How much privacy are drivers willing to give up for better car insurance rates?
Photo Illustration by Stephen Webster
Insurance giant Allstate has raised eyebrows after being granted patents for a proposed high-tech surveillance system that could track a driver’s every move. The company won patents for technology that, through the use of cameras and sensors, could monitor whether a driver is speeding, peeling rubber or turning without signaling. Sensors could even record a driver’s heart rate and blood pressure and gather information about passengers.
Not only could Allstate use that data to set insurance rates and analyze driver behavior, the company could be free to sell it to third parties such as life and health insurance companies, potential employers, credit rating agencies and advertisers.
As with other types of data companies collect from consumers, drivers are unlikely to know what’s done with it, how it’s stored, and who winds up with the information for what purpose. And though Allstate’s new technology would require consent for those willing to give up such details, privacy experts worry about the unintended consequences.
“It’s impossible for individuals to monitor what companies are doing with personal data or to exercise meaningful control over most data,” says Fred Cate, director of Indiana University’s Center for Law, Ethics and Applied Research in Health Information. Even though many companies provide consumers with their privacy policies, Cate argues they do little for the consumer, “however well-intentioned they may be.”
PRIVACY IN PERIL?
If Allstate installs its new sensor system, the company would be able to monitor behavior behind the wheel, such as aggressiveness or patience, caution or recklessness, and compliance with laws. In fact, its patent application mentions that such characteristics “are relevant to each individual’s behavior in other situations, including performance of job duties, behavior in stress and meeting obligations owed to others.”
Allstate declined to comment for this story. In a statement, however, a representative wrote, “Intellectual property we develop as part of our connect car program is geared toward improving safety, value, underwriting fairness and the driving experience of our customers.” The company also said it may not use all the patents, but it didn’t rule that out either.
In a speech last May, Allstate chief executive Thomas J. Wilson talked about “monetizing data,” but downplayed privacy concerns about data collection technology the company already uses. “We’re not seeing any huge consumer pushback on it,” he said. When offered a 10 to 20 percent discount on insurance, consumers typically opt in without a second thought, he added.
Allstate already uses a form of data collection with three-quarters of a million drivers through “telematics,” a technology that transmits data in real time between the car and the company, Wilson said in his speech. Allstate’s Drivewise and Drivesense monitors collect data on mileage, hours on the road, speed and brake activation. “We’re connected with you while you’re in your car so we can tell how you’re driving,” Wilson said.
In recent years, Geico and other insurers have also used telematics, offering to place devices in cars with the lure of lowering rates.
In addition to documenting who’s driving a vehicle, insurance companies want to know where drivers stop, how fast they’re going, how many passengers are in the car and what they’re doing. All of this could be used to lower—or raise—insurance premiums. Insurers already get notified when drivers are issued speeding tickets; but through on-board sensors, they might also discover whether drivers are speeding their kids to hockey practice or rolling through a stop sign in the middle of the night—even if they don’t get nabbed by the police.
Allstate’s patent application indicates that the company would collect data including time stamps of trips drivers make, maps of driving distances, projected times between distances, traffic signals, local speed laws and weather. Once that data is collected, it’s possible that it may be of interest to law enforcement, which raises a host of new issues.
LEGAL CHALLENGES
Courts already have challenged police for gathering data from vehicles, particularly from GPS technology. In 2012, the Supreme Court held in U.S. v. Jones that installing a GPS device to monitor a vehicle’s movements constitutes a search under the Fourth Amendment. Though the case involved police installing the device to track a suspected drug trafficker, it raised the broader question of how far the government can go in monitoring a person’s movements through such a device, whether the police installed it or not. A year later, the Massachusetts Supreme Judicial Court ruled on a similar case, saying that the government must have probable cause and provide judicial oversight before tracking vehicles by GPS for extended periods.
Such cases are closely watched by the nonprofit Electronic Privacy Information Center. “There is an urgent need to establish meaningful and enforceable privacy and safety protections,” says Khaliah Barnes, associate director of the center.
Barnes testified in November before the U.S. House’s Committee on Oversight and Government Reform during a hearing on the “Internet of cars,” a term that refers to the many ways in which vehicles are connected through digital technology. During the hearings, Barnes urged Congress to establish safeguards for drivers of connected vehicles. “Consumers are grossly unaware and privacy policies are opaque,” Barnes says. “People aren’t aware of the level of detail of the data collected.” OnStar, the company behind the in-car communication system from General Motors, raised a stir in 2011 after it proposed changing user agreements. The changes would have allowed it to continue collecting information from customers who stopped their subscriptions and sell the data to third parties. Facing a wave of protest and a congressional investigation over its practices, the company withdrew the plan.
In his speech, Allstate CEO Wilson made clear that the insurer was considering its options with the data it gathers, including selling it. “Could we, should we sell this information we get from people driving around to various people and capture some additional profit sources and perhaps give a better value proposition to our customers?” Wilson asked. “It’s a long-term gain.”
The lure of a free vehicle and $100 gas card was enough for Eva Krcmarik to agree to drive a car with sensors as part of a study by the University of Michigan’s Transportation Research Institute, which studies safety and transit issues for federal and state agencies, insurance companies and automakers.
Krcmarik, who was in high school at the time, got a car equipped with small cameras aimed at the driver’s seat and mounted in the front and back seats, as well as under the side-view mirrors. “After a while I just forgot them,” she says. “I’m a pretty safe driver, and it didn’t restrict what I did or how I drove.”
Krcmarik says she didn’t have any privacy concerns. “At the time I don’t think I cared what they were looking for,” she says. She later learned she was part of the control group and no video was used in the study. “I never thought much about what they would use the information for because I was just 16 years old and happy to have a free car for 15 weeks,” she says.
While there are undoubtedly benefits to consumers, experts worry that ubiquitous data collection has illuminated a practice that could have many consequences. “Especially when data collected for one purpose are used for something very different, and especially when the data aren’t appropriate to the use,” Cate says. He suggests that new laws are needed to create frameworks for defining permitted uses for data. Current regulations focus on notice and consent, paying little heed to the risks and uses of the collected data, he says.
“It’s not just that the law is outdated—it certainly is—but even more so that it is all too often focused on the wrong issue, consent, instead of the harms and benefits and their likelihood of resulting from a particular use,” Cate says.
This article originally appeared in the April 2016 issue of the ABA Journal with this headline: “Driving Exam: How much privacy are drivers willing to give up for better car insurance rates?”
