Information processing device

Abstract

To appropriately obtain an agreement about information collection from an information provider.SOLUTION: A consent to collection of first data from a first vehicle is obtained at a first timing from a first user via an on-vehicle device installed on the first vehicle, and when a re-consent from the first user is required to use of the first data collected from the first vehicle, a re-consent request is issued to the on-vehicle device on condition that an owner of the first vehicle has not changed since the first timing.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to techniques for collecting information from vehicles. [Background technology]

[0002] In recent years, there has been a demand for more appropriate management of personal information. In this regard, for example, Patent Document 1 discloses a system for obtaining consent to data provision from users at low cost. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-117807 Summary of the Invention [Problem to be solved by the invention]

[0004] The purpose of this disclosure is to properly obtain consent for information collection from information providers. [Means for solving the problem]

[0005] One aspect of the present disclosure is to The information processing device has a control unit that executes the following: obtaining consent to collect first data from a first vehicle from a first user at a first timing via an in-vehicle device provided in the first vehicle; and, when consent from the first user is requested again for use of the first data collected from the first vehicle, issuing a consent request again to the in-vehicle device, on the condition that the owner of the first vehicle has not changed since the first timing.

[0006] Other aspects include a method executed by the above-mentioned device, a program for causing a computer to execute the method, or a computer-readable storage medium non-transitoryly storing the program. Effect of the Invention

[0007] According to the present disclosure, consent to information collection can be appropriately obtained from information providers. [Brief description of the drawings]

[0008] [Figure 1] 1 is a schematic diagram of a vehicle system according to a first embodiment. [Diagram 2] FIG. 2 is a diagram showing components of an in-vehicle device and a server device. [Diagram 3] 4 shows an example of data stored in the in-vehicle device and the server device. [Figure 4] 4 is a flowchart of a process executed by an in-vehicle device. [Diagram 5] An example of a screen for asking for consent to provide data. [Figure 6] 11 is a flowchart of a process executed by a server device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] In recent years, attempts have been made to utilize data collected from automobiles. It is expected that various services can be provided by using the data collected from vehicles as big data. On the other hand, the data transmitted from the vehicle may include personal information or information similar to personal information. Such data includes not only personal information itself, but also location information and other data that can raise privacy issues when linked to individuals.

[0010] For this reason, attempts are being made to provide users (e.g., vehicle owners and drivers) with an explanation of the collection and use of data in advance and to obtain their consent before entering into a data provision contract. The explanation can be provided and consent can be obtained, for example, via an on-board device installed in the target vehicle.

[0011] On the other hand, there may be cases where the data collected in the past is to be used for purposes other than those originally intended. In this case, if conditions not included in the contents agreed upon in the initial data provision contract are added later, it is preferable to obtain the consent of the user again.

[0012] However, if the target vehicle is sold, for example, and the user who provided data in the past is different from the user currently using the target vehicle, a problem may arise in which the person contacted via the in-vehicle device is not the same person who provided consent in the past. The information processing device according to the present disclosure solves such problems.

[0013] An information processing device according to a first aspect of the present disclosure includes: The control unit has: a control unit that acquires consent to collect first data from a first vehicle from a first user at a first timing via an in-vehicle device provided in the first vehicle; and when consent from the first user is requested again for the use of the first data collected from the first vehicle, issues a consent request again to the in-vehicle device, on the condition that the owner of the first vehicle has not changed since the first timing.

[0014] The first data is data acquired while the first vehicle is traveling, and includes personal information of the driver and data related to the traveling of the first vehicle (e.g., position information, speed information, and images from an on-board camera). The first data is also referred to as sensor data. The control unit obtains consent to the provision of the first data from a first user of the first vehicle via the in-vehicle device at a first timing.

[0015] On the other hand, there are cases where the first user is asked to give consent again for the use of the collected first data, for example, when the purpose of use of the first data is changed after the fact. However, if the owner of the first vehicle has changed since the time when the consent was initially obtained, there is a high possibility that the user contacted via the in-vehicle device installed in the first vehicle will be a person different from the original user. Therefore, in such a case, the control unit re-obtains consent on the condition that the owner of the first vehicle has not changed since the first time. According to this configuration, it is possible to avoid contacting a user other than the user who originally provided consent.

