Re: [projectvrm] Fwd: [ PFIR ] Proposed California law requires site privacy polices not to exceed 8th grade language and 100 words

[Drummond Reed < >]

OMG.

At first I saw how long this message was and thought I didn't have time to read it. But T-Rob is a compelling thinker, so I started reading it...

...and couldn't stop.

And Rob's right, you better be sitting down when you read the end. 

I literally can't believe there hasn't been a full-blown privacy revolt about the Ford SYNC terms. Why would anyone agree to this??

On Fri, Feb 15, 2013 at 12:45 AM, T-Rob < " target="_blank"> > wrote:

Hi Alan,

> Why should we have to read a privacy policy in the first place? If
> we buy say, an automobile, we are not presented with a long and
> detailed list of its various components, their quality and
> functions, and asked if we agree or disagree with the choice of
> component or how it is being used. Quite rightly, we expect the car
> company to address all these issues in ways we can trust - and we
> expect them to be taken to the cleaners if they fall down on
> quality, safety and so on.

I used to think that too.  Until I bought a Ford Fusion with Sync. Because
my opinion of auto sales was similar to that which you expressed below, it
never occurred to me to ask about the TOS or privacy policy.  But when you
buy the car they tell you "go home and create a Sync account" in order to
use the voice activation and other Sync features.  When you actually go to
sign up, this is what you find:

" If you opt not to provide us with personal information, you can still
access our website, however you may be unable to create log in
credentials, participate in certain promotions, receive product
information, activate or use a service, or have a purchase order
fulfilled."

"Activate or use a service" in plain English means "the ability to use the
functionality for which you bought the car."  Among the other smart
features, you are able to run a Vehicle Health Report on all systems of
the car.  That of course provides a lot of info to Ford.  How do they use
the VHR?  From their Privacy Policy:

"When you run a Vehicle Health Report, Ford Motor Company may collect your
cell phone number (to process your report request) and diagnostic
information about your vehicle. Certain versions or updates to Vehicle
Health Report may also collect additional vehicle information. Ford may
use the vehicle information it collects, as well as information regarding
individual access to Vehicle Health Reports at syncmyride.com, for any
purpose. If you do not want to disclose your cell phone number or vehicle
information, do not run the feature or set up your Vehicle Health Report
profile at syncmyride.com."

So either you don't run the health reports or you do and Ford can collect
all car data, from all car systems, including your phone book uploaded to
the audio/nav system, and use it for *any* purpose.  Their policy on
Personally Identifiable Data is similarly wide open  Among the ways they
admit to use your data are:

"Compile user data that is stored in our corporate database and may be
used for marketing and other purposes."
"Match personal data collected here with data about you that we collect
offline."

What the hell are "other purposes"?  Could they be any more vague?  And
the bit about matching personal data translated in plain English to "key
your cell number and account from the VHR to your demographic records" so
that car data is not as uninterestingly anonymous as the previous
paragraphs suggest.  They also reserve the right to send your data to any
global location and note that it may reside in a jurisdiction that has
different privacy levels than your own country.

> The mere fact of introducing an 'agreement' between the buyer and
> the car company on the quality/functionality of its components would
> open up a huge temptation for the car company to blind the buyer
> with science, cut corners, take advantage --- all now with the
> defence 'but you agreed to it'. That's exactly what has happened
> with so-called 'privacy'.

Been there.  Done that.

"By clicking "I Accept" below, you the user ("User") agree to be bound by
these Terms and Conditions whether or not you have read them. If you do
not agree to these Terms and Conditions, you will be unable to run or
activate the SYNC Driver Features. You must be at least 18 years old, or
the age of majority, as determined by the laws of your state of residency,
to accept these Terms and Conditions and assume the obligations set forth
in these Terms and Conditions. Further, you agree to make all other
drivers, passengers or guests of your car aware of these Terms and
Conditions and subject to these Terms and Conditions. You are solely
responsible for the use of the SYNC Driver Features for your vehicle, even
if you are not the one using the SYNC Driver Features and even if you
claim later that another person's use was not authorized. "

So if you come to Charlotte and I pick you up to go to lunch, I'm supposed
to read you the TOS before you get into the car.  And if I forget to read
them to you and you later sue Ford for recording our conversation, I'm
responsible because - you guessed it - 'but you agreed to it'.  Oh yeah,
and they can change the TOS without notice and your continued use of the
service after that point constitutes your agreement:

"Ford may at its sole discretion, with or without notice, modify these
Terms and Conditions at any time and such modifications will be effective
immediately upon being posted on this website. Your continued use of the
SYNC Driver Features will indicate your acceptance of these modified Terms
and Conditions of Use. If you do not agree to the Terms and Conditions or
any modification of the Terms and Conditions, then you must immediately
stop using the Vehicle Health Report and/or SYNC Services."

