Getty Images | Todd Korol
A federal appeals court rejected lawsuits that alleged five major carmakers violated a Washington state privacy law. The lawsuits centered on car infotainment systems that store text messages in a way that potentially allows the messages to be retrieved by law enforcement using specialized hardware and software. The rulings in the carmakers’ favor came in cases against Ford, General Motors, Honda, Toyota, and Volkswagen.
A three-judge panel at the US Court of Appeals for the 9th Circuit unanimously upheld US District Court rulings that dismissed the five class-action lawsuits, which were almost identical. The appeals court ruled in Ford’s favor on October 27, then issued rulings upholding the dismissals of the other four cases on Tuesday this week.
We’ll cover the Ford ruling here since the other decisions don’t go into the same level of detail, and the arguments were similar in all five cases. The simple version is that the cases failed because the plaintiffs’ data stayed in the car systems and apparently was never transmitted to law enforcement, Ford, or anyone else.
The class-action “complaint alleges that the vehicle’s system downloads all text messages and call logs from Plaintiffs’ cellphones as soon as they are connected,” the Ford ruling said. “The complaint also alleges that the infotainment system permanently stores the private communications without Plaintiffs’ knowledge or consent.” The complaint’s allegations refer to Ford cars made in 2014 and after.
Plaintiffs alleged that there is no way to delete the text messages and call logs from the car system. “If text messages or call logs are deleted from a cellphone, the vehicle nevertheless retains the communications on the vehicle’s on-board memory, even after the cellphone is disconnected. Vehicle owners cannot access or delete their personal information once it has been stored,” the ruling’s summary of the complaint said.
Products can extract messages and call logs
Ford’s website provides instructions for a factory reset that “erases all stored data, such as call history, text messages, previously paired phones,” and other data. That’s useful before one sells or transfers a car but doesn’t allow drivers to manually delete specific messages or call logs while they’re still using the vehicle with a connected phone.
There was no allegation that Ford or the other carmakers directly accessed text messages or call logs, or that they stored the data in their own systems. The privacy concern comes from the fact that a company called Berla sells specialized data-retrieval products to law enforcement, which could use the products to obtain messages and logs from a car.
Berla’s website boasts that “having access to a suspect’s connected vehicle is the next best thing behind having the actual phone itself.” In a statement quoted in the plaintiffs’ complaint, Berla also says that if “a driver uses the infotainment interface to ‘delete’ their device, that device information often remains in unallocated space and can be recovered.”
“According to the Plaintiffs, Berla produces hardware and software capable of extracting stored text messages and call logs stored on a vehicle’s on-board memory,” the appeals court ruling said. “Berla products are not generally available to the public, and sales access is restricted to law enforcement, the military, civil and regulatory agencies, and select private investigation service providers.”