[0016] If the owner of the first vehicle has changed since the first timing, the control unit may resolve the issue regarding consent by performing a predetermined process. For example, the control unit may search for contact information of the owner of the first vehicle at the first timing using a predetermined database. This makes it possible to identify the user who owned the first vehicle at that time.

[0017] In addition, if the user who owned the first vehicle at that time cannot be identified or if consent cannot be obtained again from the user, the control unit may That is, instead of obtaining consent, the first data may be anonymized to a level where consent is no longer required.

[0018] Specific embodiments of the present disclosure will be described below with reference to the drawings. Unless otherwise specified, the hardware configuration, module configuration, functional configuration, and the like described in each embodiment are not intended to limit the technical scope of the disclosure to only those.

[0019] First Embodiment An overview of a vehicle system according to a first embodiment will be described with reference to Fig. 1. The vehicle system according to this embodiment includes a vehicle 10 equipped with an in-vehicle device 100, and a server device 200. The system may include a plurality of vehicles 10 (in-vehicle devices 100).

[0020] The vehicle 10 is a probe vehicle for collecting data. The vehicle 10 is configured to be able to collect data related to driving and data related to occupants, and can transmit the collected data to the server device 200 via the in-vehicle device 100. Examples of the data related to driving include the vehicle speed, direction of travel, location information, information related to driving operations, information related to vehicle behavior, image data captured by an on-board camera, etc. Examples of the data related to the occupants include personal identifiers, gender, age, etc. In the following description, data collected by the vehicle 10 will be referred to as sensor data. Although the sensor data is an example of the "first data," the data collected by the vehicle 10 does not necessarily have to be obtained by sensing.

[0021] The server device 200 is a device that provides a predetermined service based on sensor data collected from the vehicle 10. For example, by collecting position information and speed information from a plurality of vehicles 10, congestion information and traffic information can be generated and provided to other vehicles. In addition, by collecting data on the vehicle occupants, it becomes possible to provide information suited to individuals. In addition, by collecting images captured by an on-board camera, it becomes possible to generate road map data. The server device 200 requests a plurality of vehicles 10 to transmit predetermined sensor data, and the vehicles 10 (on-vehicle devices 100) respond by transmitting the sensor data.

[0022] The server device 200 may be a device that provides a service to the vehicle 10 (or other vehicles) based on the sensor data collected from the vehicle 10, or may be a device that relays the sensor data collected from the vehicle 10 to an additional external device. For example, when there are multiple types of sensor data collected from the vehicle 10, the server device 200 may relay the sensor data to different external devices under the management of different operators for each type of sensor data.

[0023] Furthermore, the server device 200 obtains consent from a user (eg, a driver) associated with the vehicle 10 to provide the sensor data (ie, to transmit the sensor data to the server device 200). The presence or absence of consent is stored in both the server device 200 and the in-vehicle device 100, and the in-vehicle device 100 transmits data to the server device 200 only when there is consent to the provision of data. The in-vehicle device 100 has a database that stores the presence or absence of consent for each type of sensor data, and determines whether the user has consented (has consented in the past) to transmitting certain sensor data based on the database.

[0024] Furthermore, the server device 200 detects changes in the conditions of use of sensor data collected in the past. When the consent is changed, the function is configured to obtain consent again from the user at that time (i.e., the user who gave consent in the past).

[0025] In the vehicle system according to this embodiment, a plurality of in-vehicle devices 100 and a server device 200 are connected to each other via a network. The network may be, for example, a WAN (Wide Area Network) that is a global public communication network such as the Internet or other communication networks. The network may also include a telephone communication network such as a mobile phone, or a wireless communication network such as Wi-Fi (registered trademark).

