John Yoswick

John YoswickJohn Yoswick is a freelance automotive writer based in Portland, Oregon, who has been writing about the collision industry since 1988. He is the editor of the weekly CRASH Network (for a free 4-week trial subscription, visit www.CrashNetwork.com).

He can be contacted at john@crashnetwork.com 

Tuesday, 28 February 2006 09:00

Legal issues surrounding black boxes get murkier

Written by

In the three years since "event data recorders" (often referred to as "black boxes") in vehicles really began to arise as an issue of interest for collision repairers, there has been significant activity related to EDRs on a number of fronts: 

• Legislatively, about a half dozen states have passed laws related to access to EDR data, and more than a dozen others are considering such legislation.

• EDR data is increasingly being accepted as reliable evidence within court rooms. This past summer, for example, a Massachusetts District Court convicted a driver of misdemeanor motor vehicle homicide in the death of her passenger based in part on EDR data that indicated she was traveling at 58 mph in a 40-mph zone.

• On the regulatory front, the National Highway Traffic Safety Administration (NHTSA) is proposing new standards for the content and format of EDR data, and for what information about EDRs that automakers must disclose.

• The number of collision repair shops and others equipped to download or "harvest" EDR data has expanded. One company reports having harvesters in 37 states collecting data for 16 different auto insurers.

Given these developments, here are some of the most common questions those in the collision industry have about EDRs and EDR data.

What percentage of vehicles have EDRs?

NHTSA estimates that at least two- thirds - and as high as 90 percent - of all 2004 and newer light vehicles include an EDR. Another estimate says that about 20 percent of all passenger vehicles on the road today have downloadable EDR information. At least one company sells equipment (for about $2,500) that can download data from EDRs on all GM vehicles back to 1994, and all Fords, Saturns and Isuzus back to 2001.

Are all EDRs collecting the same data?

No, nor do they all record and report data in a standard format. That's one issue the NHTSA hopes to address with its proposed standards that, if approved, would become effective in late 2008. It is proposing that all EDRs record the last eight seconds of vehicle speed, engine RPM, throttle percentage and braking, as well as seat belt usage and longitudinal acceleration - all in a standard format. It would require automakers to indicate in the owner's manual if a vehicle is equipped with EDR. And it would require that automakers make public information that would enable crash investigators to download EDR data. NHTSA has stopped short of requiring EDRs in all passenger vehicles because it recognizes that privacy issues have not been settled, said agency spokesperson Rae Tyson.

If I'm asked or want to download EDR data, what legal issues do I need to consider?

Not surprisingly, privacy advocates and others have serious concerns about the collection and use of EDR data, leading to a growing number of states passing or considering regulations related to EDRs. Most of these regulations, such as those passed in California, Nevada, New York, North Dakota and Texas, first require automakers to notify new car buyers of the existence of the EDR. Arkansas (and legislation under consideration in Pennsylvania) also requires notification of what type of data is recorded.

Virtually all of the states with enacted or pending EDR legislation also require vehicle owner consent before EDR data can be collected. The definition of "vehicle owner," however, varies. Texas and West Virginia don't define it further. California requires the permission of the vehicle's registered owner. If a vehicle is jointly owned at the time of an accident in Arkansas, state law requires the consent of all owners.

"Also interesting in the Arkansas law is that unlike in California and most other states, ownership does not pass to a lienholder should a vehicle be repossessed, or to an insurer should they take ownership of a vehicle," points out Scott Palmer, president and CEO of Injury Sciences, a Texas-based company that helps insurers understand accident and injury causation. "Arkansas also has a unique provision that an insurance claim cannot be contingent upon an owner's permission to give access to this data."

North Dakota requires the consent of the owner of the vehicle at the time the data is accessed (as opposed to at the time of the accident). It defines the owner of the vehicle as the person "having all the incidents of ownership, including the legal title of a vehicle regardless of whether the person lends, rents, or creates a security interest in the vehicle," or the person entitled to the possession of a vehicle as the purchaser under a security agreement or a lease of three or more months.

All of the enacted state laws - and most of those under consideration - allow for access to the data via court order.

Some states, including Arkansas, California, Nevada, New York and North Dakota, offer exemptions from getting the owner's consent prior to downloading the data if it is done so for research purposes.

"That's for understanding how the car crashed, how occupants were injured, and so forth," Palmer said. "The common theme for research purposes is that the identity of the owner of the vehicle must not be transported with the information as it goes to the various government and academic entities that are using it to study car crashes and occupant safety."


