Perceptional gaps between professionals and drivers on automotive data privacy

Abstract

The proliferation of autonomous driving and advanced mobility services, alongside increasing regulatory demands for safety and compliance, has led to a dramatic increase in the collection of personal and vehicle data. This data-centric automotive industry has created a sharp tension between automotive professionals and drivers regarding data privacy. The present study addresses the gap of how different stakeholders perceive risks and their underlying cognitive structuring of data collected in-vehicle. Based on 97 types of vehicle and personal data derived from global automaker policies and regulatory frameworks, we employed open card-sorting experiments with 30 participants, followed by hierarchical clustering and network analysis. Results show distinct mental structures: professionals tend to group special-category (e.g., genetic information, religious beliefs, union membership) and body-related data, treating them as an interconnected high-risk cluster; drivers show a tendency of grouping personally identifiable information, such as passport numbers, addresses, and emergency contacts at high risk and forming broader clusters regarding mandatory vehicle telematics. Network analysis further evinced this divergence: while professional networks prioritize regulatory compliance with centralized "compliance hubs" (biometrics, health data), drivers focus on personal traceability via "traceability hubs" (name-address-contact triads). This indicates that in-vehicle consent mechanisms should align with the driver's cognitive model, contextual factors, and item-specific risks to ensure effective data privacy and ethical governance.