[0026] Each element that makes up the system will be explained. FIG. 2 is a diagram showing a system configuration of the in-vehicle device 100 and the server device 200. As shown in FIG.

[0027] First, the configuration of the server device 200 will be described. The server device 200 can be configured as a computer having a processor such as a CPU or GPU, a main memory such as a RAM or ROM, and an auxiliary memory such as an EPROM, a hard disk drive, or a removable medium. The auxiliary memory stores an operating system (OS), various programs, various tables, and the like, and by executing the programs stored therein, it is possible to realize various functions that meet a predetermined purpose, as described below. However, some or all of the functions may be realized by hardware circuits such as ASIC or FPGA. The server device 200 may be configured as a single computer, or may be configured as a plurality of computers that cooperate with each other.

[0028] The server device 200 includes a control unit 201 , a storage unit 202 , and a communication unit 203 .

[0029] The control unit 201 is a calculation device that manages the control performed by the server device 200. The control unit 201 can be realized by a calculation processing device such as a CPU. The control unit 201 is configured to have three functional modules: a consent acquisition unit 2011, a data acquisition unit 2012, and a re-consent acquisition unit 2013. Each functional module may be realized by causing the CPU to execute a program stored in an auxiliary storage unit.

[0030] The consent acquisition unit 2011 acquires consent to data provision from the user of the vehicle 10 prior to acquiring sensor data from the vehicle 10. The server device 200 is configured to be able to acquire or store data relating to the use of the sensor data to be acquired (hereinafter, use data). The use data includes data relating to the use of the sensor data, the destination of the sensor data, the conditions for acquiring the sensor data, the timing of transmitting the sensor data, the entity (business operator) using the sensor data, the conditions relating to the data provision contract, and the like. The consent acquisition unit 2011 presents these to the user of the vehicle 10 via the in-vehicle device 100.

[0031] The consent acquisition unit 2011 determines whether or not there is consent to the provision of data for each type of sensor data, based on a response from the user of the vehicle 10. When a response is obtained from the user in response to an inquiry, the consent acquisition unit 2011 stores the presence or absence of consent in both the server device 200 and the in-vehicle device 100. When there is a plurality of sensor data to be provided or when there are a plurality of businesses that use the sensor data, a comprehensive consent may be acquired, or multiple consents may be acquired. When the user of the vehicle 10 agrees to the data provision, it can be considered that a data provision contract has been established between the user and the business entity receiving the sensor data.

[0032] The data acquisition unit 2012 requests each of the vehicles 10 (the in-vehicle devices 100) to transmit sensor data. For example, the server device 200 may In the case where the server device 200 is to execute a service of generating road map data based on the vehicle 10's vehicle-mounted device information, the server device 200 requests the vehicle 10 to transmit image data. The type of sensor data requested by the server device 200 may differ depending on the service executed by the server device 200. Furthermore, the data acquisition unit 2012 receives sensor data from a plurality of vehicles 10 (on-vehicle devices 100) and stores it in the storage unit 202. The stored sensor data is used to provide a predetermined service.

[0033] The re-consent acquisition unit 2013 executes a process of acquiring consent again from the user of the vehicle 10 regarding the use of the sensor data previously collected by the server device 200. For example, consider a case where images from an in-vehicle camera were previously provided under the condition "to be used for generating a map." In this case, the provided images cannot be used for purposes other than generating a map. If it is desired to use the sensor data outside of the condition, consent must be obtained again from the user of the vehicle 10. In such a case, the re-consent acquisition unit 2013 executes a process of obtaining consent again from the relevant user. A specific example will be described later.

[0034] The storage unit 202 includes a main storage device and an auxiliary storage device. The main storage device is a memory in which the programs executed by the control unit 201 and data used by the control programs are expanded. The auxiliary storage device is a device in which the programs executed by the control unit 201 and data used by the control programs are stored. The storage unit 202 stores sensor data collected from the vehicle 10.

