Brooke Conkle, Chris Capurso, and Kim Phan delve into the latest trends in privacy and their significant impact on the auto finance industry.
In this episode, Brooke Conkle and Chris Capurso, attorneys in the firm's Consumer Financial Services Practice Group, are joined by Kim Phan, a partner in the firm's Privacy and Cyber Practice Group. They delve into the latest trends in privacy and their significant impact on the auto finance industry. The discussion covers the evolving landscape of data security, the implications of connected cars and the Internet of Things, and the challenges and opportunities presented by AI. Kim also shares insights on how recent legislative changes and the new administration may shape the future of privacy regulations. Tune in for a comprehensive analysis of these critical issues and their potential ramifications for the auto finance sector.
Moving the Metal: The Auto Finance Podcast — 2024 Privacy Trends and Their Impact on Auto Finance
Hosts: Brooke Conkle and Chris Capurso
Guest: Kim Phan
Recorded: 12/04/24
Aired: 12/17/24
Brooke Conkle:
Welcome to Moving the Metal, the premier legally focused podcast for the auto-finance industry. I'm Brooke Conkle, a partner in Troutman Pepper's Consumer Financial Services Practice Group.
Chris Capurso:
And I'm Chris Capurso, an associate in Troutman Pepper's Consumer Financial Services Practice Group.
Brooke Conkle:
Today, we're joined by Kim Phan, a partner in Troutman Pepper's Privacy and Cyber Practice Group, and we'll be discussing recent trends in privacy and their impact on the auto industry. But before we jump into that, let me remind you to please visit and subscribe to our blogs. We have two great ones that may be of interest to you; TroutmanPepperFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. Also, we have a bevy of other podcasts that you may find interesting. The Consumer Finance Podcast, which, as you might guess, is all things consumer finance related. The Crypto Exchange, devoted to trends, challenges, and legal issues in Bitcoin, blockchain, fintech, and regtech. FCRA Focus, a podcast dedicated to all things credit reporting. Unauthorized Access, a deep dive into the personalities and issues in the privacy, data, and cybersecurity industry. And finally, Payments Pros, a great podcast focused exclusively on the payments industry. All of these insightful shows are available on your favorite podcast platform, so check them out.
And speaking of those platforms, if you like what you hear, leave us a review and let us know how we're doing. We'd love to hear from you. Alternatively, feel free to reach out to us directly. Our contact information can be easily found on the firm's website, troutman.com. If you enjoy reading our blogs or listening to our podcasts, please also check out our financial services mobile app. To download it, simply go to your iOS or Android app store and search for Troutman Pepper. Not only does our app have all of our blog content and podcast episodes in one handy place, it also has a listing of the firm's financially-focused attorneys. So check it out and see what you think.
For today, as I mentioned, we're joined by our esteemed colleague from the Privacy and Cyber Practice Group, Kim Phan. Kim, welcome to Moving the Metal. Tell us a little bit about your practice.
Kim Phan:
Brooke, Chris, thanks so much for having me. And I hope that you were both enjoying the holiday season. I know this podcast episode is coming out right in the thick of it, but always happy to join and interested very much in talking about some of the developments with privacy, with regard to the auto-finance space. But before we get into that, Brooke, as you noted, I have been working in the space for some time. I've been focused on privacy and data security specifically for financial institutions over the last 20 years. That has included working with a number of the large auto finance captive companies as well as others in the auto finance space to assist them with not only their data security needs, but their privacy needs and all things data protection. Whether or not that involves e-commerce, marketing, other compliance issues, social media, it is always an evolving and interesting space to work in. And I'm thrilled to be here to talk to your audience about it.
Chris Capurso:
Awesome. Thanks, Kim. So, I'm going to start off with two questions, one much more important than the other. The first is what is your favorite holiday movie. The second is what are some of the big trends that we've seen in privacy in 2024?
Kim Phan:
I will start out by saying that my favorite holiday movie is Miracle on 34th Street. The original. Not the trash remake.
Chris Capurso:
Classic.
