Do you have a reasonable expectation of privacy in the data recorded by your car’s airbag sensing diagnostic module (SDM)? Did you even know your car has an SDM? Two recent court cases highlight important privacy issues related to this technology – and by extension to technology embedded into other consumer products that is capable of recording user information.
Both R. v. Hamilton from the Ontario Supreme Court and R. v. Fedan from the BC Supreme Court are cases involving automobile accidents where police extracted, without a warrant, data recorded on the “black box” associated with vehicle airbag systems. These little ‘black boxes’ are referred to alternatively as sensing diagnostic modules (SDMs) or airbag control modules (ACMs). The devices are installed in cars along with the airbag system. Their recording function is triggered by the sudden deceleration that precedes the deployment of the airbags, and they typically record only a few seconds of data leading up to impact.
It is a violation of s. 8 of the Canadian Charter of Rights and Freedoms for police to conduct a search without a warrant in circumstances where there is a reasonable expectation of privacy. Thus, a key issue in these airbag cases was whether there was a reasonable expectation of privacy in the SDM data, and, in consequence, whether the police should have obtained warrants prior to seizing the devices and extracting the data.
The two courts reached opposite conclusions on this issue. Justice MacDougall of the Ontario Supreme Court found that the accused had a reasonable expectation of privacy in the data, and that his Charter rights were violated when the data was extracted without a warrant. This court found that the SDM was similar to a computer that recorded information about its user. By contrast, Justice Kloegman of the British Columbia Supreme Court found that there was no reasonable expectation of privacy in the SDM data.
The BC Court found that the driver had no reasonable expectation of privacy in the recorded data largely because he did not know that his car was equipped to record such data. As Justice Kloegman explained: “SDMs are a relatively new feature of motor vehicles and it is unlikely that the majority of drivers even know their vehicle is equipped with one or what it does.” (at para 22). In fact, the judge was prepared to distinguish Hamilton on this point – in Hamilton, the accused was an off-duty police officer who knew about such devices, and therefore could be found to have a reasonable expectation of privacy. However, for the court to base a reasonable expectation of privacy on whether or not a consumer realizes that the product they have purchased is recording data about their use of it is hugely problematic, particularly as we move into an era where more and more of our consumer items are “smart”. A reasonable expectation of privacy in recorded data should not depend upon whether the individual knew that their car, fridge, phone, thermostat, or any other consumer item was programmed to record data about their use of the device. One might even argue that the lack of awareness that one’s use of consumer devices leaves a data trail should result in an enhanced expectation of privacy.
The court in Fedan also criticized the finding of the court in Hamilton that the SDM was a kind of onboard computer, thus aligning it with other computing devices in which a reasonable expectation of privacy has been found by the courts. In rejecting the analogy to a computer, Justice Kloegman observed that when there was a triggering event, the SDM would “capture five seconds of data regarding speed, brakes, and seatbelts.” (para 23) She then stated that this was “information generated by the vehicle, not the driver.”(para 23) This too is reasoning about which ordinary individuals should be concerned. This is not data about the vehicle in the abstract (grey, Volvo, 2010); rather, it is data that reveals how the driver was interacting with the vehicle at the time of the accident. The information is clearly information about the driver – as the court in Hamilton found.
In spite of the conclusion by the BC court that the information at issue was not about the driver, the judge did admit that the “driver’s actions in operating the vehicle will cause the SDM to engage.” (at para 23) Nevertheless, she found that this did not engage a privacy interest since “those same actions would likely be visible to the public eye.” (at para 23) This conclusion is based on older case law that finds that there is no reasonable expectation of privacy in events that take place in public view. However, in technology context, there is a much more nuanced understanding of what is publicly perceptible and what is not. Accidents can occur anywhere and in any conditions. In many circumstances, there will be no witnesses. Even where there are witnesses, eyewitness testimony is notoriously unreliable – and it is considerably less precise than technological records. Eyewitnesses, for example, will not be able to provide the very precise details recorded by an SDM regarding the speed of the vehicle, the extent of braking. It is worth noting that the court in Hamilton, found, by contrast that the data in an SDM “is of a qualitatively different type than what an observing member of the public could reasonably observe.” (at para 58)
The starkly different decisions in Hamilton and Fedan illustrate that there are privacy issues here that have yet to been conclusively resolved. The issue of the reasonable expectation of privacy in SDM data is one that is worth following as cases from other provinces in Canada start to emerge. The implications of judicial approaches go well beyond on-board vehicle data recorders and may extend to a wide range of consumer devices equipped with devices that can record even small snippets of data.
