the  consumer’s consent. Only 2 notices included both of these statements  about sharing.

Data Security: Selected automakers reported using various methods to  safeguard data, including methods that we have reported could be  applied to increase vehicle data security. As we reported in 2016,  automakers can identify and mitigate cybersecurity vulnerabilities by  using practices such as conducting risk assessments and by employing  technological measures. In interviews, all 13 automakers reported using  policy and technological measures to protect data, such as limiting data  access to certain company staff, using firewalls and encryption, and  using “penetration testing” and “code reviews.” In addition, 12  automakers told us that they participate in the Auto-Information Sharing  and Analysis Center, an industry-operated forum that includes  automakers and parts suppliers. The center seeks to heighten awareness  and increase security by allowing industry stakeholders to share threat  information and potential mitigation strategies. Most automakers (9 of 13)  also reported conducting privacy risk assessments, which would involve  determining, among other things, the sensitivity of the collected data and  the potential risks if the data were improperly lost, accessed, or  disclosed. In addition, almost all of the notices (14 of 15) explained  safeguards used to protect data, and some (7 of 15) also included  examples of industry standard practices used for data security.

Data Access and Accuracy: Selected automakers reported offering  consumers various methods to access their personal account information,  but most of their notices were unclear about methods used to ensure data  accuracy. The majority (9 of 13) of automakers told us that consumers  can access and correct information, such as name and address, related  to the driver or subscriber. For example, 5 of these automakers noted  that such subscriber information can be accessed through websites or  mobile applications. One other automaker told us that consumers can  access information on the website or mobile application but must e-mail  or call the automaker to correct it. For other types of vehicle data—such  as location, vehicle health, and driver behavior—consumers’ access  varied among automakers. For example, some (4 of 13) automakers  reported that consumers can access their vehicle health data—such as  tire pressure information—through websites or mobile applications. On  the other hand, 2 automakers told us it is not possible for consumers to  access any data other than subscription-related data. With regard to data  accuracy, the majority (9 of 13) of automakers told us they take steps,  such as validation tests and other quality control measures, to ensure the  accuracy of data collected from connected vehicles. Although most (12  of 15) notices explained how to access and correct one’s data, only a few  notices (4 of 15) discussed actions the company takes to ensure data  accuracy.

Individual Control: Selected automakers reported that they obtain explicit  consent before collecting data and most seek consent again, but they  offered few options to consumers besides opting into sharing data and  receiving the connected services or opting out of the service entirely if  they do not wish to share data. In interviews, all 13 automakers told us  that they obtain explicit consent before initiating services that require data  to be collected and transmitted, typically through the consumer signing a  service agreement or activating the service. Also, the majority of  automakers (8 of 13) seek consent again in certain circumstances (e.g.,  when updating a service subscription or if the company’s data use  practices will change significantly). In addition, most of the notices (13 of  15) discussed consumer choices, including how to opt out of sharing data  with the automaker. However, all 13 automakers told us while consumers  can opt out of sharing data this would typically involve losing all  connected vehicle functionality, in part because connected vehicle  services are often bundled.

Accountability: Selected automakers reported using various methods to  ensure that their staff and third parties receiving personal data handle  them properly and most automakers’ notices discussed the methods  used. In interviews, almost all automakers (12 of 13) reported that they  work to ensure that third parties receiving data meet certain requirements,  such as following the automaker’s privacy policies, and most reported  including data-handling requirements in their contractual agreements.  Several also reported imposing additional requirements, such as asking  third parties to conduct privacy risk assessments. Nine automakers also  reported that they conduct risk assessments related to third parties’ use  of data collected from connected vehicles. Most automakers’ notices  included descriptions of the methods used to promote accountability and  designated which entity is ultimately responsible for properly handling  data. For example, almost all notices (14 of 15) named the company  responsible for handling personal data and provided contact information.  In addition, the majority of notices (9 of 15) outlined requirements that  third parties must meet before receiving data.

Privacy Notices Do Not Guarantee Privacy Protections

Views differ on the importance and effectiveness of privacy notices in  providing privacy protections for consumers. For example, FTC’s 2012  report recommended that companies should provide easy-to-use choice  mechanisms that allow consumers to control whether their data are  collected and how they are used; such mechanisms could include  privacy notices. In the report, FTC also recommended that privacy notices  should be made clearer, shorter, and more standardized to increase  consumers’ ability to comprehend and compare various companies’ data  practices. Most (14 of 16) selected experts in our review agreed with that  FTC recommendation.

However, FTC, we, and others have acknowledged that improved notices  alone cannot guarantee consumer protections. Specifically, FTC has  argued that clearer notices and improved consumer choices would need  to be combined with other privacy practices, such as focused data  collection and data security, to provide substantive privacy protections for  consumers. Furthermore, FTC stated that when combined, such practices  would help accomplish a broader goal of shifting the burden for protection  away from consumers and to the companies handling consumer data.  We have also reported that notices alone do not guarantee consumer  protections. For example, as we reported in 2016, some consumers do  not take the time to read notices, decreasing their ability to provide fully  informed consent. In another example, four experts in our review  mentioned the multiple decisions and corresponding large amount of  paperwork required for buying a vehicle as factors that would make it less  likely for a consumer to thoroughly read the privacy notice.

Selected Experts Had Concerns about Connected Vehicle Data Privacy and Automakers’ Privacy Efforts

Selected Experts Generally Agreed Broader Privacy Concerns Applied to Connected Vehicle Data

In interviewing selected experts on privacy issues related to connected  vehicle data, we presented the experts with general privacy concerns  about the commercial collection and use of data that we had identified  from our and other federal agencies’ reports and interviews with  organizations that advocate the protection of the privacy of consumers’  data and asked the experts if these issues applied to data collected  through connected vehicles. A majority of the experts generally agreed  that these general data privacy issues, as described in table 2, apply to  connected vehicle data.

All selected experts agreed that tracking, loss of consumer control over  personal information, and potentially insecure data were relevant privacy  concerns. They emphasized that using location data to track individuals is  particularly relevant in the context of vehicles. For example, one expert  said location data could paint a picture of an individual’s life, revealing  with whom they associate, the doctors they see, and the places they  frequent. Experts also raised concerns about potentially inappropriate or  illegal uses of location data, such as stalking. All experts expressed  concern about potential data access through a security breach; however,  no one we interviewed, including automakers, selected experts, industry  groups, or government officials was aware of an incident where a database storing connected vehicle data had been compromised  maliciously. Regarding loss of consumer control over personal  information, one expert explained that it is not possible for a consumer to  know exactly what is collected, when, and how the data are used.  Another expert noted that other technologies face this same challenge;  however, consumers may be less aware of what their vehicle is doing  than their computer or smartphone. In addition, vehicles may be used by  multiple individuals, and one expert expressed concern about how  multiple drivers of a car would be informed about data collection. Some  experts thought data sharing and third-party use could become a greater  issue as the auto industry evolves. These issues mirror concerns we  reported on in 2013 and 2015 about the collection, use, and sharing of  personal data by commercial entities.

