[TomWinMD]

I did a quick search of the forum and didn't see anything related to this topic, so if this is duplicative, or should be moved to a more appropriate forum on Bimmerpost, please let me know.

Maintaining our personal privacy is important to all of us, and as I think we all recognize, in our 21st Century world, there is a huge amount of technology that's now available in our BMW's.

Understanding what information our vehicles are gathering about our destinations, driving habits, and themselves is a reasonable concern, as is a manufacturer's commitment to helping us protect our privacy.

Many of us learned about what our smart phones are sharing with telecommunications providers, app developers, and other companies (and the US government) a few years back. In order to enable the services we like or chose to leverage. Such data sharing is a requirement for the connected world we work and live in daily.

I believe that as informed consumers, we should be thinking about what our cars know about us and what they are sharing with the manufacturer, or other entities - and do we know about all of what's being shared?

To start, who's actually read through BMW Connected Drive's agreement and the parts about BMW's liability with regard to the telecommunications provider and how BMW secures our data (paragraph 15 and 17) - before you signed it? What did you think?

If you didn't read it, here's the link: (https://www.bmwusa.com/content/dam/b...2014_later.pdf)

I think that the requirements of the European data privacy laws are reflected in what BMW lays out in paragraph 17 when they discuss the need to keep data we provide them secure, but I'd like to know which 3rd parties BMW is sharing data with, exactly which data they are sharing, and exactly what BMW is specifying they do with that data in terms of analysis. The blanket release of liability is noteworthy as well.

As an example, if they want to gather images from my car's forward facing cameras and radar to update GPS maps and find pot holes in the road - I'm good with that, as long as I know about it and I'm not being billed by the wireless provider for the data the car is transmitting. If the car is using the gesture control camera to photograph the occupants of my car every time it starts and then every couple of minutes (and I'm not implying it is in any of BMW's current or past cars) then I'd have a serious issue with that.

Here are links to a couple of articles on the topic that you might find interesting.

"What does your car know about you?" from the Washington Post
https://www.washingtonpost.com/techn...hevy-find-out/

"Who owns the data your car collects?" from Consumer Reports
https://www.consumerreports.org/auto...-car-collects/
(You may need an account for the Consumer Reports article, if so, sorry, but I don't want to re-post it here and potentially violate their copyright.)

So what does everybody think?

[LogicalApex]

Great topic and I agree with you heavily that privacy should be very important to all of us (and is to me).

I did read the BMW Privacy Policy and I also have requested and reviewed the data BMW stores about me via BMW CarData service (and I recommend everyone does). BMW requires you to opt in for sharing your data in ways they will use to "improve the service" in the car which I find very positive (the Data Sharing w/ Analytics option or such in iDrive Data Privacy). They also give you control over what items are accessible as well which is a major help. Meaning you can turn off remote services or limit which of those services are available for your car to enhance your privacy.

You can access BMW CarData @ https://connecteddrive.bmwusa.com/ap...portal/cardata

[TomWinMD]

Originally Posted by LogicalApex

Great topic and I agree with you heavily that privacy should be very important to all of us (and is to me).

I did read the BMW Privacy Policy and I also have requested and reviewed the data BMW stores about me via BMW CarData service (and I recommend everyone does). BMW requires you to opt in for sharing your data in ways they will use to "improve the service" in the car which I find very positive (the Data Sharing w/ Analytics option or such in iDrive Data Privacy). They also give you control over what items are accessible as well which is a major help. Meaning you can turn off remote services or limit which of those services are available for your car to enhance your privacy.

You can access BMW CarData @ https://connecteddrive.bmwusa.com/ap...portal/cardata

I'll dig through it a bit - thanks for the link. Once I take delivery on my new car and have access to the Connected Drive log in, I'm looking forward to digging into the car data sharing more.

I'm also (not to put too paranoid a point on it) interested in seeing an analysis of what the car is actually transmitting, and a full disclosure of the data BMW has in its database (not the data points themselves, but the schema) so you understand what they are collecting in total.

I'm relatively sure what the BMW provided web site shows you is a very cut down version of what the car is sending back to BMW.

