Appeals court rules carmakers can store data permanently and share it
Mark Jones and Michael McKee filed a lawsuit in U.S. District Court in Washington state in September 2021 against Ford Motor Company. The case alleged that since at least 2014, Ford’s infotainment systems had been permanently storing data such as call logs and SMS messages found on any phone plugged into the vehicle via USB, and keeping those messages on internal vehicle memory. The suit noted that a third-party company called Berla develops software and hardware known as the iVE Ecosystem is able to access those messages, and Berla can “pass the acquired communication to law enforcement, civil agencies, military, regulatory agencies, and selected private organizations.” The plaintiffs alleged these actions violate the Washington Privacy Act, as the WPA forbids “any individual, partnership, corporation, association, or the State of Washington, its agencies and political subdivisions” from capturing or storing private phone communications without the consent of everyone involved in those communications.
The part about permanent storage refers to claims by Berla. Automakers provide information on how to delete information stored in infotainment systems, and the Internet is full of tips on performing factory resets. Yet, the filing alleged Berla said that if “a driver uses the infotainment interface to ‘delete’ their device, that device information often remains in unallocated space and can be recovered.”
Besides that, automakers can pull information at any time, so deletion or a reset would offer limited effectiveness at best; and the car would simply vacuum up everything on the phone again after the restart. It is clear automakers want the info. A Honda instruction manual about in-car software of the HR-V states, in part, “Your use of the installed software will serve as your consent to the terms and conditions of the End User License Agreement. You may opt out within 30 days of your initial use of the Software by sending a signed, written notice to HONDA.” If you can and do opt-out, it’s possible you don’t get your infotainment.
Not long after, more plaintiffs filed suit against four other carmakers in Washington in related class-action suits that argued the same basic premise — carmakers violating the state act by storing personal data that vehicle owners either couldn’t delete or didn’t have access to. The four other carmakers: Honda, General Motors, Toyota, and Volkswagen.
Ford argued, in part, that “Washington courts have repeatedly held that those who send electronic communications, such as emails and text messages, understand these messages will be preserved in multiple forms and thus impliedly consent to the recording of such messages.” The automaker’s written policy on deleting data only specifies California residents as having the right to delete data.
A U.S. District Court dismissed the Ford case in May 2022, the other cases shortly after. All plaintiffs appealed to a three-judge panel on the 9th Circuit Court of Appeals. The panel dismissed the Ford case on appeal in late October. This month, The Record reported the panel dismissed the cases against Honda and the other automakers. All rulings followed the same reasoning: The Washington Privacy Act requires “an injury to ‘his or her business, his or her person, or his or her reputation.'”
The appeals court decision noted that downloading and storing messages without consent could be considered “a bare violation of the WPA.” However, because none of the plaintiffs could demonstrate injury resulting from the stored data — that their messages or call logs had been sent to another party that could or would do them damage — the automakers hadn’t violated the act. Basically, it’s not a crime to have the information, it’s a crime to use it. Feels like the clock has already started for someone in Washington to file a lawsuit with cause.
