Big Data and Automotive — A Legal Approach

Old industry versus new industry: massive power struggles are expected within the automotive industry. Data sovereignty in the cockpit will bring substantial bene ﬁ ts in the future. With the assistance of cutting-edge IT, a variety of data will and already can be collected, processed and used in modern vehicles. Various parties pursue a keen interest in accessing a wide range of data sets in modern vehicles. For the legal classi ﬁ cation of data the issue of personal reference, according to the Federal Data Protection Act (BDSG), plays a decisive role. This data may only be collected and processed within narrow limits. Fundamental questions must be discussed: To whom are the data legally assigned to? Who has the rights of disposal? And to whom do they “ belong ” ? Autonomous driving is no longer just a dream of the future. Apart from the issues involving liability, ethical issues, in particular, need to be discussed. Concepts like “ Privacy by Design ” and “ Privacy by Default ” may be potential solutions. Data protection needs to be positioned on the same level as traf ﬁ c safety and environmental protection. In this respect, the German automotive industry can assume a leading role.


Occasion and Questions
The way we get from A to B and hence our mobility is constantly changing. Only few branches of business are more affected by big data then the automotive industry. It is remarkable that the current business models for manufacturing and selling of automobiles have not changed since the automobile came into existence. The ownership of a car itself cannot be viewed as being economically efficient, due to the fact that a car is often unused. Many emerging companies are taking advantage of this fact. The keyword being: Car Sharing. Additionally, Apple Inc., Google and Facebook have started focusing on the Connected Car as their new playing field. Jeff Williams, Apple Inc.'s chief operating officer, even named this car "the ultimate mobile device". 1 It is not without good reason that Google is currently intensely developing the Google Car; they will then, in turn, become the first IT company with their own car brand.
In the near future, due to innovative IT developments, even autonomous driving will be possible. Who knows? Perhaps someday BMW, Mercedes, and Audi will no longer be the first names linked with the leading automobile manufacturers.
Developments like these are simultaneously affecting other business branches, such as the insurance sector. The substantial revenue increase for Connected Cars in the last years has resulted in, and stakeholders are trying to secure a seat at the table. 2 Not only is individual mobility about to change, but also traffic analysis and traffic control in general. In a nutshell, one could say that the whole present conception of the automobile is on trial.

What Kind of Data Does Modern IT Collect?
Nowadays new cars are already equipped with numerous technological features. The metaphor, a "computer on wheels" 3 becomes an ever-increasing reality. Emergency and driving assistance programs, accident documentation, and cameras and sensors that monitor the environment enable increased safety in road traffic. Dynamic navigation, personalized infotainment services and advanced digital communication options facilitate a significant increase in comfort whilst driving. Furthermore, the option exists to evaluate a cars condition regarding wear and tear and its need for maintenance-for instance by using the so-called on-boarddiagnosis (OBD).
Through this modern IT various kinds of data are gathered, including but not limited to, movement data, status data, data regarding driving characteristics, telecommunication data, data retrieved through environmental monitoring, are being collected, recorded, and stored. Each kind of data is accumulated and processed for different reasons and purposes. The list of IT data processing components, and the hereto associated growth in generated data sets, is steadily growing. 1 Becker 2015, Apple-Manager: "Das Auto ist das ultimative Mobilgerät," http://heise.de/-2669333. 2 VDA 2016, Anteil der mit dem Internet vernetzten Neuwagen in den Jahren 2015 und 2017, Statista, http://de.statista.com/statistik/daten/studie/407955/umfrage/anteil-der-mit-dem-internetvernetzten-fahrzeuge/.

An Overview of Data Protection Classification
In its essence, German data protection law is based on the constitutional right to informational self-determination. It was introduced by the Federal Constitutional Court in its well-known census verdict in 1983. 4 The relevant federal legal framework is the Telemedia Act (TMG), the Telecommunications Act (TKG) and the Federal Data Protection Act (BDSG). In 2018, the General Data Protection Regulation (GDPR) will be applicable.
The application of data protection law depends on the question whether data contains personal references-so called personal data. According to sec. 3, subsec. 1 of the Federal Data Protection Act (BDSG) personal data is any information concerning the personal or material circumstances of an identified or identifiable individual (the data subject). To put it simply, this means data, which contains information regarding a data subject, and thereby makes it possible to trace the information back to a person. 5 If such data are present-which is currently still being intensely debated-a legal authorization or an approval of the affected person is required, due to the data protection prohibition, unless permission is granted, to be able to collect, process and use data. 6 Because of the fact that statutory authorization is limited in its scope, one will primarily rely on the consent being freely given.

