The Data Diva E80 - Andrea Amico and Debbie Reynolds

Debbie Reynolds “The Data Diva” talks to Andrea Amico, Founder & CEO, Privacy4Cars. We discuss his journey into the Data Privacy industry and his knowledge of personally identifiable data captured by cars, the enormous volume of data that cars transmit and retain about the automotive operator, how data of individuals can benefit companies who sell the data, how the vehicles are like a browser on wheels, third party data sale of data from cars, the need to claim your car’s app, data that remains in the vehicle when sold or traded, right to repair and data privacy issues in legislation about cars, whether automakers will be more transparent about data capture and sale due to EU regulations like the GDPR, the sale of car data to data brokers, nudge technology and cars, Smart City integration with cars, the inability of the owner to find the information collected without great expense, the threat to cybersecurity, and his hope for Data Privacy in the future.

By popular demand, Debbie Reynolds Consulting is now offering executive briefings on emerging data privacy risks and how companies can avoid them. To learn more, visit the Executive briefings page on my website.

Transcript

Copy Transcript Copied

52:58

SUMMARY KEYWORDS

car, people, data, consumers, dealerships, vehicle, companies, collected, privacy, manufacturers, telematics, world, nudge, privacy policy, sell, repair, transparent, information, realize, drive

SPEAKERS

Debbie Reynolds, Andrea Amico

Debbie Reynolds

Personal views and opinions expressed by our podcast guests are their own and are not legal advice or official statements by their organizations.

Debbie Reynolds  00:00

Hello, my name is Debbie Reynolds. They call me "The Data Diva". This is "The Data Diva Talks" Privacy podcast, where we discuss Data Privacy issues with industry leaders around the world for the information that business needs to know now. I am super excited to have a special guest on the show, Andrea Amico. He's from Georgia, partially, right? And he's the founder of Privacy4Cars. Nice to have you here.

Andrea Amico  00:44

Thank you. I've been super excited to be here.

Debbie Reynolds  00:46

And I'm fascinated by cars. My dad was a mechanical engineer. So I know way more than the average person ever knows about cars. And then over the years as cars become more, have more computer systems in it right? It was kind of shutting out people who did the mechanical things about cars. So we could talk about that as well because I want your thoughts on the right to repair stuff; it dovetails with privacy. But before we get into that, talk to me about your journey in privacy and why you created Privacy4Cars. Yeah, I have been with the automotive industry for more than a decade now. And one of the companies I used to run was a very large US car inspection company. And one day, I was going through vehicles doing an audit, and it just dawned on me to say, oh, my gosh, people are leaving their home address in their garage, in their car. How often does this happen? And what else is there, and you know, who is going to do something about it? And I started asking questions. And interestingly, all the industry veterans I talked to, they really didn't know; nobody knew. There was no; there were a lot of myths. But there were not a lot of facts. And so I started collecting data in building statistics and showing it to people and saying, hey, guys, this is a real thing. And actually, numbers have gotten worse, if I think if you've been to our website, you will see very loud and clear as soon as you get in there, more than four out of five cars, are cars resold with people's data in it. And it's not only the home address and garage or cars, which God forbid, you know, the next person uses. But it's, you know, it's your phone records. Increasingly, it's biometrics payment systems identifiers. There's a lot. And, you know, if you want to have an interesting couple of hours, just pull the privacy policy of your manufacturer of the car that makes your car and gasp at it, because it's just really stunning if you never have thought about how much data is in cars nowadays.

Debbie Reynolds  03:02

I was dumb. So I knew that cars, as a result of technology, carmakers were very forward-thinking about how they were using computer systems and cars. And so I did a video, I think last year, on automobile telematics. Cars, people think, okay, my car has this cool infotainment system, I can press buttons and have it do really cool things. But what I didn't know when I found out about two years ago was how much additional data that a car collects that you would not even know about as a consumer. So I actually got to your story. So I went to get my car serviced at a dealership that wasn't the one that I typically would go to, right? It was one out in a different town. And I drove up, and I said I wanted an oil change. And I asked the ladylike, do you need my name? And you know, information. I'm like, check me in or something. And she said no. So she got her iPad, and she got this dongle and put it under the dashboard and up pops my name, address, and phone number. I literally could have fainted when I saw the stuff. I couldn't believe it. So I think that I had always thought that those telematics systems were tracking just things about the operation of the vehicle, right? To help people fix the vehicle. I did not know at that point that it was collecting a lot more personally identifiable information, and you as a consumer don't have any visibility into what is actually collected about you in these cars. Like some of the stuff that you talked about. One thing that people be shocked about is let's say your car knows your weight every day when you get in your car because it weighs you to know if you have a car that has an airbag, it needs to know how much pressure to apply to the airbag based on the weight of the individual. Right? So that information can get sold to other companies. Right? So it's this whole back channel of data collection isn't apparent to individuals. So tell me a little bit more about that.