The majority of experts we interviewed also agreed that the lack of  sufficiently informed consent (due to low consumer awareness and lack of  company transparency), disparate treatment, and little or no consumer  choice were relevant privacy concerns. Several experts said that, as in  other industries, informed, meaningful consent is difficult to obtain, as  consumers may not read notices and automakers may not present  privacy information clearly. Regarding disparate treatment, two experts  raised the example that data from connected vehicles could potentially be  used to treat consumers differently, and unfairly, in the provision of auto  insurance. Finally, experts raised concerns about consumer choice. For  example, as described above, several experts noted that consumers must  provide consent to all data collection and use or not receive any services.  Another expert said that consumers have limited choice because vehicles  are essential to people’s lives. Similarly, another expert noted that it is  difficult to compare privacy practices across automakers and connected  vehicle platforms and that consumers cannot easily change their minds  after buying a car, as it is a large financial investment.

Majority of Selected Experts Expressed Concern about Automakers’ Privacy Policies and Efforts

While we did not ask selected experts to comment on individual  automaker policies, some were concerned about automakers’ efforts to  protect consumer privacy. As previously discussed, automakers signed  onto the Consumer Privacy Protection Principles to demonstrate their  commitment to protect consumers’ privacy. However, the majority of  experts we interviewed (13 of 16) did not think that these principles  provide sufficient guidance to inform automakers’ actions or protect  consumers’ privacy. Some experts noted that other industries, such as  the credit card industry, have developed more specific self-regulatory  guidelines that include enforcement measures and better protect  consumers.

Most selected experts said the Consumer Privacy Protection Principles  lacked specificity about, for example, data use and consumers’ right to  protection. For example, they said the principles used “vague language”  and allowed for data use without consumers’ affirmative consent for  “legitimate business purposes,” which are not clearly defined. To  remedy these issues, six experts said the Consumer Privacy Protection  Principles should be more specific, and four said the principles should  define restrictions on data use. Most experts we interviewed agreed  automakers should limit data retention (13 of 16) and limit data collection  (12 of 16). While the majority of experts thought that automakers should  de-identify data (11 of 15) for focused data use, four experts expressed  skepticism about this practice, including whether it is possible to  completely de-identify data. In 2013, we reported concerns about de- identifying location data. Specifically, we found that some methods of de- identification can allow for an individual to be re-identified, and that  different de-identification methods and data retention practices may lead  to varying levels of consumer protection.

Other suggestions to improve the Consumer Privacy Protection Principles  included making the principles enforceable, making privacy information  accessible and transparent, explaining the rationale or risks and benefits  of data use, and laying out the trade-offs for consumers. All selected  experts agreed that automakers should be required to obtain explicit  consent for the use of sensitive data or data used in a manner beyond a  consumer’s expectations. In addition, the majority of experts we  interviewed (13 of 16) agreed that automakers should obtain consumer  consent at the time and in the context in which consumers are making a  decision about their data. Several experts said that consumers should  have access to personal data collected about them. However, auto  industry trade association officials said that the Consumer Privacy  Protection Principles provide automakers with a sufficient framework to  address privacy issues and allow automakers the flexibility to tailor  implementation.

FTC and NHTSA Have Efforts Related to Data Privacy Under Way, but NHTSA’s Role Is Unclear

FTC and NHTSA Have Efforts and Guidance Related to Protecting Data Privacy

While no federal law expressly confers broad privacy protections for  consumers’ data and no single federal agency oversees data privacy  issues, the FTC Act gives FTC the authority to bring actions against  companies or individuals that engage in unfair or deceptive acts or  practices in or affecting commerce. According to FTC officials, the FTC  Act applies to privacy and data security issues for connected vehicles.  For example, FTC officials said they could use this authority to bring an  action against an automaker that uses a consumer’s data without his or  her consent or in a way that violates the manufacturer’s stated privacy  policy. To date, FTC has not brought such a public enforcement action  against a connected vehicle manufacturer or its affiliates, but it has  brought such actions against other companies offering services in the  Internet of Things. For example, in 2016, FTC settled a case alleging that  critical security flaws in a company’s routers put the home networks of  hundreds of thousands of consumers at risk. In addition, as the primary  agency with authority over consumer privacy, FTC has ongoing efforts  related to protecting the privacy of consumers that use connected devices  in the Internet of Things, which includes connected vehicles. FTC and  FTC staff have issued guidance, including two reports—Protecting  Consumer Privacy in an Era of Rapid Change: Recommendations for  Businesses and Policymakers and Internet of Things: Privacy and  Security in a Connected World—both of which outline best practices for  companies. Prior to issuing these reports, FTC held outreach forums to  gather views from a variety of stakeholders on these issues. One of these  forums included a panel specifically focused on consumer-facing  technology in connected vehicles, which covered, among other things, an  overview of these technologies, security issues, and the diversity of auto  industry practices.

NHTSA, according to agency officials, has broad authority over the safety  of passenger vehicles and may issue voluntary guidance or mandate  standards through a rulemaking process to address safety, but it does  not have the authority to regulate consumer privacy as it relates to motor  vehicles or motor vehicle data. However, according to NHTSA officials,  the agency is required to consider the privacy impacts of its regulatory  activities. Specifically, NHTSA is required to conduct privacy impact  assessments and inform the public about any consumer privacy impacts  that may stem from its activities and the motor vehicle safety standards  issued by the agency. Also as part of the rulemaking process, NHTSA  examines privacy as a component of public acceptance (i.e., will the  public accept and use the mandated technology). According to NHTSA  officials, this is an aspect of “practicability” the agency is required to  consider when it proposes a motor vehicle safety standard under the  Motor Vehicle Safety Act. NHTSA may also address privacy in voluntary  guidance it issues for technologies that it expects will have safety benefits  and that it may regulate in the future.

Recent efforts by NHTSA to address emerging safety technologies align  with NHTSA’s goals of ensuring safety on the roadways and keeping  pace with trends impacting consumers. These efforts also illustrate how  NHTSA has addressed privacy issues related to emerging technologies.  For example, in December 2016, NHTSA proposed a rulemaking on  vehicle-to-vehicle technology that, according to NHTSA, is expected to  provide safety benefits. The proposed vehicle-to-vehicle rule involves the  broadcast, collection, and storage of data that includes location and other  information about passenger vehicles. As described in the Notice of  Proposed Rulemaking, consumer acceptance of vehicle-to-vehicle  technologies—which will depend on addressing consumer privacy  concerns, among other concerns—is crucial to achieving the expected  safety benefits of this technology. As a result, NHTSA expects  manufacturers to take steps to minimize consumer privacy risks by  providing a clear and transparent vehicle-to-vehicle privacy notice to  consumers.