Kim Phan:
Because even the legal theory in the original movie is much better than what they came up with in the remake, which actually had really not a great legal premise to it. That's dorky legal context for the fact that I was always planning to become a lawyer, even at the tender age that I was watching Miracle on 34th Street at home.
But the reality is, Chris, when you ask about what are some of the trends happening in privacy and the auto finance space, auto finance is not alone in the reality that privacy is one of those areas that is just light speed ahead this past year, not just for them, but for pretty much every industry, right?
Data security, I think, has been around for some time, right? Back when Target and Sony and some of those large companies had their big data breaches about 8 to 10 years ago, security, I think, has matured in a way that folks know what to do. There's always evolving threats, but people understand how they need to be thinking about them and approaching them.
Privacy, I think, is undergoing a sea change right now, where the expectations are evolving so rapidly. The compliance obligations are shifting so quickly that my understanding is that many companies, not just in the auto finance space, are having a hard time keeping up. And certainly with the auto finance space, it's one of those areas that, like mortgage, it's one of the largest purchases a consumer is going to make in their lifetime, right? There's a lot of scrutiny around that area with regard to vehicle purchases. How the auto financing is being conducted? What data is being collected? How it's being used? Who it's being disclosed to?
And you see that the same trends that we're seeing in other areas in the law directly impact how privacy should be viewed from the auto finance space. In thinking about some of the new state privacy laws, thinking about the Internet of Things and connected cars, thinking about artificial intelligence and what that means for consumer data. How it can be used? How it can train additional models and algorithms, right? All of these are some really interesting trends that are still, I would say, not resolved yet. We're still seeing new laws, new interpretations, new regulations being issued in each of these areas. And it's, let's say, high times for privacy lawyers.
Brooke Conkle:
Kim, is there any one particular – we're using the word trend, but one particular issue that you think really has emerged in 2024 for auto dealers or for auto finance companies?
Kim Phan:
Well, I'll focus on two, actually. The Internet of Things and connected cars, the impact of that on the auto finance industry I don't think can be understated. The ability for cars to have that interconnectivity opens up a whole wellspring of different opportunities for manufacturers, for auto finance companies, to understand how cars are being used. What the applications are with regard to different consumer behaviors with regard to purchasing and driving their vehicles? And not just the reality that these fully automated cars are constantly getting to accidents on the street, there's that obvious safety concern, but the privacy consideration of how often are you letting your car drive autonomously. What does that say about you as far as a driver? What does that say about you as far as being an insurance risk? What does that say about you with regard to future credit availability for when you crash that car and want to buy a new one, right?
There's a lot of things related to connected cars that I think touch on the privacy realm and specifically with regard to auto finance, right? The reality that when I bought one of my most recent cars, the salesman was very proud to tell me that the dashboard screen is powered by the same BTUs and intelligence as six laptops all right there in that dashboard. I'm like, "Is that a good thing?" But I will accept that as a good thing as the salesman is trying to sell me this car. But the ability to deliver, say, your monthly statement directly to that dashboard. And there's legislation around this. The ability to have kill switches in vehicles, right? You haven't made the last six months of payments on this car, we're going to kill it and you can't drive it anymore, right?
The ability to track whether or not your leased vehicle, which the leases say covers the continental United States, but GPS tracking shows that you drove that vehicle to Mexico. Does that mean that you've broken the terms of your lease? And what is the auto finance company going to do about that? There are so many opportunities with regard to the type of data that you can collect with the Internet of things and these connected cars, but there's also a bevy of risks associated with that. What exactly are you collecting it? How are you using it? How are you being transparent with consumers about that collection and use? Who are you giving this data to?
We have a new law in California that requires that vehicle manufacturers have an ability to turn off access to vehicle data. Say, a husband and wife jointly purchased a vehicle, but because of domestic abuse or other types of activities, the wife wants to leave that situation. And rather than having to give up her car, she should be protected. And access for the husband to location data and other driving information from that vehicle, California now says there has to be an ability to cut off that access, right? We're seeing, again, evolving legal obligations with respect to connected cars that I think we're only touching the tip of the surface of what that's going to look like in coming years.