[0035] The above-mentioned usage data is also stored in the storage unit 202. Fig. 3A shows an example of usage data 202A. The usage data is data regarding the handling of sensor data, and includes information regarding the sensor data identifier (data ID), the type of sensor data, the destination of the sensor data, the conditions for acquiring the sensor data, the transmission period of the sensor data, and the conditions for using the provided sensor data. The destination of the sensor data may be represented by a network address, etc. Examples of the conditions for acquiring the sensor data include "an image is captured at a specific point," "a video is captured in a specific section," and "location information is acquired every second during a specific time period."

[0036] The storage unit 202 also stores data for managing the user's consent to the provision of sensor data (hereinafter, consent data). Here, the consent data will be described. The consent data is data that records whether or not the provision of sensor data has been permitted by the user of the vehicle 10 for each user, destination of the sensor data, and type of the sensor data. The consent data can be generated, for example, based on the result of an interaction with the user of the vehicle 10.

[0037] FIG. 3B is an example of the consent data 202B. As shown in the figure, the consent data includes fields for a user ID, a vehicle ID, a date, a data ID, a destination, terms of use, and whether or not to provide. The user ID field stores an identifier that uniquely identifies a user who has consented to the provision of data. The vehicle ID field stores an identifier of the vehicle 10 in which the in-vehicle device 100 to which the user performed the consent operation is mounted. The date field stores the date on which consent was given. The data ID field stores information that identifies the type of sensor data. The destination field stores information that identifies the destination to which the sensor data is sent. The terms of use field stores information regarding the conditions under which the business operator uses the provided sensor data. The provision whether or not field stores whether or not there is consent to the provision of sensor data ("permitted" or "rejected").

[0038] The storage unit 202 also stores data (vehicle data) relating to the owner of the vehicle 10. Fig. 3C is an example of the vehicle data 202C. As shown in the figure, the vehicle data includes fields for vehicle ID, user ID, vehicle ID, and update date. The vehicle ID field stores an identifier that uniquely identifies the vehicle. The user ID field stores an identifier that uniquely identifies the owner of the vehicle. The update date is the date when the data was updated.

[0039] The communication unit 203 is a communication interface for connecting the server device 200 to a network. The communication unit 203 includes, for example, a network interface board and a wireless communication circuit for wireless communication.

[0040] Next, the in-vehicle device 100 will be described. The vehicle 10 is a connected car having a communication function with an external network. The vehicle 10 is equipped with an in-vehicle device 100.

[0041] The in-vehicle device 100 is a computer for collecting information. In this embodiment, the in-vehicle device 100 has a plurality of sensors for collecting information related to the traveling of the vehicle 10, and transmits the collected sensor data to the server device 200 at a predetermined timing. The in-vehicle device 100 may be a device (such as a car navigation device) that provides information to a passenger of the vehicle 10, or may be an electronic control unit (ECU) that the vehicle 10 has. The in-vehicle device 100 may also be a data communication module (DCM) having a communication function.

[0042] The in-vehicle device 100 can be configured as a computer having a processor such as a CPU or GPU, a main memory such as a RAM or ROM, and an auxiliary memory such as an EPROM, a hard disk drive, or a removable medium. The auxiliary memory stores an operating system (OS), various programs, various tables, etc., and by executing the programs stored therein, various functions that match a predetermined purpose, as described below, can be realized. However, some or all of the functions may be realized by hardware circuits such as ASIC or FPGA.

[0043] The in-vehicle device 100 includes a control unit 101, a storage unit 102, a communication unit 103, and an input / output unit 104. The in-vehicle device 100 is also connected to a sensor group 110.

[0044] The control unit 101 is a calculation unit that executes a predetermined program to realize various functions of the in-vehicle device 100. The control unit 101 may be realized by, for example, a CPU. The control unit 101 is configured to have, as functional modules, a data collection unit 1011, a management unit 1012, and a data transmission unit 1013. Each functional module may be realized by executing a stored program by a CPU.

