Unforeseen Privacy Risks: Cars, Data, and CISO Challenges

The Evolving Definition of Privacy

• 💡 Privacy is not just about security measures like encryption but also about understanding evolving data collection practices.
• ⚖️ Legally, privacy can be defined as an "intrusion upon seclusion," but a broader understanding involves how individuals want to be perceived and control their information.
• 🌍 The Universal Declaration of Human Rights, Article 12, addresses privacy as protection against arbitrary interference.

Data Collection and the "Information Company"

• 🚗 Automotive companies, like Ford, are increasingly becoming "information companies" by collecting vast amounts of data from connected vehicles.
• 📈 Data is a means to an end, leading to information and then intelligence, which businesses use to anticipate consumer needs and guide strategic decisions.
• 🛒 Everyday examples like grocery store loyalty programs and Google's ad targeting illustrate how passive data collection builds comprehensive user profiles.

Privacy Risks in Rental Vehicles

• 📱 Connecting personal phones to rental car systems can lead to contact lists and call logs being stored on the vehicle.
• ⏳ Data stored in rental cars often persists even after the car is turned off, posing a risk if not properly sanitized.
• 📄 Privacy notices for cars are often lengthy (over six hours to read), making informed consent difficult for consumers.

Data Types and Corporate Concerns

• 📍 Precise geolocation is a sensitive data type, with rights to control it varying by state.
• 📞 Other collected data can include names, emails, social media handles, biometrics, preferences, and communication logs.
• 🏢 For corporations, fleet cars and rental vehicles represent a significant, often overlooked, data leakage risk outside of direct IT control.

The Role of CISOs and Corporate Responsibility

• 🔒 CISOs must work with procurement and GRC teams to define data handling policies for fleet and rental vehicles.
• 📄 Key demands for rental/fleet companies include simplified data disclosures and media sanitization processes with certificates of deletion.
• 🚗 Cars are now computers that store data, often unencrypted, making them vulnerable endpoints that fall under a security team's purview.

Real-World Data Breach Example

• 🎖️ Researchers were able to re-identify a military contractor using data left in an unsanitized company car, revealing personal details, movements to military sites, and family information.
• ⚠️ This highlights the severe risks of data persistence in vehicles and the potential for malicious actors to exploit this information.