What Happens to the Personal Data in a Connected Car When the Car is Sold?

When he ran a vehicle inspection company, Andrea Amico was often surprised by the personal property people left behind in the cars they’d sold, traded or returned from a lease. Often, that personal property was virtual and stored in the car’s electronic systems — phone logs, contact lists, text messages and more.

The kind of data that is stored will vary by the manufacturer, the system and the third-party vendors, but it also commonly includes identifiers of the phone, garage door codes and, in navigation systems, destinations.

Today, Amico is the founder and CEO of Privacy4Cars, a company that offers a free app for consumers that helps them identify the systems in their car and then delete the data, and a subscription service for businesses that helps them do the same but also track and certify their processes.

“We realized we’re filling a void that was becoming bigger and bigger as the technology content of cars goes up, as data breaches unfortunately go up and as regulation evolves,” Amico told PYMNTS. “So, we just carved out this niche for ourselves and we hope that we get to do something good for the general population and to help companies do the right thing.”

On Nov. 30, Privacy4Cars announced it had secured two patents for deleting personal data from vehicles. One covers the company’s proprietary process for removing privacy information from in-vehicle modules. The other patent covers a process for deep forensic deletion of data in vehicles, meant for use in high-security settings, which is not yet commercially available.

Deleting Data Stored in Systems 

Privacy4Cars started as a passion project giving information to consumers. Its app provides information about the systems that may be in the vehicle and the steps consumers can take to delete the data that is stored in those systems.

The company starts with information from the car’s owner’s manual but often builds its own solutions when it finds a better procedure. He noted that automakers’ privacy policies inform consumers about data that is stored in the car, but that few consumers read these policies.

“We will tell you what systems are likely to be in your car, how they operate and what you’re supposed to do to delete your data in a way that is fast, efficient and measurable,” Amico said.

Tracking and Certifying Processes 

With its subscription service for businesses, Privacy4Cars works with auto finance companies, fleets, dealerships, auction companies, inspection companies and repossession companies. Companies like these are increasingly concerned about compliance with local and global privacy and data security regulations. The company recently audited the cars at dealerships and found personal data in cars at 88% of the dealerships.

“The reason why they are increasingly interested in it is because there’s a giant layer cake of liability here,” Amico said. “I often get asked who is going to get sued if there’s an abuse of this data; the answer is, ‘Well, welcome to America, everybody — especially anybody with deep pockets.’”

With the service, businesses can prove that they have reasonable measures in place. This also creates a value proposition for businesses, because they can show consumers that they are protecting their privacy and security. Amico sees companies promoting the fact that they do this in order to take extra care of their customers.

“I like this kind of competition in which companies say, ‘We’re doing the right thing so give us the business,’” Amico said. “I think it’s a very good thing.”

Finding Data That’s Not Just in the Car 

For modern connected vehicles, the data is not just in the car, it can be sent to other locations. For these, Privacy4Cars offers a suite of solutions that helps figure out where the data went and how it can be deleted from there as well.

“We track right now well over 500 companies that collect data from cars,” Amico said. “Of course, every car is different, so we try to figure all that out. It’s not the easiest job.”

Amico recently was interviewed on a TV news broadcast covering the story of someone who had sold his car but found that the app still allowed him to see its location, lock and unlock it, and start and stop it using his phone — even though the car was in another state and in the possession of a new owner.

“I hope that people will see that there’s a need of doing something about it before something bad happens,” Amico told PYMNTS. “So, that’s my hope, to say, ‘Make sure this is not just a check-the-box exercise for compliance; this is actually stuff that can have some real impact on people.’”