CONCORD — The nonprofit Consumer Watchdog agency is questioning the removal of key privacy protections in a bill that would allow testing of a driverless shuttle in Contra Costa County.
Consumer Watchdog advocate John Simpson said the agency is most concerned that the lack of stringent privacy protections would set a bad precedent as more driverless vehicles hit the streets. Autonomous cars collect "all kinds of data" about drivers, he said, including where drivers travel and how long they stop. According to a 2015 report published by U.S. Senator Ed Markey, D-Mass., automobile manufacturers collect "large amounts of data on driving history and vehicle performance" and that information is often stored in third-party data centers.
AB 1592 authored by Assemblywoman Susan Bonilla, D-Concord, would allow the Contra Costa Transportation Authority to test an autonomous shuttle at Bishop Ranch, a private office park in San Ramon, and at GoMentum Station, the former Concord Naval Weapons Station that has been repurposed as a testing site for driverless cars.
Consumer Watchdog had proposed language in the bill that would have restricted data collection and storage from autonomous vehicles to only what is "necessary for the operation of the vehicle" or research related to vehicle operations but not "marketing or other commercial purposes." The language was initially included but has since been replaced with a provision mandating only that autonomous vehicle operators inform shuttle passengers what personal information, if any, would be collected.
"This was an opportunity to set a privacy protection standard that could have set a precedent as this technology, if it proved to be safe, is more widely deployed," Simpson said.
But Bonilla said her bill was meant to be a narrow exception to existing law, rather than the rule. Existing law permits self-driving vehicles on public roads only if a driver is seated behind the wheel and is capable of taking control. But the proposed bill would be the first to allow the shuttles to be operated at specific locations without a driver, steering wheel, brake pedal or accelerator.
It's unclear just what kind of personal information would be collected on riders of the driverless shuttle. CCTA Spokeswoman Linsey Willis said the authority plans to present a detailed testing plan to the DMV, if and when the bill is approved. But pushback on the privacy protections from companies developing autonomous vehicle technologies prompted the provision's removal, Bonilla said.
And, while Bonilla said she supports a robust discussion on the merits of privacy and data collection in autonomous cars, time is of the essence. The CCTA and representatives from Bishop Ranch are ready to begin testing, she said, and waiting could give companies that make autonomous vehicles the impression that California isn't ready to support the burgeoning industry.
"We don't want California to get left behind," Bonilla said, adding that the state of Michigan recently approved $17 million for an autonomous vehicle testing site that's more than 300 acres in size. "My pilot bill wasn't the vehicle for that discussion."
John Doherty, the vice president and senior counsel for TechNet, which represents technology companies, called the privacy provisions that had been in the bill "hugely problematic."
"You can't even do product improvements in terms of if you're trying to track and talk to consumers about what their experience was like," he said, adding that consumers can opt out if they choose.
But privacy advocates warn that allowing an exception, even in a narrowly defined pilot program, is the wrong approach. Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, a nonprofit that advocates for privacy, free speech and innovation in the digital world, used the example of California's road charge pilot program, which is designed to test the efficacy of replacing the gas tax with a new revenue source.
Tien sits on the road charge advisory committee and said advocates had insisted on designing the pilot so that privacy concerns would be met from the outset, he said.
"Without it being specifically in the statute with the design of the road charge pilot, there was no reason to believe the people who designed (the pilot) would think about privacy at all," Tien said. "We all know that if you don't think about privacy when you design something, it is much harder to bring it in later."
Bonilla insists that debate will happen at the federal and state levels, when more companies and consumers impacted by the new regulations have time to weigh in.
In July last year, Markey and Sen. Richard Blumenthal, D-Conn., introduced the Security and Privacy in Your Car, or "SPY Car," Act of 2015. The bill directs the National Highway Traffic Safety Administration and the Federal Trade Commission to enact rules for autonomous vehicles that protect against data breaches, require the disclosure of data collection and storage, allow drivers to opt-out of data collection without losing valuable navigation features and prohibits data to be used for marketing purposes. As of Monday, that bill remained in committee.
Contact staff writer Erin Baldassari at 510-208-6428. Follow her at Twitter.com/e_baldi.
