GM's OnStar subsidiary has announced changes [PDF] to its privacy policy. Some are anodyne; others cause raised eyebrows or sheer incredulity.
OnStar offers a GPS-based onboard navigation, maintenance and emergency service. The service is subscription based. Interestingly, Onstar has been criticised for plans to collect (and disseminate) vehicle data even from customers who discontinue the monthly subscription.
The updated privacy policy ostensibly gives GM the right to collect and share information that includes the customer's name, address, telephone and email address, billing information (including credit card number), vehicle identification number and make, vehicle model and year, and diagnostic information such as odometer readings. GM may collect "other information that you voluntarily provide to us (such as your language preference, your license plate number and/or your emergency contact information)". It may also collect
• information about crashes involving your Vehicle, including the direction from which your Vehicle was hit, which air bags have deployed, and safety belt usage;Sharing? The revised policy goes beyond support for "law enforcement or other public safety officials", extending to "credit card processors and/or third parties we contract with who conduct joint marketing initiatives with OnStar". Those third parties apparently include roadside assistance companies, satellite radio providers and data management companies. Presumably some can integrate the information with data profiles that are subsequently provided to fourt parties, and away we go! Sharing includes "any third party, provided the information is anonymized", your Vehicle Maker, our affiliates, Vehicle dealers, third parties with whom we contract with to conduct joint marketing initiatives with OnStar, your fleet company and your rental company if you drive a rental Vehicle.
• information about your use of the Vehicle and its features, such as whether you have paired a mobile device with your Vehicle;
• information about when your Vehicle’s ignition is turned on or off and when your fuel is refilled
GM/OnStar regards the information as assets and may sell that information as part of the sale of some/all of the OnStar business.
Some information will not be shared -
If you use Hands-Free Calling minutes, we may obtain certain Customer Proprietary Network Information (CPNI) such as call detail records, the number of minutes purchased, the date minutes were purchased, the number of remaining minutes, and their expiration date.OnStar reserves the right to sell anonymised location data to third parties "for any purpose". The fuzziness of the anonymisation is unclear, with critics quickly commenting that if a vehicle is consistently parked at a particular location at night it may be easy to infer an identity by matching the GPS information to the driveway or residential carpark and thence to other data, particularly in regimes where state vehicle registration agencies kindly sell registration data.
Egregiously, OnStar is reported to be planning to collect and share data from OnStar-equipped vehicles even if the vehicle's owner doesn't sign up for, or cancels, the monthly service. That makes a mockery of the notion of consent highlighted recently by the Article 29 Working Party in Europe. OnStar customers must specifically ask to opt out of the tracking service.
Unless the Data Connection to your Vehicle is deactivated, data about your Vehicle will continue to be collected even if you do not have a Plan. It is important that you convey this to other drivers, occupants, or subsequent owners of your Vehicle. You may deactivate the Data Connection to your Vehicle at any time by contacting an OnStar Advisor.OnStar indicates that -
OnStar and its Service Providers may process and store information about you or your Vehicle in the United States, Canada, or other jurisdictions from which the Services or Data Connection will be provided and where the privacy laws may differ from those in the United States. Information may be available to government or its law agencies in the country where the data is processed or stored under a lawful requirement in that country.Do not fear, however, as
Nothing is more important than the safety and security of you and your family. At OnStar, we apply that belief to every aspect of our business, including the protection of your personal information. You have a right to be confident your information is kept secure and to understand our privacy practices, specifically, what information we gather, with whom we share that information, how we use that information to make your driving experience safer and more convenient, and what we do to protect your information. We are committed to making your safety and the security of your information a priority.That no doubt heartfelt commitment is highlighted by one explicit addition -
Supplemental Information for California Residents:We might ask why OnStar in aspiring to best practice doesn't systematically provide non-Californians with such data.
Your California Privacy Rights: California privacy law requires us to provide California residents with specific disclosures about our privacy practices, including telling you about the information we share with other third parties for their marketing purposes. You may request a copy of this information on an annual basis by contacting us.
Bad privacy policy and worse marketing at GM.
