Are you someone who never drives anywhere without their little black box? That four inch square black box that is a standard feature in many new cars is an event data recorder (EDR). These are just like the ones they have in airplanes that they open up for forensic purposes to determine the mechanical cause of a crash.

In a personal vehicle, the black box records such data as the vehicle speed, seat belt use, brake status, airbag deployment and whether the headlights and cruise control were on as well as up to a dozen more types of safety information. It constantly records data and replaces it with new, like a tape looping and replacing old information with new. When an accident occurs, the EDR retains the previous 5 to 20 seconds of information for possible recovery to provide a data snapshot of what happened in the moments before impact. The event data recorder does not however record voices, pinpoint a vehicle’s location, or identify who is driving. Automakers are required to tell new car buyers if an EDR is installed beginning with the 2011 model year. Currently, there are hundreds of vehicles with a black box and if you want to find out if yours has one, here is a link to a list (PDF format).

There have been statutes on the books since 2003 regarding the use of the collected EDR information. In most states, the current vehicle owner, or their legal representative, can give or withhold permission to download EDR data. Courts can subpoena EDR data through court orders and some states collect data under their existing laws governing crash investigations. Some insurance policies may have contract terms with the insured related to data collection from EDRs. This may be contained in an "Agreement to Cooperate" clause in an insurance policy. Some states have statutes that contradict these contract provisions.

For right now, the EDR just records the safety facts of your vehicle. The privacy danger is in that technological slippery slope in the name of protecting their liability, insurance and rental car companies may push for gathering personally identifiable information as well and keeping it for longer than those 20 seconds. That opens up the possibility of creating a driver profile that could be used by insurance companies to determine rates. The Privacy Gurus® will be following this story to let you know if we need to take action to deter that from happening.

Be sure to contact your Privacy Gurus® with any questions about this topic and any other privacy and information security topic.

Darity Wesley is CEO and Legal Counsel for Privacy Solutions, Inc. a San Diego based consulting firm. Her team of Privacy Gurus® work with you to create policies and procedures to establish the expectation of privacy for your members, clients, customers, prospects, affiliates, associates, employees and vendors. You can reach her at (619)670-9462 or Darity@privacygurus.com