Similarly, in September 2016, NHTSA issued the Federal Automated  Vehicles Policy, to speed the delivery of an initial regulatory framework  and best practices to guide manufacturers and other entities in the safe  design, development, testing, and deployment of highly automated  vehicles (e.g., vehicles systems capable of monitoring the driving  environment). As described in this voluntary guidance, NHTSA views  automated vehicle technology as capable of bringing significant safety  benefits. The guidance, among other things, outlined a set of privacy  principles and recommended that automakers manufacturing automated  vehicle technologies adopt these or similar principles. In addition,  manufacturers and other entities are asked to voluntarily provide  information on how the guidance is being followed, including how they are  addressing privacy.

According to officials from FTC and NHTSA, in recent years the agencies  have collaborated on vehicle data privacy and coordinated their  respective efforts in this area. For example, recently, FTC and NHTSA  staff has met monthly to discuss cybersecurity and privacy issues related  to passenger vehicles. FTC and NHTSA also hosted a workshop in June  2017 on consumer privacy and security issues posed by automated and  connected vehicles. Specifically, the workshop aimed to bring together  multiple industry stakeholders, consumer advocates, academics, and  government regulators to discuss various issues, including potential  benefits and challenges posed by the collection of connected and  automated vehicle data.

In addition to FTC and NHTSA, other federal agencies doing work on  privacy issues include the National Institute of Standards and Technology  and the National Telecommunications and Information Administration  within the Department of Commerce. For example, in January 2017, the  National Institute of Standards and Technology issued a report  recommending practices for including privacy risk assessments when  designing federal systems, and that according to agency officials, could  also serve as guidance for private companies, including automakers. In  addition, the National Telecommunications and Information Administration  has convened multistakeholder processes with industry and other  stakeholders that focused on developing voluntary codes of conduct for  the commercial use of emerging technologies, such as facial recognition  technology. According to National Telecommunications and Information  Administration officials, no additional privacy focused multistakeholder  processes are planned at this time.

Selected Stakeholders Said NHTSA’s Evolving Privacy Role is Unclear

The auto industry is currently undergoing a rapid evolution as vehicles  become more connected and automated. For example, most automakers  and industry associations in our review agreed that auto technology is  rapidly evolving, and some of these stakeholders noted that the auto  industry more broadly is evolving. As several of these stakeholders told  us, this evolution will result in more data—including more sensitive data— being collected, used, and shared.

NHTSA’s recent actions on emerging vehicle technologies align with the  agency’s safety mission, authority, and goals. However, NHTSA has not  clearly defined and communicated its roles and responsibilities related to  the privacy of connected vehicle data to stakeholders. Specifically,  according to some automakers and all industry associations we spoke  with, NHTSA’s recent actions on emerging vehicle technologies have left  stakeholders without a clear understanding of the agency’s role with  respect to privacy. For example, three automakers noted that NHTSA  appears to be more involved in data privacy as reflected by the Federal  Automated Vehicles Policy. One automaker also questioned whether  NHTSA was coordinating on data privacy issues with other relevant  federal agencies. Five industry associations told us that NHTSA appears  to have an interest in the area of privacy. Four of these associations also  told us that NHTSA might have a role in monitoring its members’ use of  connected vehicle data, but the four were not sure. In addition, in public  comments filed on the Federal Automated Vehicles Policy, one auto  industry trade group questioned whether considering privacy issues is  consistent with NHTSA’s safety mission and suggested that certain  privacy provisions in the policy exceeds NHTSA’s current statutory  authority. In contrast, all 11 automakers that discussed this topic and all  industry associations in our review told us that FTC’s role in this area is  clear. For example, representatives of both auto industry associations  told us that they had chosen to notify the FTC about their members’  implementation of the Consumer Privacy Protection Principles because  FTC would be the federal agency to enforce and hold automakers  accountable to these principles. NHTSA officials acknowledged that some  stakeholders may be uncertain whether and, if so, to what extent it has  authority to address any privacy issues with respect to motor vehicles.

The Standards for Internal Control in the Federal Government call for  agencies to identify, analyze, and respond to significant changes, and in  response to such changes, to periodically reevaluate and further define  key agency roles and responsibilities. These standards also direct  agencies to clearly communicate relevant information—such as the  agencies’ roles, responsibilities, and important changes to these—to  external parties. These standards are intended, among other things, to  help agencies manage change associated with shifting environments and  evolving demands and priorities. We have also previously found that  interagency collaboration is enhanced when agencies, among other  things, ensure that their roles and responsibilities are clearly defined. By  agreeing on and clearly defining roles and responsibilities, agencies can  clarify which agency will do what, organize their joint and individual  efforts, and facilitate better decision making. As previously described,  NHTSA and FTC have collaborated on the potential privacy risks posed  by new vehicle technologies; clarifying NHTSA’s role could therefore  further enhance collaboration with FTC and other federal counterparts.  Furthermore, if NHTSA more clearly defined its roles and responsibilities  for protecting the privacy of connected vehicle data, industry stakeholders  would have a better understanding of how the agency intends to oversee  the privacy of data generated by emerging vehicle safety technologies  and which agency is responsible for privacy as the connected vehicle  landscape continues to evolve.

In recent years, connected vehicles have become more common, offering  consumers a number of benefits but also increasing the potential for  privacy risks. Currently, automakers are reportedly collecting, using, and  sharing connected vehicle data on a fairly limited basis and are, at least  partially, using leading privacy practices to protect that data. However,  experts and others have raised a number of consumer privacy concerns,  including whether such data—including sensitive information such as a  driver’s location and behavior—are being adequately protected. No single  federal agency oversees data privacy issues. However, FTC has the  primary role—one that is clearly defined and reinforced through its  enforcement actions against companies that have engaged in unfair and  deceptive practices, such as violating their own privacy practices or failing  to implement reasonable security practices. Although NHTSA has a clear  role in overseeing the safety of the estimated 265 million passenger  vehicles on U.S. roads today, industry stakeholders are unclear about  NHTSA’s role with respect to vehicle data privacy, due to recent agency  actions on automated vehicles and vehicle-to-vehicle technology.