Andrea Amico  05:25

Yeah, well, so as you pointed out the journey over the years, right, the journey went from cars, or mechanical things that take you from point A to point B, then typically, data collection started with good intent in mind, and typically was driven by safety, right? Your example of weight is a great example, right? You need to know how much firepower to put in the airbag to stop people of different masses, right. So you need to take their weight; every time they sit on the seat, you're actually jumping on a scale, which people really don't realize. And again, he started with great intentions of making cars safer. And similarly, you know, how your vehicle was performing was originally meant for making sure that your maintenance is working to improve the design of cars. And then automakers started to realize that they had a treasure trove of data. And that's where the people started to happen. And that's where I think consumers need to start to be worried because they decided, well, how can we use this data first internally, and then who can we sell it to?. And right now, we track over 500 companies that collect data from your car, buy it, sell it and trade it. And I'm sure we're just scratching the surface. And as you pointed out, some of these data may affect how much you pay in insurance. Some of these data may affect how much your car is valued when you go and sell it. This data may affect choices that you make in your everyday life without realizing that you have been nudged in taking one route instead of another. Because Route A is going to take you in front of a gas station that has an agreement with the automaker, and so they'll drag you in front of that one instead of the one that is not part of the command. Right. So we started to really enter a world in which people's actions in the physical world are being influenced by the technology in vehicles. Not to mention them again, this data then is potentially available for riches is sold to companies in by and large consumers have no idea.

Debbie Reynolds  07:38

My boyfriend and I were driving in my car; it has the GPS right with the car. And it takes me all these crazy, wacky routes, and he doesn't like using it at all. So he uses Google Maps on his phone, and it'll tell a totally different route. So that makes a lot of sense to me because I couldn't understand why it took me to this different route?

Andrea Amico  08:04

Well, some of these algorithms, not sure that Google doesn't do it either, right? So, you know, we've done the test with, you know, a bunch of friends of studying at the same place and going to the same place and you know, two people use Waze, two people use Google Maps, and each of the four of us could rightly read different routes. And then you got to ask yourself why and the premise that you cannot really answer because all those algorithms are not transparent. It's not clear if it's random; you're really being pushed in one direction versus the other. But I think what is concerning is that a car has become a browser in the physical world, and your clickstream, your browsing history is for sale to a lot of companies, and I think a consumer should be concerned about it.

Debbie Reynolds  08:47

Yeah, let's talk about contact lists, right? And texts, okay? So I like to write in my car; I'll connect my phone to my car to listen to music, for example. But in addition to that, regardless of what else I want to do, it is downloading my contact list to the car, and it's in my car has the capability to download text regardless of whether I want it to or not. Right. So that's something that happens that I know that a lot of people don't understand.

Andrea Amico  09:24

Oh, yeah. So I think we all had the experience of syncing our phone to use the hands-free system, which by the way, is a legal requirement in most states. Or I think a lot of us have run low on battery, and we plugged into the USB port and what happens there. Right. And again, there's a lot of myths in that you may get a pop-up that tells you do you want to download your contacts, and if you hit no, then maybe because it's a rental car, you think that nothing has happened? That's not true. Every time you sync your phone with the car, your car downloads a lot of stuff from your phone and creates a mini clone of your phone. Again, this was designed originally for safety purposes. So the data being locally stored is faster to put in front of drivers in case of emergencies to be more responsive. But again, now these days, they're in companies in their privacy policy, they have the right to use not only that, if you sell your car, or you just finished or rent your car, the next person can help themselves. And three or four years ago, we actually showed to over 20 manufacturers how easy it was to extract the text messages and contacts from cars. And, you know, I taught my daughter back then when she was eight years old, and I told her how to extract the text messages of mom, which I think is great parenting, but you know, we can disagree. But it's that easy. And actually, last year, we were collaborating with another researcher in Europe, and he did that in a different way. And we collaborate. And we believe that that technique works with 100% of the cars on the road, not just half of the cars in Europe. And so you know, if you sync your phone, just be aware of your text messages, what music you listen to, but also, depending on the car stuff from transactions, what apps you've been using, files you may have saved on your phone, photos you may have taken on your phone, what social media, you're on what handle you use a lot of this stuff, there is a track of data in your car. And it's literally up for grabs from whichever person that comes next. In fact, there's right now there's the police has been used to use this data, there's actually right now a proposal in the US Senate to pass a law to create protections in Fourth Amendment protections around these exact issues because senators suddenly realized, hold on a second, you cannot get through my phone without a warrant by you don't need it if you get into my car. They don't think it's right.