I'll pause there. Do you have any follow-up on that before I jump into artificial intelligence, which is also a very meaty topic?
Brooke Conkle:
No. Actually you are hitting exactly on some of the questions that we had where, in recent episodes, we've looked at new legislation that is affecting auto finance companies, specifically some new legislation in New Hampshire, and I was going to ask you about kind of new legislation and this new law in California is exactly what we wanted to hear about.
Kim Phan:
Well, very good. With regard to artificial intelligence, that's one of the areas where I think some of these new laws, Brooke, that you're talking about, is going to pull in the auto finance industry winningly or unwittingly, right? We have new laws in Colorado and California. When I say new laws, these are the first laws that have ever been on the books. 2024 was a banner year for artificial intelligence. Colorado and California have new laws with regard to disclosure obligations, training obligations, all kinds of requirements with regard to the use of AI. And the reality is the definition of artificial intelligence is, I think, a little hysterical amongst policymakers right now. They don't understand the technology. They're trying to find things so broadly that they don't miss something. They're capturing basically everything.
In Colorado specifically, it was pointed out to the legislature that, "Hey, you've written this so broadly. This would cover everything from Skynet, from the Terminator movies, to smart devices on your phone, to just basic calculators." Their legislative solution was to clarify, "When we refer to artificial intelligence, we do not mean calculators." But the reality is they had to clarify that because their definition was so broad.
What we've been talking about with regard to the type of technologies that are now built into vehicles and the ability for auto finance companies to use some of that data is almost certainly going to be swept in to some of these new artificial intelligence laws and some of the evolving expectations around what it means to use artificial intelligence. And what rights do consumers have with regard to that use? Can they opt out? Do you have to provide them data with regard to how that decision was made? And what recourse they have if they don't agree with those decisions made by our robot overlords? Right?
Artificial intelligence is one of those areas where I think that the auto finance industry is going to find lots of opportunities, but also, again, like the connected cars, be presented with lots of potential risks. And one quick note about generative AI, that's the new evolution of artificial intelligence, and that's the chat GPTs of the world. The reality is soon we are going to have K.I.T.T. from the old Knight Rider movies able to talk to us in our vehicles and be able to do basic conversational styles where it could hear and understand what we're asking it and provide some basic content back. It is one of those areas where we are just jumping forward leaps and bounds.
Again, I think that there will be opportunities for the auto finance companies to find ways to leverage some of that technology in ways that will not only enhance their ability to service their customers, but also to operate their businesses in a way that will improve efficiency and offer lots of different potential cost savings and other benefits to the industry.
Chris Capurso:
Just had the terrifying thought of K.I.T.T. listening to me when somebody cuts me off, or I've taken a wrong turn, or any number of things and it has to reign me in.
Kim Phan:
Well, keep in mind, Chris – I mean, the reality is if law enforcement or national security purposes, they want to go to your auto manufacturer and access that data, the reality is they probably will be able to get that data.
Chris Capurso:
Which is great. They're going to think a lot of nice things about me.
Kim Phan:
Just remember it's the holidays, Chris.
Chris Capurso:
That's right. Yeah. I mean, it'll be all Christmas music. That's all they're going to be hearing. I guess another question, and this is actually I think our first podcast that we've recorded since the administration change. Obviously, a big deal. And in all aspects of legal practice, we're kind of dealing with what does that mean? Clients are constantly asking, "Okay, post –" was it January 20th is the day? Right around there. “What happens? Do things stop? Do we get new kinds of initiatives?” In the privacy space, what kind of changes do you foresee in the new administration?
Kim Phan:
Well, I mean, we're of auto finance, right? The biggest agencies that we think about are the CFPB and the FTC. Those two agencies will see dramatic changes post the inauguration. I think there's broad expectation that President Trump will replace CFPB Director Rohit Chopra on basically day one. President Biden did something similar before.