With the anticipated increase in the number of connected vehicles on  U.S. roads in the near future—and with it, the financial incentives for  automakers and others to more widely collect, use, and share vehicle and  driver data—it is important for NHTSA to define and communicate its  privacy roles and responsibilities. If NHTSA makes its roles and  responsibilities clearer, industry stakeholders will likely have a better  understanding of its oversight role for emerging vehicle technologies, and  NHTSA will likely be more effective in collaborating with FTC and other  federal agencies. However, if that opportunity is missed, consumers may  not fully embrace emerging technologies with potential safety benefits,  such as vehicle-to-vehicle technology and automated vehicles. With a  forward-looking approach to identify changes in the environment and  clarifying its roles and responsibilities as needed in response, NHTSA can  anticipate and—in collaboration with FTC—better plan for the anticipated  changes that could impact the privacy of many Americans.

The Secretary of Transportation should direct NHTSA to define, document, and externally communicate the agency’s roles and  responsibilities in relation to connected vehicle data privacy.

We provided a draft of this report to the Departments of Transportation  (DOT), Commerce, and Justice, FTC, and the Federal Communications  Commission for review and comment.  We received written comments  from DOT, which are reprinted in appendix IV. We also received technical  comments from DOT and FTC, which we have incorporated, as  appropriate.

DOT concurred with our recommendation to define, document, and  externally communicate the agency’s roles and responsibilities in relation  to connected vehicle data privacy.  Among other things, DOT reiterated  the importance of consumer privacy and how it considers the privacy  implications of its regulations and voluntary guidance, such as in the  proposed vehicle-to-vehicle rulemaking.

The Departments of Commerce and Justice and the Federal  Communications Commission reviewed our report, but did not have any  comments.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretaries of  Transportation, Commerce, and Justice and the Chairs of the Federal  Trade Commission and Federal Communication Commission, and other  interested parties. In addition, the report will be available at no charge on  the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-2834 or wised@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report addresses the following objectives: (1) the types of data  collected by connected vehicles and transmitted to automakers and how,  if at all, selected automakers use and share these data, (2) the extent to  which selected automakers’ privacy policies for connected vehicles align  with leading practices, (3) selected experts’ views on privacy issues  related to the commercial use of data collected by connected vehicles,  and (4) federal roles and efforts related to the privacy of data collected by  connected vehicles.

To address all of our objectives, we reviewed applicable federal statutes  and regulations, our prior work, and reports by other federal agencies,  academics, and research organizations on privacy and connected  technologies. We interviewed representatives of three organizations that  advocate protecting the privacy of consumers’ data identified and  selected based on their contributions to our prior work. We also  interviewed eight industry associations representing automakers,  automotive suppliers, application developers, and telecommunication  companies. The industry associations we interviewed were: Association  of Global Automakers, Alliance of Automobile Manufacturers, Application  Developers Alliance, Connected Vehicle Trade Association, Consumer  Technology Association, CTIA-The Wireless Association, Motor and  Equipment Manufacturers Association, and the National Automobile  Dealers Association.

To determine types of data collected from connected vehicles and how, if  at all, these data are used, we conducted semi-structured interviews with  representatives of 16 automakers and 3 other industry stakeholders. We  attempted to interview most of the automakers selling passenger vehicles  in the United States and identified them using the membership lists of two  automotive industry trade associations, the Alliance of Automobile  Manufacturers and the Association of Global Automakers. We selected  automakers to interview based on their 2015 U.S. market share,  specifically, a market share that was larger than zero. Based on our  discussions with the automotive trade associations, we excluded two  automakers due to their very small U.S. market share, and two other  automakers we contacted told us they no longer sell passenger vehicles  in the U.S. We identified and selected one additional automaker, which is  not a member of these automotive industry trade associations, due to its  growing market share and high profile in the connected vehicle market. Of  the 19 automakers we contacted, three did not respond to our interview  request. For the complete list of automakers we interviewed, see table 3.

We identified and selected other industry stakeholders based on their  industry roles, specifically their roles as telecommunication companies,  telematics service providers, and application developers. Of the 12 other  industry stakeholders we contacted, we interviewed three stakeholders  representing two telecommunications companies and one telematics  service provider. Given the small number of other industry stakeholders  interviewed, the names of these companies are not included in this report.  We used a semi-structured format in our interviews with automakers and  other industry stakeholders and asked each type of stakeholder the same  set of questions. For example, we asked each automaker what types of  data it collects, how these data are used, and how they share these data.  We asked each of the 13 automakers that offer connected vehicles a set  of additional questions to clarify its use and sharing of data and its privacy  practices. After interviewing selected automakers, we summarized and  analyzed their responses to identify themes relevant to our research  objectives, such as the types of data collected. The views and information  gathered through our interviews with selected automakers and industry  stakeholders cannot be generalized to the industry as a whole. However,  the 16 selected automakers we interviewed produce over 25 vehicle  brands and represented around 90 percent of the U.S. passenger vehicle  sales market share in 2015.

To determine the extent to which selected automakers’ reported privacy  practices and written privacy notices (collectively we refer to these as  “privacy policies”) for connected vehicles reflect leading practices, we  identified leading practices related to privacy using several widely  recognized sources. The privacy frameworks and reports we used for this  analysis are: (1) the Organisation for Economic Co-operation and  Development’s The OECD Privacy Framework (known as the “Fair  Information Practice Principles” (FIPPs); (2) the Federal Trade  Commission’s (FTC) report, Protecting Consumer Privacy in an Era of  Rapid Change: Recommendations for Businesses and Policymakers  (2012); (3) FTC Staff Report, Internet of Things: Privacy and Security in a  Connected World (2015); (4) the National Highway and Transportation  Administration’s (NHTSA) Federal Automated Vehicles Policy (2016); and  (5) the National Institute of Standards and Technology’s NISTIR 8062: An  Introduction to Privacy Engineering and Risk Management in Federal  Systems (2017). We compared the leading practices identified in each  source and grouped practices into similar categories. We did not deem  any practices from the sources to be irrelevant for our review on  connected vehicles, but we did determine that similar identified practices  could be combined into one leading practice. The privacy leading  practices we used for our analysis are transparency, focused data use,  data security, data accuracy and access, individual control, and  accountability. To determine the extent to which automakers’ privacy  policies reflect these leading practices, we analyzed selected automakers’  written privacy notices through a document review and reported privacy  practices related to connected vehicles based on automakers’ responses  to semi-structured interview questions. Of the 16 automakers we  interviewed, 13 offered connected vehicles at the time we spoke to them.  While many of these automakers offer several brands, one automaker  had different written privacy notices for its three vehicle brands sold in the  U.S. As such, we analyzed a total of 15 sets of privacy policies (their  written notices and reported privacy practices).

To analyze the written privacy notices, we developed questions to  determine whether an automaker’s written privacy notice specifically  addressed the various elements of a privacy leading practice. We  conducted a test case with one automaker’s written privacy notice and  made needed revisions to the questions. Then, one analyst coded each  of the 15 written privacy notices using NVivo software. A second analyst  reviewed the coding and confirmed the accuracy of the results.