Debbie Reynolds  12:02

Right. So wow, this is unbelievable. So a lot of this comes down to the third-party doctrine about how legal jurisprudence has thought about the physical physicality of where you are with your information. And then also third parties to have your data. So if a third party has data about you, it has lesser protections than you would have if it were a physical thing in your space. So this is definitely an argument that we're seeing in the US for sure. And definitely internationally about. So, first of all, who owns this data, right? So you would think the data about you that you own it within the US, you don't really own that data, or you don't have the same level of agency with it, it is in a third party's hands, and that third party, maybe your automobile.

Andrea Amico  13:01

Yeah, and you know, interestingly, specifically for vehicles, there was a law passed in 2016 called the Driver Privacy Act. And it clearly says if you're the owner of the vehicle, you need to provide your permission, unless there's a warrant and a few other cases like national security, etc., right? You need the permission of the owner to access data from the car. But this applies to only one of the about 100 computers in a car called the black box, the electronic data record, right? And so what is stored in there, which is really accidentally data or what speed you were going, which gear you were in, how hard did you have an impact with a vehicle that kind of stuff, right? That is protected. Everything else, which is 99.9% of the data collected by cars, is not, which is why now you start to have advocates on civil liberties. Look at some privacy again, these people in public, really looking at myself saying, hold on a second, the car is becoming a backdoor to extract data from phones of people. Is that right?

Debbie Reynolds  14:10

Wow, oh, my goodness, I just have so many things running in my head. But I just have so many things I want to ask you about. Let's talk about apps with cars. So I tell people this all the time. And so for people I know, some people who aren't, don't want to interact with their car with the app, I get it. But if you don't, if you have a car that has an app that can help you connect with data about your car, you should at least claim the app because other people can claim the app if you don't, right, so all they really need is proximity to the vehicle and the VIN basically, and they can claim your app. They can actually if your car has the capability, it can do remote functions, so it can you know turn on that alarm, you can unlock or lock doors and can track sort of where the vehicle is taught. Tell me a little bit about that.

Andrea Amico  15:07

Yeah. So as you pointed out, a growing amount of vehicles now come with a companion app, right, and manufacturers have put a number of features into these apps. Typically, you will know the mileage do you need service, but you know, increasingly, it's, where's the car? Can I unlock it? Can I start it? So great, you wouldn't want somebody else to have credentials, right? So three years ago, we reached out to the Automotive Manufacturers Association, which is the Association created by the manufacturers to disclose, you know, security issues.

Because we had done a test, we realized how easy it was to take over credentials. And by the way, some of these credentials are for sale on the dark web, right, and you can buy them for a few hundreds of dollars. And in most manufacturers did not respond back then a couple of them got back to us and said, well, if you were to do that, there will be a breach of our terms of service, which I'm sure has criminals all over the world shaking in their boots. And that was the answer. Unfortunately, we keep hearing of cases; there's a criminal case, actually, in California courts, right now, it's a horrible case of domestic abuse, where, you know, the ex-spouse had access to the app of the person and used it to put her in danger basically. But there's also, you know, a growing amount of cases in which consumers come to us and say, hey, I sold my car six months ago, a year ago, two years ago, I can still see where it is. And I can still lock it and start it. And, you know, so that's, that's one of the things that we work on and to help consumers have protections. And it's a very, you know, it's a very evolving issue, where I don't think that companies have quite grasped the magnitude implications because now it's no more just a privacy issue. This is a safety issue.