I can easily see the potential for any manufacturer to data mine a vehicle to improve design and performance, but with GPS enabled technologies and the cross connection to our smart phones, the amount of data available to the car, and therefore the manufacturer increases pretty quickly.

That can lead to unintended leaks of personal data that result from applications that are insecure, malicious actor's compromising BMW's data base and potentially downloading the data for less than benevolent purposes, or using the remote access to the car to gain access to personal data that BMW wouldn't normally draw from your vehicle, but could be accessed by a malicious actor.

Thanks again.

[mrgicm]

The thing is you can retain all the connecrivity and use all the features and apps while being certain you have 100% privacy. We all know today it is possible to hack into allmost anything nowdays.

Bottom line if you want to hide your privacy regarding bmw you need to remove the TCB unit from your car, thus disabling the communication between the car and the server, where ofcourse you loose all you connectivity apps, feauters and privliges

[LogicalApex]

Originally Posted by TomWinMD

I'll dig through it a bit - thanks for the link. Once I take delivery on my new car and have access to the Connected Drive log in, I'm looking forward to digging into the car data sharing more.

I'm also (not to put too paranoid a point on it) interested in seeing an analysis of what the car is actually transmitting, and a full disclosure of the data BMW has in its database (not the data points themselves, but the schema) so you understand what they are collecting in total.

I'm relatively sure what the BMW provided web site shows you is a very cut down version of what the car is sending back to BMW.

I can easily see the potential for any manufacturer to data mine a vehicle to improve design and performance, but with GPS enabled technologies and the cross connection to our smart phones, the amount of data available to the car, and therefore the manufacturer increases pretty quickly.

That can lead to unintended leaks of personal data that result from applications that are insecure, malicious actor's compromising BMW's data base and potentially downloading the data for less than benevolent purposes, or using the remote access to the car to gain access to personal data that BMW wouldn't normally draw from your vehicle, but could be accessed by a malicious actor.

Thanks again.

Absolutely, a major future revenue stream for car manufacturers is expected to come from this consistent push for "connected car" services. There is some value added for consumers, but the biggest benefits are tilted toward OEMs as this process moves forward. It is an area I am keeping a close eye on as I care quite deeply about privacy. It was one of the major reasons I wasn't interested in a Tesla (they collect more data than any other car maker to my knowledge).

BMW gives you a lot of control and they see privacy as important. For instance, you are able to connect your calendar and location on the iOS app, but from what I can see the location and calendar information are local to the device and only shared with the car where relevant. When deleting the app and re-installing "learned" features like significant locations and previous Remote 3D view requests are no longer present as they appear to be stored on the device and not the server.

The PP is really good: https://btcapiwebapp.azurewebsites.n..._pp_us-en.json

Additionally, as I mentioned earlier you can turn off remote services in the car as well as on BMW Website. Including disabling the cellular connection entirely if you prefer without needing to remove any hardware.

I will take a look at my CarData file later and see if I can easily remove any data that I don't want to share and share it with the thread. So you can get an idea of what that side looks like. But, BMW seems very good on privacy and it was a major factor for me.

[AP]

A concern I have is when you sell / trade in a car. At that point in time can you be sure that ownership has been changed 100% . Ie if you buy a used car , could the previous owner via the phone potentially see where the car is or even worse , unlock the car remotely?

I'd like to think if the car was traded in at a bmw dealership this gets done but if the car is sold privately?

[Mach550]

Originally Posted by AP

A concern I have is when you sell / trade in a car. At that point in time can you be sure that ownership has been changed 100% . Ie if you buy a used car , could the previous owner via the phone potentially see where the car is or even worse , unlock the car remotely?

I'd like to think if the car was traded in at a bmw dealership this gets done but if the car is sold privately?

I honestly didn't think about this until you mentioned it. Normally I'll just go in and factory default the GPS, phone and whatever other personal settings the car has. Do I just log in to connected drive and deactivate or do you need to call them to inform of a new owner?

[hlothery]

I've always done the best I could to delete garage door codes, music, connected devices, routes, etc from every car, as a matter of preparation for trade-in or sell. I often wonder, however, if I have done enough. There......I've created an opportunity for a coder to develop a new OBD device to do this for us!