You'd better hope Ford's web site isn't breached because *you* are
responsible for their damages if someone else uses your account:

"You are entirely responsible for maintaining the confidentiality of your
account information, including your password, and for any and all activity
that occurs under your account. You agree to notify Ford immediately of
any unauthorized use of your account or password, or any other breach of
security. However, you may be held liable for losses incurred by Ford or
your dealer due to someone else using your user name, password, cell phone
number or account."

They go on to explain all the "vehicle travel information" is collected
and may be shared with Sync services providers.  They don't tell you who
those are in the TOS but they include at the least Microsoft, Gracenote,
Garmin and Sirius/XM.  Next they explain that you bind anyone else you let
into the car to these terms.

"Further, you agree to obtain the consent to the collection, logging,
storage, and sharing of vehicle travel information and other call details
for the purposes set forth above from any other person(s) to whom you
provide access to and use of the Service via your cell phone. If you don't
consent or wish to disclose this information, do not activate or use SYNC
Services."

Now, if you thought all of that was horrifying you should sit down before
reading the next part.  They reserve the right to record all sounds and
conversations in the car.  These are called "Whole Call Recordings" or
WCRs.

"WCRs will include voice utterances and may include any other sounds in
the vehicle, including the voices of the user and other vehicle occupants,
during the entire time the Service is connected."

Of course, you bind your passengers by proxy to these terms as well:

"By activating or using the Service, you expressly agree to the recording
and sharing of your utterances and WCRs as set forth above for the
purposes set forth above in these Terms and Conditions regardless of
whether or not you have read them. Further, you agree to obtain the
consent to record utterances and WCRs from all vehicle occupants and any
person(s) to whom you provide access to and use of the Service via your
cell phone. If you don't consent or wish to disclose this information, do
not activate or use SYNC Services."

They also reserve the right to revoke licenses to any electronic media
that you store or play such as Garmin maps, Gracenote DB entries, songs,
videos, etc. on behalf of content owners:

"You therefore agree that MS and/or FORD MOTOR COMPANY may, in conjunction
with such license, also download revocation lists onto your DEVICE on
behalf of Secure Content Owners."

> As soon as we start arguing about whether the small print is
> readable or not, we have already ceded the principle and the
> argument to the data landgrab industry.

Yeah, I found this out when I attempted to upgrade the maps and CD song
title DB in the car.  Many Garmin units have free lifetime maps because it
sells the hardware.  But once you pay $30k for the hardware, they figure
you'll pay $300 a pop for map updates.





"> wrote on 02/14/2013 04:00:10 AM:

> From: ">
> To: "> , "> ,
> Cc: "> , "> ,
> ">
> Date: 02/14/2013 04:08 AM

> Subject: Re: [projectvrm] Fwd: [ PFIR ] Proposed California law
> requires site privacy polices not to exceed 8th grade language and 100
words
>

> I'm not sure I really understand this debate.
>
> Why should we have to read a privacy policy in the first place? If
> we buy say, an automobile, we are not presented with a long and
> detailed list of its various components, their quality and
> functions, and asked if we agree or disagree with the choice of
> component or how it is being used. Quite rightly, we expect the car
> company to address all these issues in ways we can trust - and we
> expect them to be taken to the cleaners if they fall down on
> quality, safety and so on.
>
> The mere fact of introducing an 'agreement' between the buyer and
> the car company on the quality/functionality of its components would
> open up a huge temptation for the car company to blind the buyer
> with science, cut corners, take advantage --- all now with the
> defence 'but you agreed to it'. That's exactly what has happened
> with so-called 'privacy'.
>
> I do not see why I should have to read anything, tick anything to
> agree to anything when I share my data with a company for commercial
> purposes. I should 'just know' that I am only sharing data that is
> 100% related to the task in hand, that any data I share will only be
> used for the purposes of providing the service and facilitating the
> transaction, that it will not be passed on to anyone else, and that
> it will be kept by the seller only for as long as service provision
> is necessary.
>
> I shouldn't have to read small print or tick boxes about this. It
> should be the standard, default norm - just taken for granted - and
> any company transgressing on this norm should be taken to the
> cleaners (by regulators and public opinion), just as a car company
> transgressing on quality and safety should be taken to the cleaners.
> I blogged about this recently here.
>
> As soon as we start arguing about whether the small print is
> readable or not, we have already ceded the principle and the
> argument to the data landgrab industry.
>
> Alan M
>
>
>