An item from the Wall Street Journal Digits blog on September 21 on General Motors’ (News - Alert) OnStar communications service ramping up to collect and share with third parties data from any vehicle with OnStar equipment even if the owner isn’t an OnStar subscriber is raising eyebrows. Details of what OnStar intends, including an explanation of why and how which accompanies the terms and conditions, are in a new privacy statement from OnStar scheduled to become effective December 2011. Yikes!

Why do this?

The blog quotes Vijay Iyer, a public relations official with OnStar , as saying, “We’re looking at future services that we might introduce…We want to make sure we get our vehicles and hardware ready now and be as transparent with our customers as possible before that.”

As justification for the expansion of data collection and sharing, the blog points out that OnStar is currently considering providing granular data to highway authorities to enable them to better handle traffic congestion. Iyer says of this initiative that the data provided are, “on an anonymized basis. We wouldn’t include any type of personal information – just bulk information.” In fact, the new privacy statement has language on “how OnStar safeguards your personal information.”

Iyer went on to say that part of the reason for the change is that GM wants to keep a live connection to OnStar to facilitate service reactivation should a subscriber cancel the OnStar service, and that, at the time of cancellation, the subscriber will be asked if they wish to keep the connection alive. And he added that GM’s sensitivity to consumer concerns about the collection and sharing of data is the reason why they are proactively alerting customers of pending changes.

The devil is in the details

On its face, the changes seem innocuous enough. What is the big deal about the transmittal of information on an anonymous basis to help ease traffic congestion and increase OnStar’s responsiveness to its customers and members of its ecosystem?  However, there is a big however. And, as so often the case, the devil is in the details. Customers are well advised to read the fine print. Below are some examples from the statement of where the road ahead could be problematic:

• Unless the Data Connection to your Vehicle is deactivated, data about your Vehicle will continue to be collected even if you do not have a Plan. It is important that you convey this to other drivers, occupants, or subsequent owners of your Vehicle.
•  What Information does OnStar collect?

o   Contact information, (including name, address, telephone number and email address)

o   Billing information (including your credit card number)

o   Information about the purchase or lease of your Vehicle

o   Other information that you voluntarily provide (such as language preference, license plate number and/or emergency contact information)

o   Information about a vehicle’s operation, including such things as diagnostic trouble codes, oil life remaining, tire pressure, fuel economy and odometer readings

o   Information about crashes, including the direction from which a vehicle was hit, which air bags deployed, and safety belt usage

o   Information about vehicle features, such as whether there is a paired a mobile device

o   Information about when a vehicle’s ignition is turned on or off and when fuel is refilled

o   In limited circumstances the location and the approximate speed of a vehicle based on the Global Positioning System (“GPS”)

OnStar says the last information on location and speed is shared only on an “anonymized basis,” a term used repeatedly in describing how they use the information collected. And, while there is extensive language about how they safeguard all of this information, the list of entities they share it with is extensive including: any third party, provided the information is anonymized.

Call me paranoid

While I appreciate all of the “safeguards” OnStar is purportedly going to implement to protect my personal data, there is something disconcerting about the mere collection of my personal data except for service authorization and identification purposes — something that could be done by speaker dependent voice recognition, or in the event of my incapacitation, other means. In addition, supplying highway authorities with location and speed information seems like the camel’s nose under the tent for elimination of radar in favor of GPS for the issuance of tickets for traffic violations, especially if tied into the extensive video surveillance systems now being deployed.

Yet all of these concerns beg an even more fundamental question about personal safety, which OnStar professes to be their top priority and the reason to subscribe to the service in the first place. Is OnStar going to be liable if people with malicious intent crack the code of anonymity and perpetrate a crime?

For instance, finding out I am on the road and a good distance from home is an open invitation to someone to rob it without risk, especially given they will also be able to match my travels with my address. Will OnStar be liable if car thieves seeking a specific make and model use the location capabilities to find my automobile and liberate it from my possession? “Oops, we are very sorry for the inconvenience,” hardly seems like the response most people are going to want to hear.

The reality also is that with the increased interconnection of smarts in the car to things like social networks, email, contact lists etc., not to mention where we are going with smart highways and cars that can drive on automatic pilot, having a live connection to my car, especially if I do not have a subscription and have not opted out of the service, creates a target rich environment for all kinds of other unlawful activities.  

Please to not misunderstand. I am not a new business curmudgeon. I appreciate that GM would like to establish and enhance a platform in my car that gives them an opportunity to increase revenues from OnStar either through value-added capabilities offered customers or through the sale of information to third-parties. Nevertheless, this move seems to be moving OnStar down a very slippery slope. Maybe there is an opportunity for tiered services here. This would involve the offering of a basic/lifeline service for communications when there is an accident, or other roadside problem, and an enhanced one where I had to opt-in for everything else. I for one will take the road less traveled electronically.