To analyze the reported privacy practices, we conducted a content  analysis of automakers’ interview responses to questions related to their  privacy practices. All automakers were asked the same set of questions,  and we conducted follow-up with each automaker offering connected  vehicles to ensure consistency in responses and ensure that we asked  questions related to each of the leading privacy practices identified as  relevant for connected vehicles for the purposes of this report. As part of  our follow up work, we asked selected automakers questions directly  related to the leading privacy practices. One analyst coded the interview  responses and a second analyst reviewed and confirmed the accuracy of  the coding.

To assess whether an automaker’s policies reflected each of these  leading privacy practices, we used the following scale:

Substantially reflected: a company met most (70 percent or more) of  the elements of this leading practice.

Partially reflected: a company met about half of the elements of this  leading practice.

Minimally reflected: a company met less than half of the elements of  this leading practice.

For each of the six leading practices, there were between 5 to 10  questions of equal weight that we used to determine the extent to which a  practice was reflected.

As noted above, our analysis of automakers’ privacy policies is based on  written notices and reported practices obtained through interviews. We  did not conduct a compliance review, as the leading practices used in this  report are not legally binding. We also did not evaluate the extent to  which selected automakers follow their reported privacy policies.

To determine selected experts’ views on privacy issues related to the  commercial use of data collected by connected vehicles, we interviewed  16 subject matter experts in connected vehicles or privacy. We identified  a prospective pool of subject matter experts through reviewing our prior  reports, related National Academy of Sciences panels, relevant literature,  and recommendations from other interviewees. We selected subject  matter experts using eight criteria: relevant background, selected  academic publications and technical reports, selected presentations at  conferences, selected popular source articles, selected testimonies,  selected instances of interviews on prior engagements, selected  professional service and appointments, and recommendations from other  interviewees. Those organizations and individuals that had relevant  experience in at least four of our eight criteria were deemed experts for  the purposes of our review (see table 4 for the full list of experts we  interviewed).

As part of these semi-structured interviews, we presented each selected  expert with general privacy concerns about the commercial use of data  we identified from our prior reports, FTC reports, and preliminary  interviews with organizations that advocate protecting consumers’ data  privacy. We asked each selected expert to what extent these privacy  concerns were relevant to data collected through connected vehicles.  After interviewing selected experts, we summarized and analyzed their  responses to identify themes relevant to our research objective. The  views and information gathered through our interviews with subject matter  experts cannot be generalized to all such experts, but they do provide  insight into relevant privacy concerns and solutions.

To examine federal roles and efforts related to the privacy of data  collected from connected vehicles, we reviewed relevant documents and  interviewed officials from four federal agencies—FTC, Department of  Transportation, Department of Commerce, and Federal Communications  Commission—that we identified as having privacy and consumer  protection responsibilities potentially related to connected vehicles. We  also discussed with selected experts, automakers, other industry  stakeholders, and industry associations the federal laws that may apply in  this context and related federal efforts and roles. Because of DOT’s role  in overseeing motor vehicles, we compared DOT’s efforts to reevaluate  and define key agency roles and responsibilities as new vehicle  technologies emerge with pertinent Standards for Internal Control in the  Federal Government and practices identified in our prior work on agency  collaboration.

Appendix II: Summary of Relevant Privacy Frameworks and Self-Regulatory Principles

Appendix III: Analysis of Automakers’ Reported Privacy Policies and Results

We assessed the extent to which selected automakers’ reported policies  reflected each of the leading privacy practices we identified. We included  in this analysis those 13 automakers offering connected vehicle services.  However, one of these 13 automakers has different written privacy  notices and reported privacy practices for its three affiliated brands. As a  result, our analysis of automakers’ privacy policies included 15 sets of  privacy policies. We reviewed the automakers’ written privacy notices and  responses to specific interview questions focused on their use of these  practices. We also asked automakers to confirm their answers to the  interview questions directly related to the leading privacy practices. We  used the following scale to categorize the extent to which each  automaker’s policies reflected each leading practice:

Substantially reflected: automaker met most (70 percent or more) of  the elements of this leading practice.

Partially reflected: automaker met about half (50 to 69 percent) of the  elements of this leading practice.

Minimally reflected: automaker met less than half or none of the  elements of this leading practice.

For this assessment, we used a total of 43 questions, each of which was  given equal weight, across the six identified leading practices:  2)  focused data use,  3)  data security,  4)  data access and accuracy,  5)  individual control, and  6)  accountability.

Some assessment questions relate to automakers’ written privacy notices  and others relate to interview questions we asked about the automaker’s  use of the leading practices. The 6 tables below include, for each leading  practice: the assessment questions, the results for each automaker, and  an overall summary of how fully all the selected automakers’ policies  reflected the practice.

Appendix IV: Comments from the Department of Transportation

Appendix V: GAO Contact and Staff Acknowledgments

In addition to the individual named above, the following individuals made  important contributions to this report: Nancy Lueke (Assistant Director);  Sarah Arnett (Analyst-in-Charge); Jessica Bryant-Bertail; Camilo Flores;  Pamela Davidson; Delwen Jones; Josh Ormond; Eleni Orphanides; and  John Villecco.

Question: To what extent do the selected automakers produce connected vehicles?

Answer: Thirteen of the 16 selected automakers in GAO's review offer connected vehicles, and those 13 reported collecting, using, and sharing data from connected vehicles, such as data on a car's location and its operations (e.g., tire pressure). All 13 automakers described doing so on a relatively limited basis.

Question: What data might be collected?

Answer: For example, they reported using data to provide requested services to consumers and for research and development.

Question: To what extent was personal data shared with third parties?

Answer: None of the 13 reported sharing or selling data that could be linked to a consumer for unaffiliated third parties' use.

Question: How will data collection likely change in the future?

Answer: However, as connected vehicles become more commonplace, the extent of data collection, use, and sharing will likely grow.

Selected Automakers Collect Different Types of Data from Connected Vehicles and Reported Limited Use and Sharing

Selected Automakers Reported Using Collected Data Primarily to Provide Services to Consumers and for Research and Development

Selected Automakers Reported Sharing Data on a Limited Basis

Selected Automakers’ Reported Policies Partially Reflected Leading Privacy Practices Relevant to Connected Vehicle Data Privacy Automakers’ Reported Policies Partially Reflected Six Identified Leading Practices

Question: What federal agencies protect consumers and ensure the safety of passenger vehicles?

Answer: The Federal Trade Commission (FTC) and the Department of Transportation's (DOT) National Highway Traffic Safety Administration (NHTSA) are primarily responsible for protecting consumers and ensuring passenger vehicles' safety, respectively.