Debbie Reynolds  17:13

Right, and I think people don't understand, if you have a car that you let someone borrow or you sell it, that data doesn't automatically stop. There's another action that you or someone else, as a consumer, have to do to transfer that data to a new owner or a new person. So it's not visible to consumers that other people may have access, which is dangerous in the first place. Cutting the cord with all these technologies is extremely cumbersome and difficult for consumers. And I'm sure that all of your audience has experience trying to discontinue or change providers for their mobile phones or their cable company. So take that experience that you had multiplied by five, then realize that three of the five are companies; you don't even know who they are. Because it's not disclosed in the privacy policy, that's the effort that is required. And we don't think it's right. I agree with that. Well, let's talk about privacy. So this is fascinating. So there are some right to repair laws. And I will talk about the Massachusetts law. This is fascinating. And the reason why it has a privacy angle is because of the data, the personally identifiable data that gets collected as in addition to kind of the operations, computer telematics that are in an automobile. So in the state of Massachusetts, I think as of this year, new cars that are being sold in the state of Massachusetts have to have kind of an open system where an individual can see to some extent what data is being collected about them in cars, and then also be able to open this up so that other people beyond kind of car dealerships can repair cars. So this is the issue: when cars became more like computer systems, manufacturers and dealerships worked together to keep up almost like a closed-loop on who could repair these cars. So if you had a mom and pop shop down the street that you liked and trusted and you wanted to repair your car, if your car has heard types of telematics or computer systems, there are things that maybe that mom and pop shop didn't have access to because these manufacturers and dealerships, were holding on to this information. So Massachusetts passed this law, which is a rights repair law, which basically says you know, car manufacturers and dealerships have to have an open system so that these mom and pop shops have access to the data so that they can also repair these cars. But in addition to the repair and kind of the mechanics of what happens within the automobile with these infotainment systems and things like that, people aren't aware, still, that there's all this additional, personally identifiable information that is in cars. And I think a lot of automakers have been against these laws, didn't want to really be transparent, obviously, part of it is sharing or maybe losing their share of the auto repair or aftermarket type of money stream, but then also not being transparent with individuals about what data is in their cars because I think if people knew what their car collected, they would be horrified.

Andrea Amico  21:03

I think if people knew what car their car collected, they would be horrified that first of all, I know I'm sure you know, the right to repair is now stuck in the courts. Right. There was a referendum for the population of Massachusetts once the Right to Repair Act passed, but it is stuck in the woods. There's a legal battle between the manufacturers and the city attorney of Massachusetts. So we'll see where what happens with that. Our perspective is that to oversimplify things, there's really two types of data that cars collect is technical data and personal data. And that's how we define it, right? So is there a problem if your repair person knows if the timing of the firing in the cylinder is correct or not? If the oil pressure is correct or not, the temperature of certain goods is correct or not? We don't think consumers really would worry about that. Right? The second in which you start to associate that information with GPS information. With identifiers. That's where it becomes, you know, actually something I think consumers should be concerned about. I don't think that they would want their repair shop necessarily to know where they've been or whom they talk to. But probably they wouldn't want their manufacturer to know that either. Right. And manufacturers today do. I agree with you that if consumers saw what data was collected, there would be a much bigger debate? And it wouldn't be about can I have my car repaired? With the shop of my choice? It will be why in the world is all this data collected in the first place? So what are you doing with it? And nobody really wants to have that conversation get out of the house. So it makes us a little bit of an outlier in the industry.

Debbie Reynolds  23:07

So, where are we going with this? Are you seeing automakers trying to be more open? Are they being more closed? I mean, obviously, they're going through the course trying to stop a lot of this kind of transparency. I feel like the future is to have to be transparent when you're handling data of individuals. And I feel like the automotive industry needs to wake up to the fact that this is what the future is going to be. So they need to try to find a way either not to collect this data, right or find better ways to protect it. What are your thoughts?

Andrea Amico  23:39

Yeah, so I think that more and more manufacturers are realizing that the ground is shifting and that more people are aware that personal information is collected by vehicles. We see a lot of evolution in the privacy policy, but also in the practices of manufacture. There's a growing number of OEMs that, for instance, when your vehicle is resold, at least in certain channels, they make sure that your data is not sold together with the car, right. And so they asked this data to be wiped. We actually work with a number of them. I think when it comes to third parties, it's far less transparent. And in fact, if you were to read the privacy policies, first of all, I hope that you know you have a hard time sleeping, and then we'll fix it. But if you were to read US privacy policies, very few mentioned any third parties by name, and it will be household names like Sirius XM. But there is. Otherwise, there's very little clarity over what data is collected to which company that actually goes what the specific purpose of the collection of those pieces of information was. And in fact, we even offer a free service to consumers to assert their rights. And we help them place requests not just with the manufacturer legally with hundreds of companies to know what data they have about them. And the answers tend to be very vague. And typically, they just regurgitate whatever is on the privacy policy, but they really don't explain to consumers exactly what was collected for what purpose, and we think that needs to change.

