Is your car spying on you?

With a court order, police and federal officials can use global positioning system (GPS) information. After an accident, event data information routinely finds its way into the hands of police, insurance companies and automakers. And there have even been a few cases where information from these devices fell into the hands of criminals and scam artists.

Your car's 'black box'
The event data recorder springs into action only when there is an accident or near miss. A chip stores readings from the car's electronic sensors in the seconds leading up to and during the accident. The information can include: the speed of the car; engine revolutions per minute; whether the driver stepped on the brakes, throttle or accelerator; whether driver and passengers were wearing seat belts; the strength of the impact and if, when and at what level the air bags deployed.

"The data we've retrieved from EDRs has been invaluable," says Jim Schell, manager of product safety communications for General Motors, who says that manufacturers need real-life crash data to build safer cars.

While many auto companies have been using EDRs in one form or another since air bags started going into cars in the 1970s, many drivers don't realize their vehicles have them.

And that's part of the problem, says Phil Haseltine, president of the Automotive Coalition for Traffic Safety, an industry-sponsored group. If the owner knows it's there, "the privacy issue goes away," he says. "It's when the owners don't realize that you have these devices in the vehicles, that's when you have problems."

In the last few years, wider use of EDRs, new developments enabling auto manufacturers to capture more crash information and partnerships with software makers that allow the data to be retrieved with a laptop are putting the issue front and center with privacy advocates.

One company is asking the government to standardize EDR information and wants to build a database to collect and sell the data.

That raises the question: Once there is data, who owns it?

California settled the issue recently with new legislation that will take effect in July 2004. Under the new laws, carmakers must tell a buyer if there is an EDR device in the car, says Kevin O'Neill, legislative director for California Assemblyman Tim Leslie. Any data collected by the device will belong to the car's owner. And if a third party like an insurance company or police department wants to see it, they will need the owner's permission or a court order.

Elsewhere, the law on ownership of EDR information is less clear. "I think it would make sense to enact similar laws in the other 49 states," says Haseltine. "I believe that the ownership of the data does indeed reside with the person who owns or rents the vehicle."

The problem is, the owners don't have the ability to retrieve or read it. That requires a specialized piece of software available mainly to manufacturers and their authorized mechanics, insurance companies and law enforcement.

Another possible conflict: If your vehicle is totaled and the insurance company takes the title, then it would also have control of the information, says Haseltine.

"The key reason why states need to enact legislation is to lay out everybody's responsibility," he says. "Motorists need assurances that if insurance companies are going to access data, motorists know that upfront, and it can't be buried on page 12 of the policy."

There is also the possibility of error. Haseltine says that he's aware of one instance where crash data in the EDR was wrong.

"Like anything else built by human beings, once in a while there could be a problem. [But] by and large," he says, "they are vastly more accurate than the old-fashioned way."

Private eyes?
In some cases, you might actually want an extra pair of eyes watching the people who drive your car, especially if you have a teen in the house or employees who drive company vehicles.

If that's the case, the data are yours for the price of a piece of software. Depending on the specific program, the device can track everything from how long the driver is out and how many miles he drives (some systems will show exact locations, as well), to how fast he goes and for how long, how hard he brakes and even whether he's buckled the seat belt.

Available only for 1996 and later model years, the after-market product plugs into an existing slot under the dashboard. Depending on the automaker and the mechanism, it may or may not be visible to the driver.

Then, every so often, you unplug it and download the information into your PC, almost like a PDA. With one version, The Car Chip, parents can select certain behaviors such as going over a particular speed or braking a certain way, and those misdeeds will be highlighted in the report, says Frank Velasquez, sales manager for Davis Instruments Inc.

A similar product will make a loud noise when the driver attempts the prohibited move.

With minors, the privacy issue is fairly simple: Your car, your rules. The only possible concern: that you know your teen is a dangerous driver -- as evidenced by the recorded information -- and let the little darling drive anyway. If there's an accident, and someone finds out about the device, another party could get access to the information.

But parents need to weigh that risk against the value of a tool that could help make their teens better drivers -- and keep them out of accidents in the first place.

However, using the software to track adult driving habits poses a different set of concerns. In many cases, employers are using the devices to track employee driving, especially where road rules are a big part of the job, as with cabbies and truck drivers.

For fleet users, Velasquez recommends telling the drivers they're being watched. "In reality, as a fleet owner ... I don't have to tell my employees that the devices are installed," he says. "But it's a good idea to do it anyway. It prevents bad feelings, and they know they are being monitored."

GPS systems
While EDRs record and store a one-time event, GPS systems operate in real time to pinpoint the location of a car with satellites. Theoretically, GPS technology could be used to track a vehicle and even monitor how fast it's going. Collected over a long period of time, the information could give a pretty accurate portrait of your day-to-day activities and driving habits.

GPS technology can be used in many places in the car, including navigation systems, anti-theft locators and so-called "starter interrupters," which lock up the ignition when a payment is late.

But just because GPS technology is capable of tracking drivers doesn't mean companies are doing that, says Geri Lama, a representative for OnStar, one of the most popular vehicle communication and navigation providers.

In the case of OnStar, no one monitors an individual vehicle unless someone in the car calls for help, says Lama. The company also is notified automatically when the airbags deploy, and will contact the driver to offer assistance.

If the car is stolen, OnStar only cooperates with the police or an owner who has filed a police report, and then, only if the subscription, which runs $17 to $35 per month, is current.

"Privacy's really important to us," says Lama, who says the company doesn't want to be in the business of spying on spouses or tracking errant teens. And the company's equipment cannot track a driver's speed, she says.

But not every GPS monitoring service plays by the same rules.

In 2000, James Turner stopped to put gas in his rental car, only to have his check card refused, says his attorney, Bernadette Keyes. The rental car company had used a GPS service to determine he sped on three different occasions and assessed three separate $150 fines. Because he'd rented with a check card, the company deducted the money from his bank account. The case is going to court next year, and Turner is still out $450, says Keyes

"Certainly it's an invasion of privacy," says Keyes, a partner with Keyes, Looney & Murphy LLC. "I don't think most people realize to what extent, and what degree of accuracy, they can be tracked with these devices."

While the rental company stated that the car had a GPS device, Keyes says that Turner had no idea it would be used as a monitoring device. "They need to have a fuller disclosure of the capabilities of the technology," she says.

Keith Whann, general counsel for the National Independent Automobile Dealers Association, agrees. He recalls a demonstration of GPS-based technology where someone had used a PC to "punch in and [find] exactly where the car [was]."

Dealers need to inform buyers what technology is present in a car - and smart buyers should make a practice of asking questions, says Whann. "Know what you're buying," he says. "What is this technology that's there?"

Another problem: Auto dealers might not know all of the things the technology can do, Whann says. "That's what concerns me," he says.

Adding to the confusion: When it comes to consumer privacy, "there are different laws and regulations, some of which overlap," says Whann.

Some advocates also want to know: Just who is watching the watchers?

How carefully do GPS monitoring services, or companies that purchase the information, screen their employees, asks Keyes, who discovered an instance in which GPS information was available to someone with a larceny conviction. What's to stop someone who knows you're out of town from robbing your house, she asks?

"The degree to which people can use this technology is just really amazing," Keyes says. "Most people just don't have any idea."

Dana Dratch is a freelance writer based in Atlanta.