Question: What is the role of the FTC?

Answer: FTC has the authority to protect consumer privacy and has issued reports and guidance and conducted workshops on the topic generally as well as on connected vehicles specifically.

Question: What is the role of the NHTSA?

Answer: NHTSA has broad authority over the safety of passenger vehicles and considers the privacy effects and implications of its regulations and guidance.

Question: To what extent have the FTC and NHTSA collaborated?

Answer: FTC and NHTSA have coordinated on privacy issues related to connected vehicles.

Question: Why is the NHTSA's role in data privacy unclear?

Answer: However, NHTSA has not clearly defined its roles and responsibilities as they relate to the privacy of vehicle data. In response to emerging vehicle technologies, NHTSA included privacy requirements in a related rulemaking and included privacy expectations in voluntary guidance.

Question: Why is this an issue for the NHTSA?

Answer: Federal standards for internal control require, among other things, that agencies define and communicate key roles and responsibilities.

Question: How would clearly defining the NHTSA's roles be benifitial?

Answer: By clearly defining, documenting, and communicating NHTSA's roles and responsibilities in vehicle data privacy, NHTSA would be better positioned to coordinate with other federal agencies and to effectively oversee emerging vehicle technologies.

FTC and NHTSA Have Efforts Related to Data Privacy Under Way, but NHTSA’s Role Is Unclear

FTC and NHTSA Have Efforts and Guidance Related to Protecting Data Privacy

Selected Stakeholders Said NHTSA’s Evolving Privacy Role is Unclear

Question: What does this report examine?

Answer: This report: (1) examines the types, use, and sharing of data collected by connected vehicles; (2) determines the extent to which selected automakers' privacy policies for these data align with leading practices; and (3) evaluates related federal roles and efforts, among other objectives.

Question: How did GAO source its data for this report?

Answer: GAO interviewed relevant industry associations, organizations that work on consumer privacy issues, and a non-generalizable sample of 16 automakers selected based on their U.S. passenger vehicle sales.

Question: How did GAO make use of the privacy policies of automakers?

Answer: In addition, GAO analyzed selected automakers' privacy policies (written notices and reported practices) against a set of leading privacy practices determined to be relevant to connected vehicles. To identify these practices, GAO reviewed a variety of privacy frameworks developed by federal agencies and others.

Question: How did GAO make use of federal privacy frameworks?

Answer: GAO reviewed relevant federal statutes, regulations, and reports, and interviewed agency officials, including those from DOT, the Department of Commerce, and FTC.

Selected Experts Had Concerns about Connected Vehicle Data Privacy and Automakers’ Privacy Efforts

Selected Experts Generally Agreed Broader Privacy Concerns Applied to Connected Vehicle Data

Appendix I: Objectives, Scope, and Methodology


Access to Government Information in the United States: A Primer

Summary: No provision in the U.S. Constitution expressly establishes a procedure for public access to executive branch records or meetings. Congress, however, has legislated various public access laws. Among these laws are two records access statutes,

Summary: the Freedom of Information Act (FOIA; 5 U.S.C. §552), and the Privacy Act (5 U.S.C. §552a),

Summary: and two meetings access statutes,

Summary: the Federal Advisory Committee Act (FACA; 5 U.S.C. App.), and the Government in the Sunshine Act (5 U.S.C. §552b).

Summary: These four laws provide the foundation for access to executive branch information in the American federal government. The records-access statutes provide the public with a variety of methods to examine how executive branch departments and agencies execute their missions. The meeting-access statutes provide the public the opportunity to participate in and inform the policy process. These four laws are also among the most used and most litigated federal access laws.

Summary: While the four statutes provide the public with access to executive branch federal records and meetings, they do not apply to the legislative or judicial branches of the U.S. government. The American separation of powers model of government provides a collection of formal and informal methods that the branches can use to provide information to one another. Moreover, the separation of powers anticipates conflicts over the accessibility of information. These conflicts are neither unexpected nor necessarily destructive. Although there is considerable interbranch cooperation in the sharing of information and records, such conflicts over access may continue on occasion.

Summary: This report offers an introduction to the four access laws and provides citations to additional resources related to these statutes. This report includes statistics on the use of FOIA and FACA and on litigation related to FOIA. The 114th Congress may have an interest in overseeing the implementation of these laws or may consider amending the laws. In addition, this report provides some examples of the methods Congress, the President, and the courts have employed to provide or require the provision of information to one another. This report is a primer on information access in the U.S. federal government and provides a list of resources related to transparency, secrecy, access, and nondisclosure.

Throughout the first 150 years of the federal government, access to government information does not appear to have been a major issue for the federal branches or the public. There were a few instances during this period when the President, arguing the need to maintain the constitutional independence and equality of his branch, vigorously resisted attempts by Congress and the courts to obtain executive records. During this same era, an active federal public printing program was established and effectively developed, making government documents more accessible.

Following World War II, some information was available from certain federal departments and agencies. The public availability of records held by the executive branch was limited by narrow interpretation of the "housekeeping" statute of 1789 (now codified at 5 U.S.C. §301), which authorized the heads of departments to prescribe regulations regarding the custody, use, and preservation of their agencies' records, papers, and property. Prevailing law tolerated this state of affairs, offering citizens no clear avenue of access to agency information. Section 3(b) of the Administrative Procedure Act of 1946 (5 U.S.C. §551) indicated that matters of official record should be available to the public, but added that an agency could restrict access to its documents "for good cause found" or "in the public interest." These discretionary authorities were relied upon to restrict the accessibility of unpublished agency records and documents.

Some congressional panels began examining information access issues and seeking responsive legislative solutions. Among these legislative responses were the enactments of four statutes.

the Freedom of Information Act (1966) and the Privacy Act (1974).

the Federal Advisory Committee Act (1972); and the Government in the Sunshine Act (1976).

This report offers an overview of each of these statutes, including the boundaries of their authority. This report then provides citations to additional resources on each of the laws.

Freedom of Information Act (5 U.S.C. §552)

In 1966, Congress enacted the Freedom of Information Act (FOIA), the first law requiring public access to executive branch records. Pursuant to the statute, FOIA does not apply to the legislative or judicial branches of the federal government or to state, local, or tribal governments. Legislative records were not included in the bill because Congress believed that its own deliberations and proceedings were adequately subject to public observation. For example, the Constitution explicitly permits each house of Congress to keep portions of its journal of proceedings secret and disallows the questioning of Members of Congress "in any other Place" regarding official speech or debate. Legislators also were satisfied with the openness of federal court files and hearing rooms. Thus, the departments and agencies were the principal object of government information access reform laws.

