Everyone is talking about CTV (Connected Television), IoT (Internet of Things) and Connected Driving. For a long time now, we have not only used the remote control to unlock the car, but also navigate confidently through the many options and conveniences of the digital car – from cockpit systems to the vehicle app on the mobile. We have these options because cars are now “connected” to the Internet – and processing personal data requires consent from data subjects also for connected technologies outside of websites. There are different requirements for the various analytics use cases that can create added value for manufacturers, users and third parties.

 

More data requires more data protection

The diametrical development of Big Data and data protection also poses a major challenge for the automotive industry.

• On the one hand, more data can be collected than ever before: car owners interact with their vehicles via in-car multimedia systems or apps connected to the vehicle. The car itself collects data on driving behavior and the wear and tear of wear parts. Important functions from the engine and transmission are monitored to detect potential damage at an early stage and increase safety for drivers and passengers. So far, so good.
• On the other hand, the use of this very data is becoming increasingly difficult: for some time now, the General Data Protection Regulation (GDPR) has been bindingly regulating what needs to be taken into account from a data protection point of view when processing data, especially during collection and subsequent further processing. If personal data is collected during driving or human-vehicle interaction, it may generally only be processed for further analysis purposes with consent.

The automotive industry needs to think about how it can process data in a compliant way and how users can really understand what is happening with their data, because only in this way informed consent to data processing by users or drivers is possible.

What personal data is collected in Connected Driving?

Connected Driving use cases primarily involve the following IDs, which are considered personal data under the GDPR and therefore require the consent of users before the IDs can be processed:

1. User ID: This comes mainly from the field of web analytics or one of the dominant web analytics systems (e.g. Google Analytics, Adobe Analytics, PiwikPRO). It is randomly generated and does not actually refer to the user at all, but to the device or even only the respective browser. If a service based on a web application is called up via the in-car multimedia system, the user interaction can be collected via “normal” web tracking. As has been known for some time, consent must also be obtained for this type of tracking.
2. Vehicle Identification Number (VIN): This is a unique ID for each vehicle. This ID can be used to track exactly which vehicle is involved. If this ID is integrated into data systems in which data is also collected from other systems, a unique link could in principle be established between a vehicle and a person. The processing of the VIN for analytics purposes therefore also requires consent.
3. Login ID: Automobile manufacturers have also been trying for some time to provide individual sections for car owners. After buying a car, you receive an account with which you can use additional content and functions that are only available to the respective car owners. This content is only available after login. The login ID is unique per person (e.g., email address, username) and thus a datum that allows for exciting analytics use cases, but also requires consent for a specific purpose.

In order to implement both interesting and value-adding analytics and activation use cases, it is sometimes necessary to process these IDs (separately or in combination). Only through unique IDs, such as those mentioned above, can interactions and data points belonging to the same person or vehicle be linked. This allows us, for example, to gain insights into different driver segments and to understand the overall customer journey of car owners – from information gathering, to purchasing, to the use of login-based content and behavior in the car.

 

 

Connected Driving Use Cases – How can data from the vehicle deliver added value?

Analytics

The more data points a company has available, the more insights can be gained from them. The insights can then in turn trigger the improvement, adaptation or new development of functions, production or marketing measures.
From our experience, analytics use cases can be diverse and add real value by enriching them with in-car data. Possible use cases:

• Understanding how users interact:
  How do drivers use the in-car and connected-drive features provided? What are the usage paths? How do the observed paths differ from the manufacturer’s intended user guidance? Which command control is preferred (e.g., touchscreen, center console, voice control)?
• Plan for future developments:
  Are development efforts in proportion to actual use? How cost-intensive is the provision of individual functions and how often are they ultimately used? What are the most used functions and how present are they displayed?
• Measure system performance:
  How well does the interaction between the car and other systems (e.g., app to control individual functions such as heated seats or air condition) work? What are the most common errors?
• Creating different user profiles:
  Are there different segments of users in terms of interaction with the functions provided, e.g. music lovers, techies, purists? How do different user segments correlate with vehicle type (e.g., e-vehicles vs. sports cars vs. family vans)? How can we collect and analyze data on driving behavior to create different profiles of driver types?

