Driver privacy: Are fleets violating lawfully protected rights?

Speaker 1:

CCJs 10 44 is brought to you by Chevron Delo, heavy duty diesel engine oil. Now there's even more reasons to choose Delo are fleets unknowingly violating their driver's privacy rights. You're watching CCJs 10 44, a weekly episode that brings you the latest trucking industry news and updates from the editors of CCJ. Don't forget to subscribe and hit the bell for notifications so you'll never miss an installment of 10 44. Hey everybody, welcome back. I'm Jason Cannon and my co-host is Matt Cole. 20 years ago, unless you were a rock star or a member of the Hollywood Elite, you probably had reasonable expectations for privacy basically everywhere you went, that's all changed. Now that everything's connected, everything is streaming and seemingly everybody is interested in everything everyone else does around the clock. One of the

Speaker 2:

Areas where fleets may be violating lawfully protected rights to privacy is a place where they have the best of intentions inside the truck cab from driver facing cameras to ELDs. Inca technology gathers a lot of personal data and information because privacy regulations can vary state to state. Fleets need to be sure they understand those regulations and how or if they're in compliance.

Speaker 3:

A lot of the fleets are starting to roll out video-based safety solutions. And at first it was always, well, the unions would get involved, but now a lot of the states are writing the privacy rights. And so these states may come out and say, Hey, you got to have the driver's right to record them. And so whether you're domiciled or you're headquartered in one state, you may have a terminal in another state. So you got to look at, Hey, do I have the driver's consent to actually have driver focused or driver facing video in the truck? Does the driver have to actually sign off on that? And that comes from, that's video-based safety. And then of course, any system also captures not the video-based safety, but if you look at whether it's hours of service dispatch, all that has driver's license or CDL number. So you have to look at, you're storing that information and that's birth dates in some cases social security number.

So that's part of what you have to protect. That is the driver. So you have to look at that part, that piece of driver privacy. And then certain states, for example, in Illinois, when you look at video-based safety also, it gets into things that you don't even think about with a biometrics that's part of privacy, how it reads the eyes. And so you can go on some video-based provider's website, and it actually has a form about the state of Illinois and how to answer questions on whether or not they do biometrics or not. Because Illinois, for example, is looking at whether or not they can capture that information and other states are following suit. So not only do you have to look at your specific, what you're capturing, but you got to look at your vendors and your partners and what they're capturing. So it's in a lot of states, of course, with driver privacy becoming a hotter topic, they're starting to roll out more and more information.

Speaker 1:

The tricky part here is that just because your trucking company is domiciled in one state, that doesn't shield the company from enforcement action when traveling through other states with tougher privacy laws. So compliance can be a lot like hitting a moving target.

Speaker 3:

You may be headquartered in a state, let's say you're headquartered in North Carolina that has one set of driver privacy rules. But let's say you have terminals in California, in New York and who are much more stringent on driver privacy, then you got to look at their rules.

Speaker 4:

The bottom line is though, when we start dealing with this type of stuff, it's almost educating the home-based company of what is the highest common denominator. So right now there are approximately 19 states and another four or five that are getting ready to release privacy regulations that go along with that. And it seems like California and New York, not reading every detailed line in between them, but it seems like California and New York seem to be the most restrictive, right? So when you start to peel back that onion and then you're trying to figure out how these companies need to operate, where they're operating, the equipment that they're using, and this goes back to exactly what you're saying, it gets really messed up at that point because they're going to have to operate at this level of highest common denominator. So if that's going to be California or New York, then we're going to have to roll those privacies up to get to the California or New York set of privacy laws.

Speaker 2:

If compliance is all about consent, wouldn't having drivers sign off on acknowledgement? Simplify matters. Joe and Artie say it's not quite that simple, and they explain after a word from 10 44 sponsor Chevron lubricants.

Speaker 5:

We serve customers from Birmingham, Alabama to the Gulf Coast, so our people and our trucks are booked solid all day. There is no slack in our schedules. These trucks can't break down. I choose an engine oil that takes care of the number one issue with our engines emissions, so we don't have to worry about DPF clogging. I choose the engine oil that keeps our trucks hauling. I choose delo 600 A DF.