[0045] The data collection unit 1011 acquires sensor data from one or more sensors included in the sensor group 110 at a predetermined timing, and stores the sensor data in the sensor DB 102A of the storage unit 102. When multiple sensor data are available, the data collection unit 1011 may acquire all of the sensor data. The sensor DB 102A is a database in which the sensor data collected from the sensors of the vehicle 10 is stored.

[0046] 3D is an example of data stored in the sensor DB 102A. In addition to the sensor data, the sensor DB 102A stores the identifier of the user of the vehicle 10, the date on which the sensor data was acquired, and the like. The time, the location where the sensor data was acquired (location information), and the ID of the sensor data are stored.

[0047] Based on consent obtained from the user of the vehicle 10, the management unit 1012 determines which of the sensor data stored in the sensor DB 102A should be transmitted to the server device 200. Specifically, the management unit 1012 executes the following process.

[0048] (1) Processing for receiving usage data from the server device 200 The server device 200 transmits the above-mentioned usage data to the in-vehicle device 100, thereby requesting data from the vehicle 10. In other words, the usage data also functions as data for requesting the vehicle 10 to transmit specific sensor data. As described above, the usage data includes an identifier (data ID) of the sensor data, a type (data type) of the sensor data, a transmission destination of the sensor data, an acquisition condition of the sensor data, a transmission cycle of the sensor data, etc. The usage data may include information regarding the usage of the sensor data, a business entity that uses the sensor data, usage conditions, etc. The usage data transmitted from the server device 200 is stored in the storage unit 102 .

[0049] (2) Managing user consent for external transmission of sensor data External transmission refers to transmitting the sensor data to a device (e.g., the server device 200) outside the vehicle 10 (i.e., providing the sensor data to the outside). The management unit 1012 acquires from the driver whether or not there is consent to the provision of specific sensor data included in the usage data received from the server device 200, and generates the consent data described above. The consent data is stored in the storage unit 102 (consent data 102B), and is also transmitted to the server device 200 and stored in the storage unit 202 (consent data 202B). The management unit 1012 determines whether or not to transmit the sensor data requested by the server device 200 based on the consent data and the detection result of the driver.

[0050] (3) A process for identifying sensor data that is requested by the server device 200 and for which consent has been given to external transmission. The management unit 1012 determines whether the requested sensor data is permitted to be transmitted to the outside based on the consent data and the usage data, and if transmission is permitted, determines that the sensor data is to be transmitted.

[0051] For example, the management unit 1012 determines whether the in-vehicle device 100 has the sensor data specified by the request data. The management unit 1012 recognizes what type of sensor data is requested by referring to a data ID included in the request data. The management unit 1012 also compares the acquisition condition included in the request data with the records recorded in the sensor DB 102A to determine whether the in-vehicle device 100 has the matching sensor data.

[0052] If the in-vehicle device 100 holds the sensor data specified by the request data and if consent has been given to the provision of the sensor data, the management unit 1012 determines that the sensor data is to be transmitted. In addition, if there is no history of the user of vehicle 10 allowing external transmission of the target sensor data, the management unit 1012 may inquire of the user of vehicle 10 as to whether or not transmission is permitted, and update the consent data based on the result of the inquiry.

[0053] The data transmission unit 1013 acquires the sensor data determined by the management unit 1012 from the storage unit 102 and transmits it to the server device 200 .

[0054] The storage unit 102 is a memory device including a main storage device and an auxiliary storage device. The auxiliary storage device stores an operating system (OS), various programs, various tables, etc., and by loading the programs stored therein into the main storage device and executing them, it is possible to realize various functions that meet a predetermined purpose, as described below. The primary storage device may include a random access memory (RAM) or a read only memory (ROM). The secondary storage device may include an erasable programmable read only memory (EPROM) or a hard disk drive (HDD). It may also include a disk drive (HDD, Hard Disk Drive). may include removable media, i.e., portable recording media.

[0055] The communication unit 103 is a wireless communication interface for connecting the in-vehicle device 100 to a network. The communication unit 103 is configured to be able to communicate with the server device 200 according to a communication standard such as a mobile communication network, a wireless LAN, or Bluetooth (registered trademark).