With regard to consent for data processing, a distinction should be made between questions that also work without assignment to users or vehicles and those that require assignment to at least one of the IDs mentioned above. Especially when it comes to the pure understanding of interactions or the frequency of use of different features, such an assignment is not necessarily required. Creating segments and establishing a connection to the car, on the other hand, will not be possible without an ID.
As soon as the collection of one or more of these IDs is necessary to implement the analytics use cases mentioned, legally sound consent must also be obtained. Drivers must actively consent to the collection and be informed transparently about what data is collected for what purpose and how the respective car manufacturers (or their service providers) process it.

 

In-Car Activation

Once the data has been collected and processed, the next step is to activate it in the car itself. The multimedia system of a car offers an additional digital touchpoint which – similar to other touchpoints such as websites and apps – can be used for a direct and individualized customer approach. In-car data, if necessary together with data from other areas, can be processed in such a way that the use of the car, the driving experience or the use of digital services around the car can be adapted in a user-centric way.

For car manufacturers, this creates the following opportunities, among others:

• Personalized in-car multimedia content: Similar to the personalization of websites or mobile apps, the data and insights generated from in-car analytics can be used to personalize the multimedia system. Depending on which functions a driver uses more often or at which times which functions are used, the interface can be personalized. If the data from different areas (app(s) connected to the car, personal login area, in-car) is also combined, a holistic personalized user experience can be built up that can be provided at all touchpoints involved – and thus also within the car.

• Creating different driver profiles: If, in addition to the interaction data from the digital touchpoints, data from the car itself is also integrated – i.e., data on driving behavior and sensory data from the chassis and engine – different profiles can be created. For example, if a car is used by several family members or if several people in a company have access to a vehicle, a profile could be created for each person by processing the data. Machine-learning algorithms used specifically for this purpose could learn from the use of multimedia functions and the individual driving style of each person. If a person then selects their appropriate profile when they get in, their driving experience will be tailored as closely as possible to their individual needs.

• Creating additional revenue via in-car sales: Additional touchpoints are also additional points-of-sale (PoS). While we are already used to making online purchases via our smartphone, it is also conceivable to do so via the touchscreen of our car. For car manufacturers, this offers the opportunity to provide customers with offers where they are really relevant. Assuming that the data is collected, integrated and processed appropriately, possible in-car offers could look like the following:
  • “You seem to be a sporty driver. Try our upgrade for engine tuning to the “Sport” package for only xx,xx €.”
  • “We notice that you like to travel. Upgrade now for only xx,xx € to the advanced version of our navigation system and enjoy additional benefits abroad.”

Admittedly, the more advanced the use cases become, the more the question of actual feasibility arises. Nevertheless, modern automobiles are already a valuable source of data, but they also have the potential to be an equally valuable customer touchpoint that can be activated. If the data is available in principle, or if it is at least possible to process it, and if the in-car multimedia system or the car itself allow flexible adjustments to be made, it is certainly possible to implement such use cases, at least from a technical point of view.

With regard to consent, the situation becomes more complex: If I want to activate data collected in connection with the use of Connected Driving in the respective car, it must also be possible to assign this data clearly and at any time to this car – or in some of the examples described: to the car AND to a person in the car. Appropriate, unambiguous and voluntary consent must be obtained and users must be able to revoke it at any time. This raises the question of whether consent must be obtained before every drive, since it is entirely possible that several people will use the same car. When the car is started, however, it does not yet know which person is behind the wheel. In addition, different people may have different preferences when it comes to consent for data collection and processing. When consent is revoked, it must be ensured that this revocation applies to all systems involved in the data architecture. A requested deletion must also be guaranteed for all systems.

 

Data sharing

Another category of possible use cases arises from data partnerships with third-party companies. Here, great added value can arise for all parties involved, but the advantage for one party can also become a disadvantage for another. This is relevant for consent, as a driver would naturally be cautious about giving consent for a data processing purpose that could also be detrimental to him or her.

An example of such a partnership is the sharing of collected vehicle and driving behavior data with insurance companies. In the form of a “pay-as-you-drive” model, insurance policies could be individualized and customized for each person. Data from the vehicle would allow insurance companies to better assess the underlying risk individually for each person. The insurance amount would thus not be calculated based on the entirety of all insured persons or general parameters, but individually for each person. However, this also shows the difficulty of such a model: If you are a careful and/or infrequent driver, such a model would be advantageous; for careless and/or frequent drivers, however, it would most likely be disadvantageous. If we now assume that consent is needed for this purpose of data transfer, the former group would increasingly agree, the latter would increasingly decline. To what extent an insurance company would benefit from a database of almost only cautious drivers is, of course, difficult to assess and foresee.

