Data security in cars – should drivers and passengers be worried?

As more and more cars become connected to the Internet and to each other, the fear that sensitive personal data could be stolen via wireless interfaces is growing. 

Experts say drivers' and passengers' personal information is at risk of being taken by hackers and other groups with malicious intent. 

They also are concerned over what they see as a big danger of information being disclosed from within the vehicle universe without those inside having given their permission. In some cases, users may have no idea of what in-vehicle messages are being passed on. 

So what are carmakers doing about it? 

Manufacturers already recognize that in-vehicle data is a moneymaker which can be used to fuel lucrative marketing activities. Major companies, start-ups and insurance companies are clamouring for drivers' personal information before the regulators clamp down. 

For marketers, both the technical data generated by the car and information about the people inside can be sold at a profit. 

Car dealers, workshops, suppliers, insurance companies and motoring clubs are all interested in in-vehicle data. Other possible beneficiaries include city traffic planners and the police. 

Information on car movement can be used to establish user profiles for targeted advertising, and GPS tracking devices could warn bosses whether employees are using company vehicles for personal reasons. 

Consumers have known for years that handsets and computers can be subject to personal identity theft and harvest information that is sold to third parties, but with cars, it's something new for most. 

"This topic comes up a lot these days and it will continue to do so for many years," says Thomas Kranig, who heads the Bavarian data protection agency in southern Germany. 

There are so many possibilities for using in-vehicle data that many may not be used for some time, or until privacy laws permit. For instance, a car could pay for its own fuel electronically at the pump using the owner's credit card, though this is currently not allowed. 

Shops and petrol stations could examine customer flow to get ideas on how to boost turnover. Apps could also report parking spaces and take the frustration out of finding somewhere to leave the car when out shopping. Cockpit displays could tell the driver about restaurants and stores in his or her vicinity, personalised based on taste. 

Owners have a right to ask what happens to the data generated by their vehicle, though carmakers are cagey about what actually happens to the information they harvest. 

Take BMW, for example. A customer whose car is fitted with the company's "Connected Drive" system might send out a message for breakdown assistance that includes the identity of the vehicle and owner so that a BMW-authorized repair shop can attend the incident. 

"This data is later deleted and there is no way that the data is transferred to a third party," says a spokeswoman for the company.  

Over at the Allianz insurance company, one of Europe's largest, managers take a different view. The company regards in-vehicle data as relating specifically to the vehicle and not the person at the wheel. In such a case, normal privacy laws would not apply. 

Insurance companies want access to all in-vehicle data which would reveal such details as how fast or slow the car has been driven. Premiums could be adjusted accordingly, and the data passed on at a profit. The owner would have agree to this, but he or she might not be aware of the repercussions of doing so. 

Kranig stresses the need to keep technical in-vehicle data separate from infotainment feedback such as what music a driver or passengers are listening to via a provider such as iTunes. 

"These days people are willing to disclose a good deal of personal information in order to gain access to paid or free services," he says. "People have hardly any privacy left," he adds. — dpa