FOIA established, for any person—corporate or individual, citizen or otherwise—presumptive access to existing, unpublished agency records on any topic. The law specifies nine categories of records that may be exempted from the rule of disclosure. Agencies within the federal intelligence community are prohibited from making any record available to a foreign government or a representative of same pursuant to a FOIA request. Disputes over the accessibility of requested records may be settled, according to the provisions of the act, in federal court or may be mediated in the Office of Government Information Services (OGIS).

Fees for search, review, or copying of materials may be imposed, while certain types of requesters may be granted fee waivers or reductions. FOIA was amended in 1996 to provide for public access to information in an electronic form or format. These amendments are often referred to as e-FOIA. In 2007, FOIA was further amended to

redefine qualifications for fee waivers for those seeking records, require the National Archives and Records Administration to establish OGIS to act as a centralized FOIA oversight office and FOIA dispute mediator, and require agencies to create tracking systems that allow requesters to determine the status of their information requests, among other modifications.

In 2009, provisions of the OPEN FOIA Act of 2009 were enacted as amendments to the Department of Homeland Security Appropriations Act, 2010. Among other requirements, the provisions established specific criteria for the future statutory creation of exemptions that would allow federal executive branch agencies to withhold certain categories of records. For example, the enacted provisions require that qualifying future statutory exemptions from FOIA cite specifically to 5 U.S.C. §552 in their authorizing language.

Federal Advisory Committee Act (5 U.S.C. App.)

A 1972 statute, the Federal Advisory Committee Act (FACA), requires that the meetings of all federal advisory committees serving executive branch entities be open to public observation and that all committee records be accessible to the public. FACA was designed to eliminate duplication of committee expertise and make advisory bodies in the executive branch more transparent. Committees that fit certain FACA criteria are governed by FACA's guidelines. Congress can decide, however, to place some or all or FACA's transparency and access provisions on an advisory body that it statutorily establishes.

The statute specifies certain categories of debate that federal advisory committees may conduct outside of public view as well as advisory committee records that may be withheld from public release. Disputes over the proper public notice for a committee meeting or the closing of a session may be pursued in federal court.

Legislated in 1974, the Privacy Act provides U.S. citizens or permanent resident aliens presumptive access to personally identifiable files on themselves held by federal agencies—generally excepting law enforcement and intelligence entities. The statute specifies seven types of information that may be exempted from the rule of access. When a citizen or resident alien contends that a federal record on him or herself contains inaccurate information, the act allows correction through a request to the agency that possesses the record. Disputes over the accessibility or accuracy of personally identifiable files may be pursued in federal court.

Government in the Sunshine Act (5 U.S.C. §552b)

Enacted in 1976, the Government in the Sunshine Act is intended to open the policymaking deliberations of any agency headed by a "collegial body" —such as boards, commissions, or councils—to public scrutiny. Pursuant to the statute, agencies are required to publish advance notice of impending meetings and make those meetings publicly accessible. The act includes 10 conditions under which agency meetings are to be exempted from the act. Disputes over proper public notice of such meetings or the propriety of closing a deliberation may be pursued in federal court.

Congress routinely requests nonpublic information from executive branch agencies. When agencies resist these requests, Congress has formal and informal methods of encouraging or requiring agencies to comply. Language within FOIA explicitly states that the statute does not permit agencies to withhold information from Congress. In general, an agency's dispute with the legislature over access to information is often resolved through negotiation—reduction of the quantity of records initially sought, substitution of other information, alternative delivery mechanisms, or limitation of the number of individuals who will examine materials provided by another branch. Congress could use its "power of the purse" and the Senate could use its advice and consent power to leverage its information access demands.

Federal courts rely upon a spirit of justice and fair play to sustain their orders for the production of information by another branch. In view of the American separation of powers model of government, such conflicts among the three branches are neither unexpected nor necessarily destructive—and probably will continue to occur.

Both Congress and the judiciary have subpoena powers that can compel the production of materials by another branch. Subpoenas, however, are usually only issued after other methods of securing requested information have been unsuccessful. Even subpoenas, however, have sometimes been resisted. In 2012, for example, the Attorney General refused to turn over certain documents subpoenaed by the House Committee on Oversight and Government Reform, citing the President's determination that the information was protected by a form of executive privilege. A federal district court, in Committee on Oversight and Government Reform v. Lynch, rejected the claim of privilege over the items sought, and ordered the Attorney General to produce the responsive documents.

FOIA requires each federal agency to submit a report on or before February 1 each year to the Attorney General describing the agency's freedom of information workload. Annual reports from all of the departments and agencies are posted online by the U.S. Department of Justice. In March 2011, DOJ launched FOIA.gov, a government portal that allows users to explore various metrics on the administration of FOIA in executive branch agencies. The portal uses the data agencies provide in their annual FOIA reports to allow users to compare among agencies the number of requests they receive, answer, deny, have appealed, and the average number of days it takes to respond to a request—among other metrics. According to FOIA.gov , in FY2014, the federal government received 714,231 FOIA requests—9,837 more than in FY2013. In FY2014, the federal government had 159,741 "backlogged " FOIA requests, more than 64,000 additional backlogged requests than in FY2013. The Department of Homeland Security (DHS) received 291,242 requests in FY2014, more than any other agency. DHS also had the greatest number of backlogged requests with 103,480 in FY2014, more than 64% of all backlogged FOIA requests govermentwide.

According to the FACA Database, which is hosted by the General Services Administration, 1,050 active advisory committees operated in FY2014, costing more than $339 million.

A certain number of requests for information under the various access to information acts result in judicial action. The Administrative Office of the U.S. Courts provides statistical information on the number of FOIA cases filed in U.S. District Courts in its compendium, Judicial Business of the United States Courts . According to that report, 446 cases related to FOIA commenced in U.S. District Courts in FY2014 (16.8% more than the 382 cases reported in FY2013).

The Transitional Access Web Clearinghouse (TRAC), a "data gathering, data research and data distribution organization at Syracuse University," maintains a website called FOIAProject.org that tracks federal FOIA-related lawsuits around the country. According to TRAC's research, in FY2014, 401 FOIA lawsuits were filed in U.S. District Court. Also in FY2014, TRAC found that 504 FOIA cases were pending in U.S. District Court.

Other transparency watchdog organizations also track litigation related to federal access laws. Judicial Watch, a public interest group that seeks to promote transparency in government, has posted information about its own lawsuits under "The Docket." Citizens for Responsibility and Ethics in Washington, a nonprofit organization that seeks to promote government accountability, has a webpage devoted to lawsuits in which it is involved. EPIC, a public interest nonprofit that focuses on civil liberties and privacy issues, also has a webpage devoted to FOIA-related litigation .

Individuals, groups, and organizations all possess a right to access some government information. Both government and private groups publish guides to the information acts in paper and on the Internet as well.