What Parties Are Interested-Who Wants a Slice of Data Cake?
The current situation is messy. There are a large number of stakeholders facing off against each other in a complex network of, mostly, conflicting interests. 7 The drivers, vehicle owners, passengers and other road users are unified in their endeavor to protect their own right to informational self-determination concerning the data set they have generated. Indeed, an exception must be made in regard to the younger "Facebook generation": they deal with their generated data in a deliberately naïve manner, particularly when potential economic benefits are expected. An example is heavily discounted insurance tariffs. The "old" automobile industry, mentioned above, is interested in all data, which will be useful for future construction and production. However, the overarching goal of the industry, which in sum is the German Association of the Automobile Industry (VDA), is to aim for sovereignty regarding trends in vehicle development. This is exactly where the IT companies of Silicon Valley that are steadily working to improve their influence on the technical evolution of modern vehicles come into the picture. 8 Additionally, they are interested in expanding the services they provide through personalized advertisement and Location Based Services.
Authorized dealers and repair shops are also interested in generated data for the settlement of their purchase and service agreements, not only within the scope of warranty law. Finally, stakeholders, such as the advertising industry or insurances, and also governmental institutions, in terms of prosecution and financial authorities, must also be named as parties interested in receiving data.

To Whom Does the Data "Belong?"
The controversy about the legal classification of data in the age of big data will be one of the key challenges the jurisprudence will face in the years to come. The conception of the German Civil Code (BGB) is traditionally based on the structural distinction between the exchange of goods and services; this does not include data as an object of legal protection. 9 The issue of data ownership is also one of the most critical issues in regards to the modern automobile: To whom does the data-which is generated by the owner and driver-"belong"? To whom are they legally assigned? Who has the power of disposal? The world's leading automobile companies have been trying to position themselves in regards to these issues for quite some time now: At the end of 2014, the former CEO of VW, Martin Winterkorn, announced that the German motor industry will not allow Apple and Google to take over the internet without a fight. 10 The legal debate concerning data ownership is still at an early stage, although some advances have been attempted. 11 Upcoming developments will be observed with great anticipation. The future developments and their implications will not only influence data ownership in regards to the Connected Car, but will affect the whole automobile industry.

Are Driverless Cars Science Fiction? By No Means!
Until a few years ago, self-driving cars were a commonly occurring theme in science fiction movies-but they will become a reality in the foreseeable future. The question to ask is not "if" autonomous driving is technologically feasible, but "when" it will begin. In any case, the technical know-how and framework is already available. Electronic parking and lane-keeping assist systems are already available in series cars today. 12 Google has been testing its famous Google Self-Driving Car on the streets of California since May 2015. 13 An accidentwhich the Google Car would be held accountable for-has so far not occurred. Therefore, technological nightmare scenarios-as things stand today-appear to be unjustified. At the most, one of the test cars has been stopped by local police, on the basis of driving too slowly.
Regardless of how well the technology is already performing, there are a lot of legal and ethical questions to be further discussed and clarified. In the area of civil law, liability issues play a decisive role, especially liability in the event of damages. This is because of the fact that economic costs as a result of traffic accidents-in Germany alone-amount to approximately 30 Billion Euro. 14 Due to this, even marginal legal changes in liability issues cause a massive economic impact. Apart from the specific traffic law liability, according to sec. 7, sec. 18 of the Road Traffic Act (StVG) and the general tortious liability according to sec. 823 of the Civil Law Code (BGB), the product and producer liability are also subject to scrutiny. In addition, the effects on criminal law and misdemeanors must be discussed. Finally, the questions of traffic law in the Road Traffic Regulation (StVO) and issues of regulatory approval according to the Regulation of Approval of Vehicles for Road Traffic (FZV) must be dealt with. 15 As things currently stand a postponement of liability in favor of the vehicle owner and a necessary redesigning of the 1968 16 Vienna Convention on Road Traffic from can be expected. 17

Solutions-"Privacy by Design"
What should a reasonable solution regarding the growing flood of data in modern vehicles try to achieve? A balance between the economic innovational potential on one hand, and an appropriate consideration of the protection of fundamental rights-especially the right of informational self-determination-on the other hand.
The law has already made initial attempts through enabling the possibility of anonymization and pseudonymization in sec. 3, subsec. 6 and sec. 6a of the Federal 12 Lutz, NJW 2015, p Lutz/Tang, NJW 2015, p 124;Lutz/Tang/Lienkamp NZV 2013, p 63. Data Protection Act (BDSG). In regards to this, it is particularly important to take procedures in accordance with the current state of the art into account. The principle "Privacy by Design" could serve as a superior approach than the specific legal approaches. According to this principle, data protection should already be considered in the initial drafts of the development of a new technology, in order to emphasize its importance. "Privacy by Design" is closely linked to the concept "Privacy by Default", where a high minimum level of privacy settings are implemented in the privacy settings of the new technological services. Subsequently, the user shall then be able to decide for him/herself about additional data transfers. The inclusion of both approaches into the broad discussion would provide the potential of good problem solving.

Opportunities and Risks
The automotive industry has ultimately arrived in the digital age and is currently at a crossroad. How can one use the economic opportunities of big data without taking too many risks regarding data protection? The German automotive industry may in this respect-due to its global position-attain a pioneering role. Who knows, maybe Privacy: made in Germany will provide for substantial advertising potential in the future? However, it is clear that data protection, in order to do justice to its significance, must be given the same amount of discussion as traffic safety and environment protection has.

Author Biography
Max v. Schönfeld Dipl.-Jur., research associate at the Institute for Information, Telecommunication and Media Law (ITM) at the University of Münster. He holds a law degree from the University of Münster.
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.