Debbie Reynolds  25:29

Yeah. Are you seeing any movement about this in Europe? You know, I've seen Europe has stronger privacy regulations related to personal data.

Andrea Amico  25:40

Yeah, so interestingly, so in Europe, there's two pieces of regulation. They clearly apply GDPR and E privacy, and the reason why your privacy applies is because a b equals for this call, you know, this is a piece of terminology equipment. So that's what this regulation is about, right. And there are already mandates in place that have been in places like the original GDPR. And there's also been white papers written by the European Data Protection Board and how they exactly apply to connect to the EU. So there is a lot of clarity on the fact that, yes, cars collect personal information; yes, it is regulated. Yes, it's not allowable to sell a car or rent a car with leaving the personal information, the previous person’s in there. The reality is, unfortunately, quite different. So we just did an audit in the UK. And our figure of four out of five is right on the dot, also in Europe. In the UK, now, it's, you know, Brexit, but they have the same general regulations, as you can imagine, and so one thing is what the law says, and what is actually happening is, unfortunately, still quite different. So a huge gap that companies need to fill.

Debbie Reynolds  27:03

Yeah, I So this all plugs into data brokers, which is industry; this has been thriving over the years, mainly because they operate in the shadows. People don't know who they are, or what they are and what they're doing with this data. And then part of it, some people don't, can't imagine what happens when this data is correlated together, or gathered, maybe, let's say you use, five different services, the data that you generate from those five services may be shared by those five companies, and maybe that gives them a more fulsome view about you. The issue is, if they are using that data to make decisions about a customer that can be harmful, it's not transparent.

Andrea Amico  27:55

Well, absolutely. So we have done a few tests, in which we asked ourselves, okay, if I were to go to a random dealership, and I were to test drive a car, and I could take a 30-second video of select screens in the car, what can I know about the previous owners? And you will be appalled. You will be appalled, right? Because first of all, you can extract a lot of personal information straight out of the car, that doesn't require the NEF, right? Where people live, where they've been, you know, that means very quickly, you will know the first name, we have the last name, we know what really we know how much the house is worth. We know where they take the kids to school, we know which hospitals they go to, you know when they go out for, what's your favorite place for dinner? I mean, you get to know all this stuff, right, of course, because again, the car is a browser. And the browsing history is right there unless you wipe it super easy, right. But then, once you start to combine it with other sources, as you said, you get a much finer picture. And then, if you really had access to the entire stream of data that you can extract from the telematics, that's when you actually start to know the behavior of people is not just how they drive. You know, there's an increasing amount of vehicles now have driver monitoring systems. And there's a lot of debate around Tesla, for instance, and they don't know how to make the car safer. And how could these people be in the backseat, and we should slap a big camera right in there to make sure that people are behind the driver's seat? Well, the problem with that is that a lot of companies are actually doing this. And, but what they're doing is not just am I paying attention to the road. In fact, the largest supplier of these in-car cameras just acquired two companies. These are AI companies that specialize in detecting people's emotions. So consumers should be aware that when you drive a car, there's no red blinking light, but if you're driving a current vehicle, chances are, there's an infrared camera behind the dashboard that is looking at you every second. And it's trying to interpret what you're doing. Again, the basic stuff is, are you paying attention to the road? Or you're looking at your lap? Because that's where your phone is. And so, you know, maybe buzzers make you pay attention to the road. That's a good thing. But from there to say, You look hungry. I know, they usually you'll stop at Chick Fil A; I'm saying that because I'm in Georgia. Right? So, Andrea, there's a Chick Fil two miles down the road, right? Or you look tired. There's a Starbucks three miles down the road. So when I'm leaning toward you, want to do that, right? So again, your actions are being nudged for what was originally a purpose of safety into something really different. Yeah, let's talk about your tests on the technology. I did a video on that as well. So nudging, the theory behind nudging, started in education, right. So it wasn't really a technological thing. But what we're seeing is this nudging, which is basically in education that was used to give positive reinforcement to people who were learning different things, but what we're seeing, because it's a psychological sort of manipulation. So nudge in itself isn't bad, but not as bad when it's being used in ways that aren't transparent to people. And then also, instead of, let me nudge you to learn or can increase your skill level to let me nudge you. So you can buy my products or product of someone that I have a business relationship with you.

Debbie Reynolds  32:00

Can we talk a little bit about nudge?