The reality is the directorship of the CFPB will alter and the priorities of the CFPB are widely expected to change. And from a privacy perspective, with regard to the auto finance industry, we're going to see things like the FCRA, Fair Credit Reporting Act, rule-making basically put on a shelf. They recently announced proposed regulations to amend vast aspects of the FCRA. For example, what it means to get written instructions of the consumer to pull a consumer report. What it means to have a legitimate business need to obtain a consumer report. Permissible purposes of the auto finance industry are frequently using, the CFPB would have placed additional restrictions and requirements on them. All of that presumably goes away as soon as there is a new leadership at the CFPB.
There's other implications too with regard to how the CFPB views things like open banking. The ability for third parties, like dealers, like auto finance companies to obtain consumer transactional data directly from banks themselves. How that gets interpreted? That rule was finalized recently, I think back in October. And while it would be hard for a Trump administration to unwind that rule entirely, presumably, we will see some shift in how it's being interpreted and implemented. And that, again, could open up various data sources and other doors for the auto finance companies to benefit from.
At the FTC, I think the big change that we'll see is Lina Kahn, who was the youngest, and I'll say one of the most imaginative lawyers I've ever seen lead the FTC in finding new ways to stretch the FTC's authority. The FTC had announced some time ago that they were undergoing a privacy rule, which they called their data surveillance rule-making. I think we can widely expect that rule-making walls we put on a shelf and that broad uses of commercialization or monetization of data by companies is something that we're not going to have to worry about under a Trump administration FTC.
Now, whether or not Khan leaves the FTC entirely is a little actually up in open question. She certainly will not be the chair anymore. The president will be able to select a new chair. Traditionally, the existing, the seated chair of the FTC will resign and make way for a new chair to be appointed by the president. Now, that's not a strict obligation. And while that has been tradition, I think we've observed that Khan has been willing to buck tradition in the past. And whether or not she wants to stay as a commissioner through the remainder of her term, and she still has three or four years left on her seven-year term as a commissioner. While she won't be the chair, she could choose to stay for that period of time, which would leave Trump in a position of either removing someone entirely, which is difficult at an independent agency to find a way to appoint a Republican chair. He could also appoint one of the existing Republican commissioners as the chair. There's a little bit of open question as to what will happen at the FTC, but the certainty is that Khan and some of her initiatives like the data surveillance rule-making will almost certainly be put aside.
Chris Capurso:
And I guess one follow-up on that. This is kind of the question we ask everybody when we're talking about the administration change. Obviously, that's at the federal level. Do you think at the state level – I mean, obviously, you've already described several state initiatives and state laws coming in specifically related to privacy. But do you see any changes? Do you think folks will be a little bit more active at the state level depending on which way their political winds blow in the privacy space?
Kim Phan:
Yes, I think you're likely to see at least among the democratically controlled states that there will be an uptick in legislation, regulatory enforcement, other activities as these states essentially deputize themselves to take over where they perceive to be gaps in federal activity. We saw this during the first Trump administration that there was heightened activity amongst the state attorneys’ generals and others with regard to how they were viewing especially issues like privacy. Which, again, where there is a perception that there may be some gaps on the federal level with regard to what is being done. I think that is something we're likely to see. What form that takes I think is still an open question, but I think we will see more activity on the state level than in prior years.
Chris Capurso:
Right. Well, that'll wrap it up for today's podcast. Thank you to our audience for tuning in. Don't forget to check out our blogs where you can subscribe to the entire blog or just the specific content you find most helpful. That's the ConsumerFinancialServicesLawMonitor.com and the TroutmanPepperFinancialServices.com blogs. And while you're at it, why don't you head on over to Troutman.com and sign up for our consumer financial services mailing list so that you could stay abreast of current issues with our insightful alerts and advisories and receive invitations to our industry insider webinars.
And also, while you're on the website, you should check out FCRA Focus, which Brooke mentioned earlier, but Kim is the co-host of that podcast. So you should check it out. And of course, please mark your calendars for a great new episode of Moving the Metal, which will be released in 2025. We are going to take a holiday break. Hope everybody has a wonderful holiday. And until next time.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.