Many new vehicles come equipped with event data recorders(EDRs), those black boxes that record and store data in the momentsbefore and after a crash. Until 2000, only manufacturers could gainaccess to and decode the information that these devices gathered.Now, with a laptop and a specialized computer program, virtuallyanyone can download this data. As a result, car owners areconcerned about what data is being collected and how it can be usedby police, employers, rental car agencies, and, most notably forour discussion, insurance companies.

In the face of these concerns, 12 states have enactedlegislation governing access to EDR post-crash data. As the usageof this data becomes more commonplace in U.S. courts, claimpersonnel and their lawyers must understand privacy issues and keyprovisions of various state initiatives to avoid potentialcase-defining pitfalls.

Privacy Issues

A host of potential privacy issues can arise with EDRs,including who owns the recorded information; the circumstancesunder which others may obtain that information; and the purposesfor which those persons may use that information. Specifically, useof EDR information may run afoul of the Fourth and FifthAmendments.

The Fourth Amendment limits the ability of government agents tosearch for evidence — such as EDR information — without a warrant.It does not apply to searches conducted by private parties who arenot acting as agents of the government. However, the fact that theperson conducting a search is not a government employee does notmean that the search is “private” for Fourth Amendment purposes. Asearch by a private party will be considered a Fourth Amendmentsearch if the private party acts as an agent of the government.

The Supreme Court has offered little guidance as to when privateconduct can be attributed to the government. Rather, the questionturns upon the degree of the government's participation in theprivate party's activities. The federal Courts of Appeal haveadopted a range of approaches for distinguishing between privateand government searches. About half apply a totality of thecircumstances approach that examines three factors: whether thegovernment knows of or acquiesces to the intrusive conduct; whetherthe party performing the search intends to assist law enforcementefforts at the time of the search; and whether the governmentaffirmatively encourages, initiates, or instigates the privateaction. Other Courts of Appeal have adopted more rule-likeformulations that focus upon only the first and second factors.

The Fifth Amendment provides that no person “shall be compelledin any criminal case to be a witness against himself.” It has beensuggested that the Fifth Amendment's protection againstself-incrimination could be invoked as a means of preventing theadmission of EDR data at trial. It is this writer's opinion thatthe admission of EDR information does not violate the FifthAmendment because by its terms, it applies only to criminal, notcivil cases. Furthermore, the only evidence that is shielded by theprivilege against self-incrimination is testimonial evidence. Thus,the protection of the Fifth Amendment only exists to shieldstatements, not data. Accordingly, the Fifth Amendment should notpreclude the admission of EDR information in a civilproceeding.

While it could also be argued that the common law of trespassmay prevent EDR data from being obtained without the owner'sconsent, in all likelihood the data can be retrieved as part ofdiscovery in litigation. For instance, Rule 26(b) of the FederalRules of Civil Procedure provides that “[p]arties may obtaindiscovery regarding any nonprivileged matter that is relevant toany party's claim or defense …. ” With respect to the nature of thematerials that may be obtained under Rule 26, Rule 34(a)(1)(A)allows discovery of “ other data compilations.” This language hasbeen broadly interpreted to include electronic data.

State Statutes

Although there is no federal statute governing access to EDRinformation, state legislatures have addressed EDR access concerns.Since 2004, 12 states have enacted pertinent laws, while at leasteight states have introduced legislation in 2008.

All of the statutes require the vehicle owner's consent toretrieve data. Of the 12 states, three require the consent to be inwriting, one places time limits on the consent, and one addressesadmissibility. All of these laws have an exception to the consentrequirement when data is recovered for research purposes and theidentity of the owner is not disclosed. In criminal cases, they allprovide that a search warrant overrides the owner consentrequirement.

California, Maine, Nevada, New York, and Texas have the mostbasic forms of EDR legislation, which require that the vehicleowner's consent must be obtained before data can be examined.

On the other end of the spectrum is Arkansas' statute, which isthe most restrictive. The Arkansas statute declares that the EDRdata is private and that all owners of the vehicle must consent inwriting before the EDR data can be accessed. The owner of thevehicle at the time the EDR information is created retainsexclusive ownership rights. The statute also states that the“ownership of the data shall not pass to a lienholder or to aninsurer because the lienholder or insurer succeeds in ownership tothe vehicle as a result of the accident.” Finally, an insurer orlienholder may not make an owner's consent to use EDR data acondition of the policy or a condition of the payment or settlementof an obligation or claim.

Colorado specifies that EDR data is the “personal information ofthe vehicle owner.” The statute also provides that the vehicleowner has to consent to the release of the EDR data within 30 daysof its retrieval.

Connecticut prohibits the alteration or deletion of EDR data orthe deliberate destruction of the EDR unless a reasonable amount oftime is provided for the police to obtain a search warrant.Notably, the Connecticut statute does not address whether dataownership transfers with the transfer of ownership to a carrierwhen a car is salvaged.

New Hampshire's statute provides that ownership of the EDR datadoes not transfer with the transfer of ownership to a carrier whenthe car is salvaged. Instead of treating the gathering of EDRinformation as a privacy issue, New Hampshire refers to it asprivate property. The statute provides that violations “shallconstitute an unfair or deceptive act or practice.” This is notablesince violation of this statute carries a criminal penalty with astatutory maximum sentence of 12 months.

North Dakota's statute is similar to that of Arkansas', in thatexclusive ownership of the EDR information remains with the ownerof the vehicle at the time the data record is created and may notbe retrieved without the owner's permission. The law states that“[a]n insurer may not require as a condition of insurabilityconsent of the owner for access to data that may be stored withinan event data recorder and may not use data retrieved with theowner's consent before or after an accident for the purpose of rateassessment.”

Maine's statute, in addition to requiring the vehicle owner'sconsent, notes that “[n]othing is this subchapter affects aninsured's duty to cooperate as provided in an applicable insurancecontract or agreement.”

Oregon requires the consent of all registered owners andprovides that the EDR information does not become the property of alienholder or insurer because the lienholder or insurer gainsownership of the vehicle as a result of an accident. Furthermore,an insurer may not condition the payment or settlement of a claimupon the owner's consent to the retrieval or use of the EDR data oras a condition of providing the policy or lease.

The statute also has specific requirements for criminal versuscivil cases. In criminal cases, there is a specific exception forsearch warrants, which override a lack of owner consent. In civilcases, an insurer may petition a court for an order to retrieve EDRdata from a vehicle without the owner's consent if the courtdetermines: (i) the owner of the vehicle has a policy of insuranceissued by the petitioning insurer; (ii) the data is necessary toreconstruct the facts of the accident and “to allow the insurer todetermine the obligations of the insurer under [its] insurancepolicy”; and (iii) “an accurate and timely determination of thefacts of the accident cannot occur without the [EDR] date.” SinceEDR information is supplemental to any accident reconstructionanalysis, the petitioning insurer may not be able to satisfy theserequirements.

Virginia's statute provides that ownership of the EDR as well asthe data it captures survives the salvage transfer of ownership ofthe vehicle so long as the EDR is not separated from the vehicle.Just like the Arkansas and North Dakota statutes, consent cannot beconditioned upon an insurance cooperation clause since advancewritten permission to gain access to EDR data is strictlyprohibited. The statute also provides that “[t]he failure of aninsurer to obtain access to the [EDR] data shall not create, norshall it be construed to create, an independent or private cause ofaction in favor of any person.”

Aside from the specific declaration in the Arkansas statute thatEDR data is “private,” the Arkansas, New Hampshire, North Dakota,Oregon, and Virginia EDR statutes all refer to EDR data as propertywith the same ownership rights as tangible property.