Andrea Amico  32:05

Yeah. So I'm sure there's a huge debate now around dark patterns, right. And the reality is that trying to change the behavior of people per se is not good or evil. As you pointed out, you know, if I told you to be sticking to cars, if I taught you to be a better driver, to keep a better safety distance to be more aware of your surrounding, and by doing so, did I am I reducing your likelihood of getting into an accident, is this a good or bad thing, I think it's a very different thing to say, again, you look tired, but I'm not going to send you to Dunkin Donuts, and the transparency, as you pointed out, those are the two things that really make a difference in the ethics of it. Yeah, and regulating this, as I'm sure you know, is very difficult, right? And we're still at the very beginnings of how technology companies do this in the physical world. There's plenty of nudging in the UK, in the online world. I think it's quite different, you know, am I pushing you to click an ad, you know, and I'm changing your behavior by 0.2%. But in aggregate, with all my users, it makes a difference. That's one thing. But am I convincing you to take a right turn versus a left turn in the physical world? I think that that's quite different.

Debbie Reynolds  33:29

Yeah. Wow, that's crazy. So I work a lot with Smart Cities and fleets and telematics and,  collecting data, the way the cities use cars and the Internet of Things. I tell people your car is basically a computer is a series of computers on wheels. And one thing that people don't understand about cars is that the data that is captured there can be transmitted wirelessly to other places. So it's not just I think some people say, okay, this stuff is collected is in my car. So I know it's actually, you know, being transmitted wirelessly to other things. Right. Let's talk about that.

Andrea Amico  34:14

Yeah, I mean, back to your example right when you said that you pulled your car into the shop and they knew whom you were depending on what car you drive, they know when you just turn into the dealership right, they get a signal with hey that'd be spoiling the end make sure you get bay number two and call her by name and offer her a coffee because it's her favorite drink. That's not actually happening today. And that's the reality of cars and realities that all this technology has been originally evolved as features. Right? And so this is as crazy as saying, you know, we sell typewriters. Oh, but then as a feature, we started to put the hardware so we can record what you typed. So you can remember it. Or, as a feature, we decided to put a screen. So you actually don't need the paper was a feature, we added a modem, or as a feature, we added whatever, whatever, right? And then this thing, you know, is a laptop. But when it talks to, you know, when it comes to what measures should we take to protect that the industry see likes to say still a typewriter, we don't have to do much. And that's problematic. And this is not just a manufacturer situation, right? Saying that to fix all of this, we just need to get the manufacturer to do something and change something. It's not true anymore. This is like saying, you know, let's go Intel, Intel, and Dell, that they're responsible for, you know, privacy and security on the Internet, you know, cats out of the bag at this point, because literally, the cars are hyperconnected, there's hundreds of companies that are involved in exchanging data. And let's not forget that, you know, those assets are rented, sold by dealerships. They're financed, they're insured in don't these companies have actually a responsibility to protect the data of consumers? We think they do. Right? So this is a much bigger discussion, then, you know, what should for the do or what, you know, what should you know, name your favorite manufacturer? It has become a much more complex problem to solve.

Debbie Reynolds  36:31

Yeah. Also the technology, I don't think people understand how advanced technology is now. Right? They don't understand the things they're using. Now they don't understand what is doing with their data house collecting information. And then now we're getting into a situation where, you know, the technology will be lightyears ahead of where people are thinking, you know, that's exactly where we're going with the metaverse and connected devices instead of Internet of Things devices, collecting information just on a device, now, they will talk to one another about you and, you know, get more information and make more inferences. And you know, those inferences concern me quite a lot, right. So these, in addition to the tangible data that these devices can collect, also can make inferences as you said; what are your thoughts?

