OnStar’s Plan to Keep Tabs on Ex-Customers Riles Lawmakers

OnStar recently raised hackles in the privacy community with revisions to its privacy policy. Now, members of Congress have taken up the issue.

Sen. Charles Schumer, D-N.Y., has asked the Federal Trade Commission to investigate the new policy on the grounds that it may be an unfair or deceptive trade practice.

The company’s new terms are “one of the most brazen invasions of privacy in recent memory,” he charged.

“I am concerned that OnStar may be abusing the consumer data — including sensitive information like vehicle location and speed — to which it has access,” Schumer wrote to the FTC. “These changes put consumers at risk for having sensitive personal data collected and shared without their knowledge.”

Schumer’s office did not immediately respond to the E-Commerce Times’ request for further comment.

“We are always very specific about with whom we share customers’ personal information, and how they will use it,” said OnStar in a statement provided to the E-Commerce Times by spokesperson Adam Denison. “We have never sold any personally identifiable information to any third party.”

Customer for Life

Two changes to the policy are particularly troublesome.

One is that when a customer cancels the OnStar service, the two-way communications system may continue to track the automobile via the still-active link. OnStar has clarified the policy, explaining that customers have to specifically ask that the two-way connection be shut down when the service is canceled.

The second point is that OnStar is now reserving the right to share any data it collects — including data from subscribers who canceled the service but didn’t take the extra step to shut down the two-way connection.

That data — which OnStar says will be collected only on an anonymous basis — is very revealing about a driver’s habits. It includes speed and location, odometer readings, seat belt use and air bag deployment.

OnStar has said one use of the data would be to study traffic flows.

However, there could be other possibilities that aren’t quite so neutral. The data could also be marketed to third parties — insurance companies, for example.

Extraordinary Breach

All in all, privacy advocates are appalled.

“It is really astounding the rights it is claiming for itself,” Beth Givens, director of policy and advocacy for the Privacy Rights Clearinghouse, told the E-Commerce Times.

“GM has corrupted the customer relationship by continuing the connection,” she said. “What is it about ‘No’ that they fail to understand?”

The possibility of a congressional inquiry is good news, added Givens. “Usually when a company gets the attention of Congress, that company takes a second look at its practices. Sometimes it is enough to get a company to stop.”

The promise of anonymity is a weak one, she noted, explaining that “considerable research has shown that this data can easily be re-identified.”

OnStar’s contention that is has properly disclosed what it is doing is also suspect, Green Armor Solutions CEO Joseph Steinberg told the E-Commerce Times.

“The reality is people don’t bother reading the fine print in a privacy policy and so don’t realize the consequences,” he pointed out. “Even for people that just skim it, they might not realize that if they turned off the service they still could be tracked.”

OnStar has an obligation to at least spell out very clearly what it is doing and how people can opt out, Steinberg said, if it insists on maintaining the opt-out policy.

“I think when people realize they are having their data collected even after unsubscribing they would handle the unsubscribe process much more carefully,” he said.

Legal Issues

Certainly, when people realize the legal liabilities that this data poses, they will be dismayed. There have been cases of people sued in civil court and prosecuted by so-called black box data in cars that can track this technology, Butzel Long shareholder Claudia Rast told the E-Commerce Times.

“It will be interesting to see how this plays out as the data become less expensive, more ubiquitous and more precise,” she said.

Prosecutors as well as defendants and plaintiffs in civil suits will routinely require this data if it is relevant to their cases, Rast predicted. “I believe it will become a huge component in e-discovery faster than many right now realize.”