Speaker 3:

There's different guidelines. So you've got to talk about what capturing, you got to talk about where it's being stored. You got to talk about what you're doing with it. You've got to talk about who's got access to it and how long you keep it. So I think it's a little bit more complicated than that. So I would always say have somebody from HR look at it, have somebody legal, look at it, some video-based safeties will have a third party look at it. Some video-based safeties have only personnel of the company look at it. So you've got to lay all that out in the agreement as far as who's got visibility, you've got to talk about also how long you keep that data. So depending upon the state. And you also got to talk about what kind of cameras is it forward facing? Is it driver facing? You've got to include more, typically more information than that. And so I definitely would consult with somebody that looks at the law for the state and then draft agreement based upon the law in the state.

Speaker 4:

The driver piece of it is merely the first piece as Joe was alluding to, right? And that's merely the first piece of this entire privacy regulations aspect of it. And it goes deeper into how are you going to protect it, right? Is it going to be encrypted while it's at rest? And then like Joe was saying, it's going to be who has access to it? When do they have access to it? What reason do they get access to it? And all of those things are going to be contractually laid out with their vendors as well. So we're going to start to get into this really big dynamic of cybersecurity when it comes to the privacy regulations. We have some corporate companies, which is very interesting, where they've elected to just go to GDPR because that's the highest common denominator. Now, we don't want to do that here in the United States, most probably because they're very restrictive guidelines and our unions, and a lot of people will probably be screaming at the top of their lungs at that point. But what we will say is that finding that highest common denominator and adhering to it is going to fit within side most regulations.

Speaker 1:

Obviously, data privacy is important, but why would a hacker want drive cam video? Well, they really wouldn't. After the driver's personal data and a backdoor into the trucking business,

Speaker 3:

The data that would be valuable would be, for example, the driver's, driver's license number, CDL number, birth date, and then some of the systems obviously have the social security number, and so that's data that is valuable that gives them access. So a lot of these data privacy, talk about the security measures have to be in place to secure the data. It can't just be, Hey, you have to secure the data and if the data is breached, here's the steps that have to be taken to report that. So certain things have to be put in place, so cyber has to be a priority, and that's to protect the business or to protect the drivers or the consumer. In this case, obviously it could be used to impersonate or somebody could go and try to get a driver's license and the driver's number. Somebody could do identity theft, and so that's to protect the driver. Also, if somebody were to get certain data, let's say it's locations and things like that, that could be used for cargo theft. So that's not driver privacy per se, but if they're able to follow the assets that could be used for cargo theft,

Speaker 2:

The best bet to be in compliance may be to find the most strict regulations applicable to you and comply with those what already has called the highest common denominator. But as regulations tend to change, especially ones that involve technology, fleets have got to keep up with all the little nuances in play

Speaker 4:

When we have this overarching set of regulations. Okay, great, that's a good first starting point and you better be compliant with that one. We can let all the lawyers and all of those people figure out what state is what and so on and so forth. But when you start to move up the ladder a little bit is when you're going to have to start securing it differently. You're going to have to start encrypting it differently. Is it going to be encrypted while it's in transit or is it only encrypted while it's at rest? And those are going to be those other type of nuances that get added above just that one piece of federal regulation.

Speaker 3:

When you roll out, for example, or if you have rolled out video-based safety, you got to keep track of the new regulations, privacy regulations are coming out. Don't depend on the vendor to come to you and say, Hey, this state is coming out with this new regulation. Also, even if you've rolled it out, doesn't mean your grandfathered in. You've got to take responsibility to know, Hey, I may have had this rolled out for two or three years, but now this particular state, for example, they're changing things, so I do need to get something drafted up for my drivers to sign off on. And so you are going to have to figure out a way to keep track of that so you've got the right documentation. So a driver doesn't come back and say, Hey, you did not have my permission to do this. This particular law has been passed. So you've got to figure out a way to keep track of what states have new laws and how they impact your video-based safety program.

Speaker 1:

That's it for this week's 10 44. You can read more on ccj digital.com. While you're there, sign up for our newsletter and stay up to date on the latest in trucking industry news and trends. If you have any questions or feedback, please let us know in the comments below. Don't forget to subscribe and hit the bell for notifications so you can catch us again next week.