Data-Driven: Consumer Disclosure Report exposes not just home addresses, but driving habits

Ann Arbor, MI (InvestigateTV) — With dedicated careers in the nonprofit sector, Ryan Bates and his wife never expected the first car they purchased to be a high-tech, electric vehicle.

“We really like the car. We like being able to charge it up here at home,” Bates said.

What they didn’t know, however, was their brand-new 2023 Chevy Bolt EUV, with its innovative features, would also be gathering a wealth of information about their driving habits.

After seeing several news reports alleging Chevy was monitoring customers who purchased its cars, Bates decided to reach out to a data broker, LexisNexis, to request his consumer disclosure report.

That’s when Bates learned his car salesman had signed him up for a free OnStar subscription from Chevy’s parent company, General Motors, meant to help with in-vehicle safety, security, and navigation.

But Bates wasn’t aware that the subscription’s of use/agreement/fine print meant his vehicle would also be collecting his day-to-day driving activity – something he likened to “spying,”

“I was able to call LexisNexis, put in a request for my file, and what came back was 200 pages,” Bates said. “[It shows] every time I’d brake a little bit, every time I accelerated a little fast.”

The data had been collected by the OnStar program then sold to LexisNexis.

The report revealed records of his trips through telematics data, detailing acceleration events, hard braking, high-speed occurrences, distance traveled, and the vehicle’s VIN. However, it offered no context for these incidents or what might have triggered them.

“Was I braking hard because a kid ran into the street? Or was I braking hard because I’m a bad driver?” Bates questioned. “Was I speeding up to an accident on the highway, or was I speeding up because I’m irresponsible? This report doesn’t say any of that.”

Bates isn’t only concerned about where this information is stored, but also how an insurance company might use it.

“Have they given it to my insurance company? I don’t know. There’s no way to know,” Bates said.

‘Who Owns Who?’

Bates is not the only one signaling a problem. InvestigateTV discovered that several consumers have filed complaints with the Consumer Financial Protection Bureau regarding the leakage of personal information.

One consumer stated: “LexisNexis provided incorrect information to XXXX, and my car insurance is elevated because of this. I never consented to them having my information, nor do I currently consent to them having any information on me. They are legally obligated to provide the correct information when selling someone’s information, and I refuse to provide them any personal information. I demand that they correct this report so that my car insurance returns to the cost it should be, as they are legally obligated to do so without any action from me in the first place.”

Another consumer filed a similar complaint with the Ohio Attorney General’s Office.

“I requested a Consumer Disclosure Report, and the report came as a weblink and , but when attempting to and view it, I received an error message. This is non-compliance with my request. I requested this as a result of finding out that GM was potentially selling my driving data to this company [LexisNexis] without my express permission. This only makes it worse when the requested document errors out when trying to view it.”

In August, Texas Attorney General Ken Paxton filed a lawsuit against General Motors for unlawfully collecting drivers’ private data and selling it to several companies, including insurance companies, following the launch of his own investigation into the car manufacturer in June.

Several other class-action lawsuits have also been filed. A case in Michigan, where GM and OnStar are headquartered, states that the companies shared or sold data to third parties to “compile reports used by auto insurance companies to set rates and s, all without the consumers’ knowledge or consent.”

In another, a man in Florida claims his insurance s shot up after “erroneous” and “negative driving information” was illegally supplied to insurance carriers.

So far, General Motors and OnStar have denied all claims filed against them. GM also announced in April that it severed ties with LexisNexis.

“Who owns who, right? Do I own the car, or does the car own me? When the car’s selling this much information to a data broker, it’s like I’m the product,” Bates said.

A need for stronger consumer privacy law for car manufacturers

InvestigateTV first uncovered this issue after experts and lawmakers questioned how much data cars can collect about consumers. As technology advances, modern cars are becoming more like smartphones on wheels, equipped with sensors, cameras, and GPS systems that constantly gather massive amounts of data.

In 2017, only six percent of vehicles on the road were connected to the internet. Fast forward to 2023, and that number has surged to nearly 31%. According to a forecast by LexisNexis, by 2027, it’s projected that nearly half of cars in the U.S. will be connected.

Center for Auto Safety Executive Director Michael Brooks has witnessed the transformation of the automotive landscape firsthand. For decades his nonprofit organization has kept a close eye on the auto industry and government regulations to ensure consumer protection.

Brooks emphasized that the data collected by cars goes beyond what many consumers may realize. From key fobs to opening and closing doors and even activating windshield wipers, all these actions are being tracked, he warned.

“Some cars are collecting a thousand data points every millisecond, which means you’re collecting about a million data points per second over the course of your trip. That’s a ton of data being ed to the company,” Brooks said.

This extensive data collection raises concerns about how this information is used and who has access to it. When it comes to privacy in these matters, Brooks argued we need laws to protect consumers.

“Unfortunately, right now in America, there’s very little law around who controls that data. Consumers don’t have a lot of rights in law that say this is your data and you can control it,” Brooks said.

He does believe, however, that if the information isn’t identifiable, it could be helpful to keep the roads safe.

“The data that’s coming out of these cars, while it poses a consumer threat in some ways to privacy, when it’s not anonymized, if it’s anonymized, it can be used for great purposes,” Brooks said.

InvestigateTV reached out to several major insurance companies across the country. Only Geico, Progressive, and the USAA responded, stating that they collect driving data through consent-based programs to generate overall driving scores, which may affect consumers' insurance s.

Sen. Jeff Merkley (D-OR) has introduced the Car Privacy Rights Act of 2024, aimed at safeguarding consumers' car data and enhancing transparency in data collection practices. His legislation seeks to prevent car manufacturers and other entities from sharing or selling any data collected from consumers via their vehicles without explicit prior consent.

Merkley’s proposal includes provisions requiring car manufacturers to simplify the process for consumers to revoke their consent for data collection. Additionally, the bill mandates that all car manufacturers submit annual reports to the Federal Trade Commission (FTC) detailing their consumer data privacy practices, including information about who the data is shared with and sold to.

The Biden istration recently proposed restrictions on connected vehicles with parts coming from Russia and China. Those rules would restrict data brokers from selling data to other countries, but it does not prevent an American manufacturer from sharing and selling that information right now.

Meanwhile, Ryan Bates continues to advocate for more consumers to request their consumer disclosure reports to find out what their car manufacturers might have collected. He’s urging Congress not to hit the brakes on stronger consumer laws.

“The solution here isn’t to buy a different car; the solution is that we need laws to stop this. We need stronger consumer protections so that people who go out and buy a car don’t have to worry that it’s going to spy on them,” Bates said.

Copyright 2024 Gray Media Group, Inc. All rights reserved.