Driver Privacy Act of 2015 Addresses Privacy Concerns for Data Collected on Event Data Recorders
Wednesday, March 2, 2016

An event data recorder (EDR), as defined in 49 CFR section 563.5, generally means a device or function in a vehicle that records the vehicle’s dynamic time-series data during the time period just prior to or during a crash event. Such data is intended for retrieval after the event, but does not include audio and video data. The EDR records continuously as a vehicle travels; however, data is only stored if a major event occurs, such as a crash or air bag deployment.

The data in these recorders can include whether a driver’s seatbelt was buckled, how far the accelerator was depressed, the seat position of a driver, whether the brakes were applied before a collision and the vehicle’s speed. This information can be used for crash reconstruction and by the National Highway Traffic Safety Administration (NHTSA) to conduct investigations into potential vehicle defects. Although it has not required the installation of EDRs on new vehicles, the NHTSA estimates that vehicle manufacturers voluntarily install EDRs on approximately 96 percent of new motor vehicles.

Exceptions to the Privacy Standard

This Act is very important because the data/information collected and stored by these EDRs can be extremely valuable in determining issues of fault and liability after a collision. The Act establishes the owner or lessee of a motor vehicle as the owner of data collected and stored on the vehicle's EDR, however there are exceptions. These limited exceptions include (1) as authorized by a court or judicial or administrative authority, subject to the standards for admission into evidence; (2) pursuant to the written, electronic or recorded audio consent of the vehicle owner or lessee; (3) to carry out investigations or inspections authorized by federal law; (4) if necessary to facilitate medical care in response to a car accident; and (5) for traffic safety research, so long as the personal information of the owner/lessee is not disclosed.

Impact on Employer/Vehicle Owners

The Driver Privacy Act of 2015 also has a major impact on employers, as an increasing number of companies install or otherwise use some of the latest monitoring technologies in vehicles driven by employees. The Act affects employers in that ownership of the data recorded by the EDR may shift from the employer to the employee depending on the owner of the vehicle, regardless of the use. If the employee is operating a company-owned or -leased vehicle, the company has the right to access the information contained on the EDR. In addition, the company would have to be the one to consent to anyone else’s access to the EDR. In the alternative, if the employee is operating his/her own vehicle for company business, the employee owns the data and the employer would need the employee’s written, electronic or recorded audio consent before accessing the EDR information.