Andrea Amico  37:29

Well, all of these are true; I think what I'd like to point out is how cars are different and, in my mind, are different in two ways. One is that you and I can argue how important it may be to name your favorite social media platform. Okay. But there is very little debate on the fact that if Americans do not have access to personal transportation, there are some real-world impacts in most of the United States in their access to healthcare, being unable to have a job and, just in general, secure their well being and their financial well being. And so, cars are not optional for most people. I think that this raises the bar on the level of protections that are necessary. The other thing is that cars are sold through dealerships or rented to through rental companies; they're insured by other companies. And so, unfortunately, not only it's very difficult to understand what data is collected by cars, but you have a little bit of these, you know, these drill in which the manufacturers tells the dealership but they're supposed to say the dealership is supposed to tell you certain things, and then you're supposed to read. And so, every time that there's all this disintermediation of information becomes even more confused than it should be. In fact, last year, we said consumers to 72 different dealerships. And we asked them to test drive cars. First of all, they found personal information in 88% of the dealerships just by driving one or two random cars of their choice, which already tells you the magnitude of the problem. But then we ask consumers to ask a number of questions to the dealerships on how the car works. It turns out it is only four out of 72 dealerships. So that's what 6% correctly told consumers. Yes, this car collects personal information. Yes, the manufacturer has the right to sell this personal information. Right. And so if you're a buying it at a store, and the store doesn't know, and I don't think this was malicious, I think they honestly just like consumers, they don't know. Right? But this is why the model of consent is even more broken for cars than for name your average device or, you know, service online. Because it's even more problematic, and let's not forget cars are the first or second largest purchase of Americans. So it's not a tiny thing. This is, you know, for most people it is the most expensive thing you own.

Debbie Reynolds  40:28

Right. Also, I just want to touch on this. I had this experience recently. So you're talking about the driver Privacy Act that protects kind of the black box information, it is almost impossible for a regular person to get that data, I found out, it's hard to find out where it is, how to get it, how to talk to people to get it some you know, there are some law firms that specialize, and maybe they have deals with people. But I mean, if I have that right, I should be able to see that data, right?

Andrea Amico  41:02

Yeah, the reality is that that data will be highly uninteresting, I promise you. So you know, if you're being asked to pay between $1,000 and $3,000, real numbers that we hear from consumers that tell us that what they've been asked for twice a year, just don't spend the money, it's not worth it. Unless, you know, the only moment in which you want to have a copy of the data is if you are in a serious accident. The data is actually being subpoenaed using legal proceedings, right. But otherwise, most people don't know what your angle is in the first place. So why would you want to know what was your angle at a certain time, right? So it really doesn't matter. The data that really matters is, again, from a privacy perspective, is outside of DVR. And it's completely unregulated by the Driver Privacy Act. It's how much should you wait if you're alone in the car? Who else was there? What were you listening to? What were the last five things you touched on in your infotainment system? How hard do you brake? Wherever you're being? What are you calling? What are you getting there? What are you distracted by? Those are the kinds of things that are really collected and monetized. And those are the kinds of things that are not in the act, and they're not regulated, or then by the Privacy Policy and Terms of Service. And as you can imagine, those are one-sided. A consumer cannot go to a dealership and say, yeah, I'd like to buy the red one on the lot. But I disagree with clause 27 and clause 43. And your redline them and hope to walk out of the lot. You can't do that. Right? So there's really no choice.

Debbie Reynolds  42:45

Right. A lack of choice, a lack of transparency, and a lack of agency. So, where do we go from here? What should we be doing? And we're not doing now?

42:55

What? So?

Andrea Amico  42:58

There is some progress, right? So we've been pushing a lot of force in the industry to really think hard, not just about regulation. But what's good. Right? What's good for consumers and consumers? What's good for business? Is it really good to sell people data together with cars? So do we just sell cars? And so we've actually convinced a lot of companies that before selling the car, at the data consumer probably should be taken out. We are creating free tools for consumers such as this, assert your rights. I bought a new car. How do I know that the old owner is not tracking me? It turns out, right. So we'll take on those cases legally pro bono because we think it's the right thing to do. But I think consumers should demand this. If you go to a dealership, shouldn't you ask, you know, if you're trading in your car, you're bringing back your lease, to say, show me that you're going to get rid of my data. And don't take people's word for it. Because we've done that, you know, when we send us consumers to those dealerships, a full third of the dealership said that they had a process in place to remove the data. And it turns out it wasn't true for at least three-quarters of the dealerships. And don't take people's sure we do that at face value. Ask them to show you what are they doing? I mean, we ask the same things when we bring our electric devices right, so if you bring back your phone to say your Verizon store, they'll delete the data in front of you they'll show you how to do it. At the end of the day, I think people need to demand respect for the data; they will demand proof. And they need to show companies that they care. Because if consumers don't ask for it, companies themselves will care. I think it's very important. And I'm glad that, you know, your audience is very, very attuning to this; they will keep asking, let's do the right thing.