[0056] The input / output unit 104 is a means for accepting input operations performed by a user of the device and presenting information. In this embodiment, the input / output unit 104 is made up of a single touch panel display. That is, it is made up of a liquid crystal display and its control means, and a touch panel and its control means.

[0057] The sensor group 110 is a collection of multiple sensors that the vehicle 10 has. The multiple sensors may be, for example, a speed sensor, an acceleration sensor, a GPS module, or the like, that acquire data related to the traveling of the vehicle. The multiple sensors may also be, for example, an image sensor, an illuminance sensor, a rainfall sensor, or the like, that acquire data related to the traveling environment of the vehicle 10. The sensor group 110 may include a sensor for collecting data related to the driver or passengers of the vehicle 10. For example, the vehicle passengers may be identified based on an image obtained by capturing an image of the interior of the vehicle, and data related to the passengers may be transmitted as sensor data.

[0058] The sensor group 110 may also include an on-board camera mounted facing outside the vehicle. Images captured by the on-board camera can also be considered as one type of sensor data.

[0059] 2 is an example, and all or part of the functions shown in the figure may be executed using a dedicated circuit. Also, the programs may be stored or executed using a combination of a main memory device and an auxiliary memory device other than those shown in the figure.

[0060] Next, the process executed by the in-vehicle device 100 will be described in detail. 4 is a flowchart of a process in which the on-board device 100 transmits sensor data to the server device 200 based on the application data received from the server device 200. The process shown in the figure is periodically executed while the vehicle 10 is traveling.

[0061] In parallel with the execution of the illustrated process, the data collection unit 1011 executes a process of periodically acquiring sensor data from the sensors included in the sensor group 110 and storing the data in the sensor DB 102A of the storage unit 102.

[0062] In addition, in parallel with the execution of the illustrated process, the management unit 1012 executes a process of receiving usage data from the server device 200. For example, the management unit 1012 makes an inquiry to the server device 200 to determine whether or not there is usage data to be received. Whether or not there is usage data to be received can be determined based on, for example, the last update date and time and the version number of the usage data. For this reason, the server device 200 may notify the in-vehicle device 100 of the last update date and time and the version number of the usage data. Furthermore, the in-vehicle device 100 may store these in the storage unit 102. If there is usage data to be transmitted, the management unit 1012 receives the usage data from the server device 200 and stores it in the storage unit 102. At this time, old usage data may be deleted. It is also assumed that the in-vehicle device 100 has already completed identification of the driver at the timing of starting the process shown in Fig. 4. The identification of the driver can be performed, for example, based on an image captured by a camera provided at the driver's seat.

[0063] First, in step S11, the management unit 1012 identifies the sensor data requested by the server device 200 based on the usage data. In this step, the sensor data requested by the server device 200 and stored in the storage unit 102 is specified. The sensor data specified in this step may be of multiple types.

[0064] The processes of steps S12 to S15 are executed for each of the plurality of sensor data identified in step S11. First, in step S12, the management unit 1012 judges whether or not the driver's consent has been obtained for transmitting the target sensor data to the server device 200. For example, if the consent data 102B contains a record that matches the combination of the data ID and transmission destination indicated in the usage data, and if there is a record whose provision permission field is "permitted", this step is judged as positive. If the provision permission field is "rejected" or if there is no corresponding record (if the driver has not expressed an intention regarding external transmission of the target sensor data), this step is judged as negative.

[0065] If the determination in step S12 is affirmative, the process proceeds to step S13, in which the data transmission unit 1013 transmits the corresponding sensor data.

[0066] If the determination in step S12 is negative, the process proceeds to step S14. In step S14, the management unit 1012 judges whether the driver has previously expressed an intention to refuse the transmission of the sensor data having the corresponding data ID. For example, if the consent data 102B contains a record that matches the combination of the data ID and the transmission destination indicated in the usage data, and if there is a record whose provision availability field is "rejected", this step is judged as positive. If the judgment in step S14 is positive, the corresponding sensor data is not transmitted.

