Car rental companies and car-sharing schemes are failing to protect sensitive customer data, according to a recently published report by Privacy International.
The UK-based charity has found that car makers, and rental firms in particular, are negligent when it comes to protecting the privacy of drivers using the connected devices increasingly built-in to modern vehicles.
Companies are failing to look after a range of personal information, including locations they've visited, smart phone contents and places of residence.
As part of a research project, Privacy International rented a number of internet-connected cars in a bid to explore how information is collected and restored on their infotainment systems.
Every vehicle the charity rented exhibited serious privacy flaws when it came to personal data. The cars contained information about previous and current drivers, including locations visited and smartphone contacts.
The charity also got in touch with a number of car-schemes in Europe, the UK and the US to explore their internal security practices. However, none of them had what PI regarded as sufficient policies in place to ensure that personal information is protected.
And, out of the companies that participated in PI's research, all referred the charity to their terms and conditions. They also said it's the responsibility of drivers to delete their data upon returning the car.
While many vehicles come with the option to "factory reset" the car, according to PI it's unclear how and what information is actually deleted.
And only one car rental company is looking to adopt an internal policy about deleting driver information, implementing it before the General Data Protection Regulation comes into force in May next year.
Millie Graham Wood, a solicitor at Privacy International, slammed the lack of any discernible policies at car rental firms to protect customer data.
"This report shows how basic information, which could identify who we are and where we go, is currently left open and accessible to everyone on cars used by popular rental companies," she said.
"We are calling on rental companies to make it simple and clear for people to delete their personal information when they return a rental car. We encourage individuals who see someone's data on the car to report it to the company."
She added: "When we hire a car, the last thing on our mind is the data we are potentially giving away to companies, manufacturers, and the next driver.
"However, internet-connected cars know our current location, patterns of movement, connect to our smart phones to download our contacts and messages, may collect our browsing habits and know our music taste.
"The volume of data collected by infotainment systems and telematics units is growing."
A Quantum Development Kit for developers only
Banks, law firms and financial software suppliers in the UK, US and Russia targeted
Rolls-Royce chief digital officer Neil Crockett plans to use big data for efficiency and profit
Tackling security and global connectivity in logistics