The Government Accountability Office (“GAO”) has released a report to the House of Representatives Committee on Science, Space, and Technology, Subcommittee on Research and Technology, entitled “Vehicle Data Privacy: Industry and Federal Efforts Under Way, but NHTSA Needs to Define Its Role” (“the Report”). The Report, dated July 2017 and released on August 28, 2017, highlights progress made by the automotive industry and sets forth instructions for the National Highway Traffic Safety Administration (“NHTSA”) regarding connected vehicles.

The Report set out to assess privacy developments pertaining to “connected vehicles”—those with “technology that wirelessly transmits and receives data. ” Of the 16 automakers GAO reviewed, 13 offer connected vehicles, and all of those 13 “reported collecting, using, and sharing data from connected vehicles, such as data on a car’s location and its operations,” “on a relatively limited basis. ” None of these companies “reported sharing or selling data that could be linked to a consumer for unaffiliated third parties’ use.” 

Furthermore, the Report found that “[a]utomakers have taken steps, including signing onto a set of privacy principles, to address privacy issues. ” The GAO looked at developments in transparency, focused data use, data security, data access and accuracy, individual control, and accountability, and found that “most automakers’ reported privacy policies . . . substantially reflected” leading practices in the field.

The GAO also looked at the roles of the Federal Trade Commission (“FTC”) and NHTSA. NHTSA “has broad authority over the safety of passenger vehicles and considers the privacy effects and implications of its regulations and guidance.” The GAO determined that “FTC and NHTSA have coordinated on privacy issues related to connected vehicles,” but that “NHTSA has not clearly defined its roles and responsibilities as they relate to the privacy of vehicle data.” 

GAO’s key recommendation is that “NHTSA define, document, and externally communicate its roles and responsibilities related to the privacy of data generated by and collected from vehicles.” NHTSA has agreed with this recommendation.