[0067] If the determination in step S14 is negative, it means that the driver has not previously expressed an intention regarding the sensor data of the corresponding data ID. In this case, the process proceeds to step S15, where the driver is asked whether or not he or she has given consent.

[0068] In step S15, the management unit 1012 confirms with the driver whether the corresponding type of sensor data may be provided via the input / output unit 104. The confirmation may be performed, for example, via a screen such as that shown in Fig. 5. The screen may include information regarding the type, purpose, destination, and acquisition conditions of the sensor data, and the business entity that uses the sensor data. When there are multiple types of sensor data to be transmitted, consent may be obtained for each type on multiple screens, or the user may be allowed to select whether or not to consent to the provision of each type of sensor data on the same screen.

[0069] When the driver responds, the result is reflected in the agreement data 102B and the agreement data 202B. Based on the content of the response, the processes of steps S12 and S13 are repeated.

[0070] Next, the server device 200 changes the conditions of use of the sensor data previously collected. The following describes the process executed by the server device 200 when the conditions of use have been changed. For example, the use of the sensor data has been changed since the contract was made, or the business entity using the sensor data has been changed since the contract was made. When it becomes necessary to use the sensor data under conditions not included in the original contract, the server device 200 executes the process shown in Fig. 6. The process in Fig. 6 is executed by the re-consent acquisition unit 2013 of the server device 200.

[0071] First, in step S21, it is determined whether the current owner of the vehicle 10 that previously transmitted the target sensor data (hereinafter referred to as the target vehicle) has changed since the time when the sensor data was acquired. In this step, first, the consent data is referenced to extract records related to past consent. Then, it is determined whether the owner of the vehicle (target vehicle) indicated by the vehicle ID included in the record has changed since the sensor data was acquired. The current owner of the target vehicle can be determined based on the vehicle data 202C stored in the server device 200.

[0072] If the owner of the target vehicle has not changed since the time the sensor data was acquired, the process proceeds to step S23, where consent is requested again via the in-vehicle device 100 mounted in the same vehicle.

[0073] If the owner of the target vehicle has changed since the time the sensor data was acquired, the process proceeds to step S22. In step S22, it is determined whether or not a terminal associated with the previous owner of the target vehicle (i.e., a user who gave consent in the past, hereinafter referred to as the target user) can be identified. For example, if a vehicle currently owned by the target user can be identified, the in-vehicle device 100 mounted on the vehicle can be identified as a terminal associated with the target user. The vehicle currently owned by the target user may be identified, for example, by searching the vehicle data 202C. If the determination in this step is positive, the process proceeds to step S24. If the determination in this step is negative, the process ends.

[0074] In step S24, data is sent to the terminal identified in step S22 requesting consent again for the use of the sensor data. The terminal notifies the user that the conditions for using the sensor data have been changed, and requests consent for the provision of the data. If consent is obtained, the consent data 102B and 202B are updated in the same manner as in the process described above.

[0075] As described above, when the conditions of use of previously collected sensor data are changed, the server device 200 according to the first embodiment obtains consent again via the in-vehicle device 100, on the condition that the vehicle owner has not changed since the timing of the previous consent being obtained. This configuration makes it possible to prevent unrelated users (e.g., a user who purchased the target vehicle as a used vehicle) from being asked to consent again to data provision. In addition, since it is possible to contact the user who provided the sensor data, it becomes possible to make better use of the sensor data.

[0076] (Modification of the first embodiment) In the first embodiment, the server device 200 identifies the terminal currently associated with the target user by referring to the vehicle data. However, the server device 200 may identify the terminal associated with the target user by using other data sources. For example, if data for identifying the target user's contact information, email address, mobile device, etc. is available, the target user's contact information can be obtained by accessing the data. Furthermore, if there is a platform that manages consent to data provision, separate from the server device 200, the platform may be used to obtain the contact information of the target user.