However, if the collection and sharing of the necessary data were to have an effect not only on the insurance amount, but also on the various components of an insurance policy, this could be of interest to every car owner. If, for example, different components of a policy can be added or removed depending on driving and usage behavior, each person could insure his or her own individual risks in the best possible way and tailored to his or her needs.

Another example, which is already largely a reality, is the sharing of vehicle data with car dealerships and repair shops. By processing and sharing data from the vehicle, repair shops can, for example, suggest service appointments directly in the display of the respective car or draw attention to offers. The more data from the car is collected, processed and made available, and the better the data architecture required for this is designed, the more advanced the use cases can be. In this way, predictive maintenance can help to detect wear and tear or minor defects at an early stage and proactively counteract possible damage. This saves the car owner money, while the car manufacturer increases the chance of long-term customer loyalty thanks to an improved customer experience.

Looking at these data sharing examples from a consent management perspective, they are not very different from those of in-car data activation. If personal data is collected and processed – which is the case with these use cases – a GDPR-compliant consent is required. Providing detailed information about the purpose of the data processing is crucial here. Especially if the processing involves third parties – such as insurance companies.

 

Consent rates and transparent communication at the point of consent

It can be assumed that customers will be cautious about sharing their data with other parties and will initially be hesitant to have their own driving style evaluated and assessed. In these cases, therefore, automakers are particularly called upon to build trust – both in advance and at the point of consent – in order to obtain a reliable and truly value-adding data basis. Transparent communication and the highlighting of an expected benefit for the respective person should therefore be a core element of consent management. But here, too, the question arises as to how the obtaining of consent, the processing of the data, and the ultimate use of the data can be optimally designed in the specific case – especially in scenarios in which several people have access to the same car, but do not want to be confronted with a consent banner or call for consent before every trip. A consent status that may change on a daily basis also prevents cohesive data and insights, which calls into question the fundamental added value of the data as it becomes more irregular and severely limits the number of meaningful use cases.

 

Data power and responsibility: who actually owns the data from the car?

Who exactly owns the data from the car is still legally unclear: Does it belong to the car manufacturer who collects it or to the owners of the vehicles? The tech companies that make the connected car possible in the first place? The public, since the data would enable fair(er) competition? Consumer advocates, automotive suppliers and insurers fear that the planned EU law that was supposed to answer this question will now be delayed again.

So far, the normative power of the factual has prevailed: The problem is that the data is currently held by the vehicle manufacturers, giving them a major competitive advantage over third parties, suppliers and startups. Not to mention the data sovereignty of individuals. A final decision that could break this data monopoly of the manufacturers is no longer expected during this EU legislative period, although a draft law should have been available as early as 2021. The delay will now create facts in favor of the manufacturers, who will be allowed to keep their data monopoly for the time being. The industry is pleased.

However, access to this mobility and vehicle data would be quite crucial for new business models. “According to industry sources, 40 to 50 data points are needed from a vehicle in order to implement new insurance concepts such as “pay-as-you-drive” or remote diagnostics or maintenance. Suppliers also have a strong interest in third parties such as independent repair shops having access to vehicle data. An independent repair market is a prerequisite for them to reduce their dependence on the major automakers.” (Kugoth 2023)

One possible scenario would be for the EU Commission to forego regulations for this specific sector and instead refer to the Data Act, which is intended to make data more usable for third parties. However, the automotive industry would not agree with this at all, as the Data Act – analogous to the EU’s most recent digital laws, such as the Digital Services Act – focuses on users, who are supposed to retain sovereignty over their data – even though it would presumably be difficult for most car drivers to penetrate what their driving and vehicle data could ultimately be used for. Whether the German government will include the issue of data access to vehicle data in the planned Mobility Data Act remains unclear, but is currently being examined.

 

Kugoth, J. (January 30, 2023), Brüssel bremst bei Fahrzeugdaten, Mobilitätsdienstleister empört. https://background.tagesspiegel.de/mobilitaet-transport/bruessel-bremst-bei-fahrzeugdaten-mobilitaetsdienstleister-empoert. March 1, 2023.

Thanks to David Berger and Gabriela Strack (Bay-Q) for input and legal advice.