[TomWinMD]

Here's how you can delete personal data from iDrive versions 4+ through 6.

Source: https://theroadahead.bmw.ca/pdf/BMWF...acy_Engsml.pdf

[TomWinMD]

Here's how to delete personal settings in iDrive 7.0 from BMW How To on Youtube.

According to the video it deletes driver profiles, contacts, journey data (not further specified), and navigation data.

[TomWinMD]

Originally Posted by AP

A concern I have is when you sell / trade in a car. At that point in time can you be sure that ownership has been changed 100% . Ie if you buy a used car , could the previous owner via the phone potentially see where the car is or even worse , unlock the car remotely?

I'd like to think if the car was traded in at a bmw dealership this gets done but if the car is sold privately?

I would think that for a private sale you (as the new owner) could contact your dealer or BMW Connected Drive - once they've verified your identity and that you were the new owner (copy of registration, etc.), they could remove the previous owner's information from their corporate system.

I haven't done this myself. Does else anyone have direct experience with this situation?

[claykin]

Originally Posted by TomWinMD

I would think that for a private sale you (as the new owner) could contact your dealer or BMW Connected Drive - once they've verified your identity and that you were the new owner (copy of registration, etc.), they could remove the previous owner's information from their corporate system.

I haven't done this myself. Does else anyone have direct experience with this situation?

When I lease turn in my vehicles (just did one) I delete all personal data from iDrive, clear the garage door opener, and I also remove the vehicle from my connected drive account.

I also notify bmw assist when I'm on the phone with them to setup the new vehicle.

[AP]

I the think the concern is that some people may simply even know about connect drive. If they buy privately or from a non BMW dealership, Can't expect them to know the full details of this.
The onus is on the seller to unregister them selves from connected drive.
Whilst the details on the car can be cleared up easily (again if you know about that - I bet many people have traded in their cars and not done this!)
Dealers may do it , but I bet its been forgotten in some cases.

[LogicalApex]

I requested a newer version of my CarData report and am posting the glossary of items that end up being collected by the car. My report had a lot less than the items mentioned in the glossary (like my acceleration profile or how often I spend in various car modes) and this may be due to my privacy settings in the vehicle (I don't allow collection of data for analytical purposes). But this should help illuminate the discussion on various data points collected.

I'm sharing the glossary instead of my individual report as it didn't seem to offer any additional value.

BMWCarDataTelematicsDataGlossary.pdf

[TomWinMD]

Press release on privacy from June 29, 2020

Woodcliff Lake, NJ – June 29, 2020… BMW of North America announced today the U.S. introduction of BMW CarData, a new set of tools for customers to see and manage how their vehicle data is used. This means that BMW owners in the U.S. will have the ability to choose the vehicle connectivity, privacy, and services that are right for them – including links to third-party services in the future – all through a secure, private platform.

To access the CarData service, a customer must have a telematics-enabled BMW vehicle with a built-in SIM card registered in the ConnectedDrive portal. Customers will have access to the most important telematics data from their vehicle which is securely sent from the vehicle to secure BMW servers. A customer can request a BMW CarData report at any time which shows three types of vehicle data: Condition data (such as mileage); usage-based data (such as average fuel consumption); and event data (such as an automated service call).

There is more to come, too. In the near future, BMW customers will be able to use the connectivity of their vehicle for convenient third-party services such as insurance policies based on actual mileage. This data link will happen through the secure BMW CarData system, without any direct access by third-party services to BMW vehicles. Customers stay in full control over the data that is shared, with whom, and for how long. A CarData report of the data released to third parties is available for customers to download at any time via the ConnectedDrive portal. The report contains a detailed list of the telematics data stored in connection with the vehicle and a glossary explaining key terms.

The launch of BMW CarData in the U.S. follows the successful introduction of CarData in Germany in 2017. For more information about BMW CarData in the U.S., visit BMW ConnectedDrive.

https://www.bmwusanews.com/newsrelease.do?id=3607&mid=

[LogicalApex]

I guess I was digging into this before it was officially released. ����

[TomWinMD]

Originally Posted by LogicalApex

I guess I was digging into this before it was officially released. ����

Looks like it. Not sure I'm picking 'share with insurance company'.