The U.S. House of Representatives Committee on Government Reform has published several editions of its report, A Citizen's Guide on Using the Freedom of Information Act and the Privacy Act of 1974 to Request Government Records —most recently in September 2012. In addition to the text of the acts, the Citizen's Guide contains descriptions and explanations, sample document request forms, and bibliographies of related congressional and non-congressional material.

The Office of Government Information Services (OGIS), which began operations in 2009, hosts a webpage that provides "tips and tools" to agencies and requesters. The website includes best practices for making FOIA requests, information on FOIA training for agency administrators, information on how agencies can work with OGIS, and FOIA contacts at agencies for requesters.

The General Services Administration's Federal Citizen Information Center publishes Your Right To Federal Records: Questions and Answers on the Freedom of Information Act and Privacy Act . Like the Citizen's Guide , this publication contains explanations, samples, and texts, although in less detail than found in the Citizen's Guide .

The Department of Justice (DOJ) is responsible for overseeing and coordinating administration of the Freedom of Information Act. DOJ's Office of Information Policy maintains online extensive material about FOIA, statistics on its usage, guidelines for making requests, and freedom of information contacts at other federal agencies.

Among many nongovernmental groups that publish information about freedom of information are Public Citizen and the National Security Archive. Public Citizen, a nonprofit organization that represents a variety of citizen interests, maintains a website that provides FOIA resources and information. The National Security Archive, a collective of journalists and scholars who "check rising government secrecy," maintains a website that contains a number of FOIA guides, including "Effective FOIA Requesting for Everyone: A National Security Archive Guide," which was published in January 2008.

Records on each of the active federal advisory committees are available on the General Services Administration's FACA Database. The website includes each committee's charter, information on the members of each committee and their contact information, and cumulative data on the cost of federal advisory bodies.

CRS Report R41933, The Freedom of Information Act (FOIA): Background, Legislation, and Policy Issues , by [author name scrubbed]

CRS Legal Sidebar WSLG93, The Freedom of Information Act (FOIA) and the Drone Strikes Program , by [author name scrubbed]

CRS Report R43924, Freedom of Information Act Legislation in the 114th Congress: Issue Summary and Side-by-Side Analysis , by [author name scrubbed] and [author name scrubbed]

CRS Report R44253, Federal Advisory Committees: An Introduction and Overview , by [author name scrubbed]

CRS Report R44232, Creating a Federal Advisory Committee in the Executive Branch , by [author name scrubbed]

CRS Report R44248, The Federal Advisory Committee Act: Analysis of Operations and Costs , by [author name scrubbed]

CRS Report RL30240, Congressional Oversight Manual , by [author name scrubbed] et al.

CRS Legal Sidebar WSLG288, The Privacy Act: Nearing Middle Age and Needs Improvement? , by [author name scrubbed]

U.S. Congress, House, Committee on Government Reform, A Citizen' s Guide on Using the Freedom of Information Act and the Privacy Act of 1974 to Request Government Records , H.Rept, 112-698, September 2012, at https://oversight.house.gov/wp-content/uploads/2012/09/Citizens-Guide-on-Using-FOIA.2012.pdf .

U.S. Congress. Senate, Committee on Governmental Affairs, Federal Advisory Committee Act (Public Law 92-463)—Source Book: Legislative His tory, Texts, and Other Documents, Committee Print, 95 th Congress, second session, Washington: GPO, 1978.

U.S. Department of Justice, 2014 Litigation and Compliance Report , at http://www.justice.gov/oip/2014-foia-litigation-and-compliance-report .

U.S. Department of Justice, The Department of Justice Guide to the Freedom of Information Act (Online Edition), at http://www.justice.gov/oip/doj-guide-freedom-information-act-0 .

U.S. Department of Justice and U.S. General Services Administration, Your Right to Federal Records: Questions and Answers on the Freedom of Information Act and Privacy Act, 2011 , http://publications.usa.gov/USAPubs.php?PubID=6080 .

U.S. General Services Administration, FACA Database Case Digest , at http://casedigest.faca.gov/Case/ShowCaseTablePage.aspx .

David M. Pritzker, Reducing FOIA Litigation Through Targeted ADR Strategies , Administrative Conference of the United States, Washington, DC, June 2014, https://www.acus.gov/research-projects/reducing-foia-litigation-through-targeted-adr-strategies .

The George Washington University, Effective FOIA Requesting for Everyone: A National Security Archive Guide , 2009, at http://nsarchive.gwu.edu/nsa/foia/foia_guide.html .

Richard K. Berg, Stephen H. Klitzman, and Gary J. Edles, An Interpetive Guide to the Government In the Sunshine Act , 2 nd ed. (Chicago: American Bar Association, 2005).

Question: How do these laws affect access to federal information?

Answer: These four laws provide the foundation for access to executive branch information in the American federal government.

Question: What is the purpose of records-access statutes?

Answer: The records-access statutes provide the public with a variety of methods to examine how executive branch departments and agencies execute their missions.

Question: What is the purpose of meeting-access statutes?

Answer: The meeting-access statutes provide the public the opportunity to participate in and inform the policy process.

Question: How commonly-used are these laws?

Answer: These four laws are also among the most used and most litigated federal access laws.

Freedom of Information Act (5 U.S.C. §552)

Using the Information Access Laws
Litigation

Question: To what extent do the four statutes allow for access to federal information?

Answer: While the four statutes provide the public with access to executive branch federal records and meetings, they do not apply to the legislative or judicial branches of the U.S. government.

Question: How can the branches of the government share information?

Answer: The American separation of powers model of government provides a collection of formal and informal methods that the branches can use to provide information to one another.

Question: How are conflicts over information accessibility handled?

Answer: Moreover, the separation of powers anticipates conflicts over the accessibility of information. These conflicts are neither unexpected nor necessarily destructive.

Question: To what extent are conflicts common?

Answer: Although there is considerable interbranch cooperation in the sharing of information and records, such conflicts over access may continue on occasion.

Question: What does this report address regarding the four access laws?

Answer: This report offers an introduction to the four access laws and provides citations to additional resources related to these statutes.

Question: How does this report examine FOIA and FACA usage?

Answer: This report includes statistics on the use of FOIA and FACA and on litigation related to FOIA.

Question: How does this report examine information requests inside the federal government?

Answer: In addition, this report provides some examples of the methods Congress, the President, and the courts have employed to provide or require the provision of information to one another.

Question: What does this report address regarding information access in general?

Answer: This report is a primer on information access in the U.S. federal government and provides a list of resources related to transparency, secrecy, access, and nondisclosure.

Using the Information Access Laws
Guides to Records Access

Using the Information Access Laws
Selected CRS Reports