Debbie Reynolds  45:22

And then, on the business side, for companies that are developing technologies in this space, you should really be thinking about how to build in privacy at a foundational level, right? So not collecting more than you need, having a purpose for what you collect, making it easy for whoever, whether it be the dealership or individual, to be able to either see or even delete, the information that's being collected about them, you know, I think is really important. And I think this issue is only going to become more pressing in the future. Like you said, we've seen some cases, regarding domestic violence, where someone may have been stalking someone or attracting, you know, cars, and we're seeing this with like, Air Tags, you know, not to pick on Apple, but you know, anything that's doing tracking of people can even though it may have an advantage, we have to also think about what could be the potential harm. Sometimes manufacturers, they really get excited about the innovation, which is nothing wrong with that, right? You have to think about the bad side, you know, how can this be used to harm someone? And how can we design it to sort of limit that harm?

Andrea Amico  46:38

I very much agree with everything you said. I think there's a long journey ahead. We are a small company, where I think we're being pretty good at influencing some large players to look at things differently. And we realize it's just a journey. And my hope is that people in your audience will start to think more about what is in their car, and they look at the other driveway, as they look at the computer, they're connected. It's literally the same thing in the same safeguards that demand to have in place for their other electronic devices. Hopefully, they will start to demand the same safeguards for their cars.

Debbie Reynolds  47:28

Excellent, excellent. So if it were the world, according to Andrea, and we did everything you said, what would be your wish for privacy in the future?

Andrea Amico  47:40

I think that if people started to ask themselves more, what is my car doing? And then ask accountability from anybody services that do their dealerships, their auto finance company, of course, the manufacturer, the rental companies, we will be in a much better place. It always starts with caring and asking that companies do care. I think those that do simple things can actually change a lot of behavior in the world and make it a better place.

Debbie Reynolds  48:13

Yeah, that's a great, great question. I want to add a comment. Something that I'm seeing in the cell phone world and I think is also probably happening in the car world. So there's a trend now that manufacturers are seeing, and they're people who can afford new phones want older phones like they're not liking some of the data collection happening. So so we're also seeing people, there's an uptick in people buying used cars or older cars, not the newer car so that to me, that should be a wake-up call for the industry, to let them know that people aren't really happy with all this, data collection, and especially when it isn't transparent to them.

Andrea Amico  49:03

Unfortunately, it's becoming less and less of a choice, right. So one more thing, which cars are different than your average consumer electronics, right? So if you go to your big box store and you buy a brand new TV today, it is virtually impossible for the TV to not be a Smart TV, right? But at least if you take that TV home, and you decide to never punch in your Wi-Fi, network name, and password, then the TV is still dumb as a bag of hammers, right. It doesn't connect anywhere. That's not true with cars. Cars are connected at the factory. And in many cases of complete disconnection, actually not possible because certain safety systems rely on and actually if you were trying to do that, you would spend a lot of money you would void the warranty, and you will drive an unsafe vehicle right, so that's the other thing where cars are different. And yes, while I do hear people sometimes with, oh man, I'm going to buy myself a 1960s Corvette, it sounds pretty cool, I've got to tell you, but you know, it's just not. It's just not a feasible choice for most consumers. And unfortunately, cars do age, right? And if you want to have reliable vehicles, say I want to drive the 20-year-old vehicle because it didn't have any of this. It has some, again, some real-world consequences.

Debbie Reynolds  50:34

That's fascinating. Oh, wow. I'm so glad to have you on the show. This is amazing. I can't wait for people to hear this. I think everyone needs to hear it in the personal world, in the business world. How do people get in contact with you if they're interested in Privacy4Cars?

Andrea Amico  50:52

Oh, sure. The easiest way for them is to go on our website, which is Privacy4cars.com. We also offer a free mobile application for consumers where they can learn by themselves how to delete the data, or at least certain data that is stored in the vehicles. It also makes it easier for them to get in touch with dealerships that may offer protections, and so that they know who are the good folks out there, they're actually doing something about it. So you can just look for Privacy4Cars on the App Store or Google Play and download it for free. And hopefully, people will like it.

Debbie Reynolds  51:37

Perfect. This is amazing. Thank you again for being on the show. This is amazing. Keep up the great work. I'll be keeping my eye on you and what you're doing, and you know, hopefully, we'll have a chance to collaborate in the future.

Andrea Amico  51:50

Oh, you're just sort of them to be on your watch list. So now I know I really have got to be here. Well, it's really lovely to be here. Thank you for having me. Keep up the great work. Thank you for raising awareness. We need more people like you out there.

Debbie Reynolds  52:06

Oh, thank you so much. I really appreciate it. Okay,