[0077] Second Embodiment In the first embodiment, when the owner of the target vehicle changes, the terminal associated with the previous owner (for example, the in-vehicle device 100 installed in the new vehicle) is identified, and consent is obtained again via the identified terminal.

[0078] On the other hand, there are cases where the owner cannot be contacted if the owner has completely given up the car, or if the communication function is not available in the new vehicle, etc. In the second embodiment, in such cases, the sensor data collected in the past is anonymized so that consent is not required.

[0079] When it is determined in the process of step S22 that the terminal associated with the previous owner cannot be identified, the server device 200 according to the second embodiment performs a process of anonymizing the target sensor data. For example, such a process may be a process of making it impossible to identify the user by deleting or editing an item that can identify the user, or an item that can identify the user by a combination of items. For example, data can be anonymized by replacing an identifier unique to each user with an identifier that represents age, sex, or a combination of these.

[0080] In this example, an example of replacing a user's identifier has been given, but the method is not limited to a specific one as long as the data can be anonymized. With this configuration, even if the previous owner of the target vehicle cannot be contacted, it is possible to utilize sensor data collected in the past.

[0081] (Modification) The above-described embodiment is merely an example, and the present disclosure can be modified and implemented as appropriate without departing from the spirit and scope of the present disclosure. For example, the processes and means described in this disclosure can be freely combined and implemented as long as no technical contradiction occurs.

[0082] In addition, in the description of the embodiment, the vehicle owner is determined using the vehicle data 202C, but the vehicle owner does not necessarily have to be determined using the vehicle data 202C. In addition, in step S21, it is determined whether the owner of the vehicle is different or not, but if it is possible to determine whether the person who previously agreed to the provision of data is the same person as the current user of vehicle 10, the subject of the determination does not necessarily have to be the "owner of vehicle 10."

[0083] In addition, in the description of the embodiment, a face image is exemplified as information for identifying the driver of the vehicle 10, but the driver of the vehicle 10 may be identified based on other biometric information. Examples of such biometric information include a fingerprint, a voiceprint, and an iris pattern.

[0084] In addition, in the description of the embodiment, only the server device 200 is exemplified as a destination of the sensor data, but the sensor data may be transmitted to multiple destinations. In this case, the in-vehicle device 100 may receive purpose data from each of the multiple external devices. The destination of the sensor data may be the manufacturer of the vehicle 10 or a related business operator, or a third party with which a data provision contract has been concluded.

[0085] In addition, the process described as being performed by one device may be shared and executed by multiple devices. Alternatively, the processes described as being performed by different devices may be executed by a single device. In a computer system, the hardware configuration (server configuration) by which each function is realized can be flexibly changed.

[0086] The present disclosure can also be realized by supplying a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors of the computer read and execute the program. Such a computer program may be provided to the computer by a non-transitory computer-readable storage medium connectable to the system bus of the computer, or may be provided to the computer via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (floppy disk, hard disk drive (HDD), etc.), an optical disk (CD-ROM, DVD disk, Blu-ray disk, etc.), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, and any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0087] 10. Vehicle 100...In-vehicle equipment 200 Server device 101,201...Control unit 102,202...Storage section 103,203···Communications Department 104...Input / output section 110 Sensor group

Claims

1. Obtaining consent to collection of first data from a first vehicle from a first user at a first timing via an in-vehicle device provided in the first vehicle; When consent from the first user is requested again for use of the first data collected from the first vehicle, issuing a consent request again to the in-vehicle device, on condition that an owner of the first vehicle has not changed since the first timing; An information processing device having a control unit that executes the above.

2. When an owner of the first vehicle has changed since the first timing, the control unit does not issue a consent request again to the in-vehicle device. The information processing device according to claim 1 .

3. When an owner of the first vehicle has changed since the first timing, the control unit performs a predetermined process. The information processing device according to claim 1 .

4. The predetermined process includes a process of searching a predetermined database for contact information of an owner of the first vehicle at the first timing. The information processing device according to claim 3 .

5. The predetermined process includes a process of anonymizing the collected first data. The information processing device according to claim 3 .

Images