Car data privacy breach: automakers secretly share driving records with insurers

Do car companies sell your data?

A startling revelation has come to light – major automakers and insurance companies have entered into a furtive exchange of consumer driving records. This under-the-radar practice involves car manufacturers discreetly sharing granular details about individuals' driving habits and vehicle usage patterns with data brokers who cater to the insurance industry's appetite for such insights.

The veil was lifted on this covert data trade when Todd Smith, a software firm owner residing near Seattle, received an eye-opening 258-page dossier from LexisNexis, a global data analytics giant. The document exhaustively chronicled over half a year of driving activity by Smith and his spouse in their Chevrolet Bolt – detailing a staggering 640 trips with specifics like dates, durations, distances traveled, instances of speeding, harsh braking, and aggressive acceleration maneuvers. Astonishingly, this treasure trove was furnished to LexisNexis directly by General Motors, the automaker behind the Bolt model.

Smith's jaw-dropping experience in car data privacy is far from unique. Over recent years, automotive titans like GM, Honda, Kia, and Hyundai have forged strategic alliances with data brokerages such as LexisNexis and Verisk. These partnerships grease the wheels for the mass harvesting and dissemination of driving conduct data culled from millions upon millions of internet-connected automobiles prowling American roadways.

While some motorists may have willingly opted into sharing their vehicle's telematics for tailored usage-based insurance offerings, a significant cohort claims complete obliviousness to any such data-sharing arrangement. Online forums are replete with bewildered drivers venting their shock at discovering their intricate driving records were surreptitiously dispersed to third-parties – a revelation that frequently precipitated alarming spikes in their insurance premiums.

One particularly unsettling case involves a Cadillac owner hailing from Florida's Palm Beach County. This unlucky individual found himself denied auto coverage from no less than seven insurers after LexisNexis weaponized his personal driving metrics – including instances of forceful braking and aggressive acceleration – against him in assessment algorithms. Despite adamantly insisting his road conduct was neither reckless nor perilous, the owner ultimately secured insurance through a private broker, but at premiums more than double his previous rates.

The automakers and data brokers maintain plausible deniability, asserting they procured drivers' consent through densely-worded fine-print legalese and labyrinthine privacy policies – documents the average consumer is unlikely to scrutinize with keen diligence. However, legal scholars contend such disclosures grossly violate reasonable expectations of privacy.

"It's not within the reasonable expectation of the average consumer, it should certainly be an industry practice to prominently disclose that is happening," admonished Frank Pasquale, a professor of law at Cornell University.

The ramifications of this surreptitious data commerce extend far beyond mere financial burdens. Policymakers have sounded shrill alarms over the potential for consumer abuses and deceptive business practices warranting regulatory intervention. The California Privacy Protection Agency has already initiated formal investigations, while legislators like Senator Edward Markey of Massachusetts have issued forceful calls to action.

"If there is now collusion between automakers and insurance companies using data collected from unknowing car owners to then raise their rates, that's a potential violation of laws prohibiting unfair and deceptive practices," Markey warned, invoking the Federal Trade Commission Act's potent Section 5 prohibitions.

For their part, the automotive and insurance sectors steadfastly maintain their actions are lawful and rooted in noble intentions – chiefly promoting road safety by incentivizing more cautious driving habits. General Motors, for example, insists its "OnStar Smart Driver" program which feeds data to LexisNexis and Verisk brokerages is strictly optional, transparently designed to educate customers on their driving behaviors and potentially qualify them for more affordable coverage commensurate with their road conduct.

Nevertheless, the prevailing lack of transparency combined with evident potential for misuse of such private data raises grave concerns over consumer privacy safeguards and ethical boundaries governing data harvesting practices. As internet-connected vehicles become ubiquitous, strident calls for prominent disclosures and muscular regulatory oversight will only intensify.

While usage-based insurance models proffer theoretical benefits for responsible motorists, the presently clandestine nature of data sharing protocols erodes public trust and fuels fears over insidious privacy erosion in our increasingly data-driven world.  Striking an equilibrium between embracing innovative technologies and robustly safeguarding consumer privacy will be a monumental policy challenge for both lawmakers and industry captains in the coming years.