This month's question: Where is the black box in my car that tracks my driving?
News You Can Use: what your employer knows about your habits off hours, fraud with fake IRS forms, how giving to charities gets you on sucker lists, my rant on big business causing identity theft and more.

Last month a spate of high profile data breaches at big companies like ChoicePoint and Bank of America made hundreds of thousands vulnerable to identity theft. If you haven't checked your credit report recently, please, please do (call 1-877-322-8228).When you're done with that, you can start worrying about all the new technology that is rapidly encroaching upon one of our last bastions of privacy, the car.

Remember, if there are any questions you'd like answered in future editions, send mail [newsletter AT amandawelsh.com].

And then there's my book, The Identity Theft Protection Guide.

If you're lucky, the answer is under the driver's seat. If you're unlucky, the answer might be on the judge's bench.

Since 1999, every car coming off a US assembly line has been equipped with at least two airbags. In order to know if the airbags should be deployed, cars also have sensing devices which monitor things like a change in vehicle speed, brake status, and the state of driver's seat belt every few milliseconds (see the full list of what can be tracked). In the event of an accident or near-accident (defined opaquely as something severe enough to "wake up" the sensing devices), the sensing device triggers the airbag and, in up to 90% of newer cars, records about 5 seconds of pre-crash data.

The smarter sensory devices, also called Black Boxes or Event Data Recorders (EDRs), typically look like this and depending on the car you drive, can be found either under the dash or front seat on the driver or passenger side.

A few years ago, as part of an initiative to learn how to make safer cars, a Santa Barbara company called Vetronix introduced a software package that translates the data collected by EDRs into something readable…and analyzable. Now, certain GM, Ford and Isuzu cars can be easily deprogrammed following a crash. It's this data that is starting to show up in courtrooms across the country.

Data from a black box recorder in a Corvette will be used in an upcoming trial of two teenage men accused of second degree murder after a 139mph joy ride. At least six other states - Maine, Kentucky, Florida, Illinois, Michigan, and Missouri - have already joined New York in using black box data.

We should expect more.

Last fall, the National Transportation Safety Board recommended that all cars made in the U.S. be required to have black boxes. The National Highway Transportation Safety Administration wants to standardize on collection of 42 pieces of data by 2008 and will issue a formal ruling on this soon.

In addition, car insurers and legislators are already thinking beyond collecting and using crash data. California and Oregon have floated the idea of a mileage tax administered by the black box. Insurers are toying with ways to monitor actual driving to set more accurate rates or voiding warranties if your dealer discovers you've been driving too fast or otherwise "abusing" your car.

At this point, consumer protection is pretty limited. California passed a law requiring information on your car's EDR to appear in the manual. But the really hard questions like who actually owns EDR data (presumably, but not definitively, the driver) and whether the data is reliable enough to base important decisions on aren't getting a lot of attention.

If you're concerned about the potential for misuse of data from your own airbag, here's a pre-written letter on privacilla.org you can send to your legislator.

Privacy::Protection is a free monthly newsletter providing news and tips on privacy and information protection issues. Back issues are available at [http://www.amandawelsh.com/newsletters].

You can unsubscribe by sending email to newsletter AT amandawelsh.com.

To subscribe or send comments or suggestions for future content, email newsletter AT amandawelsh.com. Permission to print comments is assumed unless otherwise stated. Comments may be edited for length and clarity.

Please feel free to forward this newsletter to colleagues and friends who will find it valuable. Permission is granted to reprint Privacy::Protection, as long as it is reprinted in its entirety.