Pending legislation in Massachusetts, Alaska, Tennessee and West Virginia offers similar research exemptions. Some states also allow exemptions from getting the owner's consent prior to downloading the data if it is done so for repair purposes. An automotive technician diagnosing vehicle problems and repairing the vehicle can download the data for that purpose without the owner's consent in Arkansas, California, New York and North Dakota. Pending legislation in Massachusetts, Tennessee and West Virginia offers similar repair-related exemptions.

A number of states considering EDR legislation have drafted less common provisions. Bills in Montana, New Hampshire and New Jersey, for example, give the vehicle owner the right to disable the EDR, despite the fact that in many cases, this means also disabling the air bag system.

"An interesting element to the Alaska bill is not only must the owner consent to the download of the data, they must also consent to the use and disclosure of the data before it can be downloaded," Palmer said.

The bottom line, Palmer said, is that anyone in any of the above states (or Louisiana, Maine, Connecticut and Virginia, which are also considering some form or legislation on EDR data) should make sure they understand the restrictions on accessing EDR data.

Have the automakers and insurers taken a position on such legislation?

With this clearly being an issue state legislatures are looking at, the Alliance of Automobile Manufacturers has proposed model legislation that it hopes lawmakers will adopt. It requires disclosure of EDR existence in the vehicle's owners' manual, and in the case of subscription type services such as OnStar, disclosure of what data is collected. It defines the vehicle owner as the person possessing legal title and entitled to possession of the vehicle, or a lessee with a written lease over three months in duration.

It allows for the downloading of EDR data with the consent of the owner or owner's agent, with a court order, for research purposes, or by a dealer or auto technician for the purpose of service or repair to the vehicle.

The Property Casualty Insurers Association of America (PCI) has proposed its own revisions to the automaker's model legislation. That revision would allow EDR data to also be downloaded without the vehicle owner's consent if it is done so by or on behalf of an insurer for claims adjusting or investigation, fraud investigation, loss control or research.

"This is not a position that is held by our company," Palmer said of the PCI proposal. "We believe owner consent should be a requirement before the data is extracted, but this is what [PCI is] proposing to legislators. We are consistently finding that the legislators are not responding to this request."

What are courts ruling in terms of ownership of the data and its validity?

Palmer lists a series of cases over the past five years pertaining to EDR data that he says indicate that "courts are seeing this data not as private individual data but as evidence as to what happened in a car accident."

Indeed, in New York last year, a defense attorney challenged the admissibility of information gleaned after police removed data from a defendant's black box before obtaining a search warrant. A judge ruled, however, that the seizure was legal and that the driver had no reasonable expectation of privacy because he'd been on a public highway where anyone watching could see his driving behavior.

"But what's also important about these cases is that [courts] are finding the data scientifically reliable in determining what happened in an auto accident," Palmer said. But some tests of EDRs have indicated that if power to an EDR is lost during a crash, the device may not record all data or could falsely record seat belt data.

The vehicle's speed can also be recorded inaccurately if the car is airborne during an accident, rolls over or loses a wheel from the drive axle. And in at least one case, researchers discovered a programming bug that caused an EDR to falsely record brake information in a particular car model. EDR download reports now include a warning about this glitch for crash inspectors..

Robert Breitenbach, director of the transportation safety training center at Virginia Commonwealth University, which conducted a study of EDRs, said investigators and courts should never rely solely on EDR data.

"You really need to do a thorough investigation of the physical evidence and just use [EDR data] as another tool," he said.

If a collision repair shop clears air bag codes on a vehicle or disposes of an air bag module when replacing it with a new one, could it be liable to disposing of evidence?

Although EDRs are generally a component within an air bag control module, simply clearing the air bag codes does not erase EDR data, which on most systems is permanently recorded following an air bag deployment. (If the air bag does not deploy but the EDR system was triggered, the data is retained for 250 ignition cycles - about 6-8 weeks of normal use - or until a more severe impact is recorded.) The issue of whether an air bag module containing an EDR should be disposed of once replaced is a little less clear.

"Unfortunately in our society, finger- pointing is common place," Palmer said. "So that's a very valid concern."

Are there insurers requiring DRPs shops to download EDR data?

Palmer said he is not aware of DRP contract language requiring such downloading because he does not have access to those contracts.

"But I'm aware at least in one instance where that practice exists in the industry today," he said.

John Yoswick is a freelance writer based in Portland, Oregon, who has been writing about the automotive industry since 1988.