Consent confirmation device, consent confirmation computer program, and consent confirmation method

Abstract

The present invention provides a consent confirmation device that verifies whether or not the occupants have given their consent to provide data acquired in the vehicle to external parties, without imposing any burden on the occupants. [Solution] The consent confirmation device 12 includes a confirmation unit 233 that confirms with the occupant whether or not they consent to the provision of data when the occupant identification information that identifies the occupant of the vehicle and the consentee identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle 10 do not match.

Description

Technical Field

[0001] The present invention relates to a consent confirmation device, a computer program for consent confirmation, and a consent confirmation method.

Background Art

[0002] For the development of vehicle control technology and the like, data acquired in a vehicle has been provided outside the vehicle. Such data includes information on the vehicle and the occupants (e.g., the driver), and it is necessary to consider the handling of this information from the perspective of privacy protection.

[0003] Therefore, when it is required to use the information collected on the vehicle and the occupants, the information is provided after obtaining the consent of the occupants (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] When the vehicle is used by the same occupant, repeatedly asking the same occupant for consent to provide information to the outside bothers the occupant. On the other hand, when the occupants of the vehicle are changed due to transfer or sharing of the vehicle, etc., it is required to obtain consent from the new occupants to provide information to the outside.

[0006] Therefore, an object of the present disclosure is to provide a consent confirmation device that confirms the presence or absence of the consent of the occupants while reducing the burden on the occupants regarding providing data acquired in the vehicle to the outside.

Means for Solving the Problems

[0007] (1) According to one embodiment, a consent confirmation device is provided. This consent confirmation device is characterized by comprising a confirmation unit that confirms with the occupant whether or not they consent to the provision of data when the occupant identification information that identifies the occupant of the vehicle and the consentee identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle do not match.

[0008] (2) In the consent confirmation device of (1), it is preferable that the confirmation unit confirms whether the occupant identification information in the vehicle matches the consenter identification information.

[0009] (3) The consent confirmation device of (1) or (2) further comprises a data management unit for managing data, wherein the data management unit stores the data in the vehicle's storage device until it is determined that the occupant identification information and the consentee identification information match, or until it is confirmed that the occupant has consented to the provision of the data, but preferably does not provide the data to the outside of the vehicle.

[0010] (4) In the consent confirmation device of (3), it is preferable that the data management unit discards the data if the crew identification information and the consentee identification information do not match and the crew does not consent to the provision of the data.

[0011] (5) In any of the consent confirmation devices described in (1) to (4), if the crew identification information satisfies the determination conditions generated based on the consenter identification information, the confirmation unit preferably determines that the crew identification information and the consenter identification information match.

[0012] In the consent confirmation device of (6)(5), it is preferable that the consenter identification information includes the identification information of multiple consenters, and that the device further has a generation unit that generates a determination condition based on the identification information of multiple consenters.

[0013] (7) In any of the consent confirmation devices described in (1) to (6), the consenter identification information preferably includes terminal identification information that identifies the consenter's terminal, the vehicle's parking location, the country information in which the vehicle is registered, the vehicle owner information, the consenter's biometric information, or the consenter's vehicle operation information.

[0014] (8) In any of the consent confirmation devices described in (1) to (7), it is preferable that the data acquired in the vehicle includes specific information that identifies the occupants.

[0015] (9) In any of the consent confirmation devices described in (1) to (8), it is preferable to further have a registration unit that registers the crew identification information as consenter identification information when the confirmation unit confirms that the crew member has consented to the provision of data.

[0016] (10) In another embodiment, a consent confirmation device is provided. This consent confirmation device is characterized by comprising: a confirmation unit that confirms with the occupant whether or not they consent to the provision of data when the occupant identification information that identifies the occupant of the vehicle and the consentee identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle do not match; and a data management unit that provides the data to the outside of the vehicle when the occupant identification information and the consentee identification information match.

[0017] (11) In another embodiment, a consent confirmation computer program is provided. This consent confirmation computer program is characterized by causing a processor to perform a process that includes confirming with the occupant whether or not they consent to the provision of data when the occupant identification information that identifies the occupant of the vehicle does not match the consentee identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle.

[0018] (12) Another embodiment provides a consent confirmation method. This consent confirmation method is performed by a computer and is characterized by confirming with the occupant whether or not they consent to the provision of data when occupant identification information that identifies the occupant of the vehicle does not match consentee identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle. [Effects of the Invention]

[0019] The consent confirmation device according to the present invention has an effect of being able to confirm whether or not the consent of the occupant has been obtained while reducing the burden on the occupant regarding providing the data acquired in the vehicle to the outside.

Brief Description of Drawings

[0020] [Figure 1] It is a schematic configuration diagram of a data collection system in which the data collection device of the present embodiment is implemented. [Figure 2] It is a sequence diagram of the data collection process of the data collection system of the present embodiment. [Figure 3] It is a hardware configuration diagram of a vehicle in which the data collection device is implemented. [Figure 4] It is a diagram showing the passenger compartment of a vehicle. [Figure 5] (A) is a diagram showing an example of a registration form, (B) is a diagram showing another example of the registration form, and (C) is a diagram showing still another example of the registration form. [Figure 6] It is an example of an operation flowchart of the confirmation process of the data collection device. [Figure 7] It is a diagram for explaining generating a determination condition. [Figure 8] It is an example of an operation flowchart of the update process of the data collection device. [Figure 9] It is a diagram for explaining updating a determination condition. [Figure 10] It is a diagram for explaining another form of the data collection device.

Embodiments for Carrying Out the Invention

[0021] Figure 1 is a schematic diagram of the data collection system 1 on which the data collection device 12 of this embodiment is implemented. The data collection system 1 includes at least one vehicle 10 and a server 30. The data collection device 12 is implemented in the vehicle 10. The data collection device 12 collects data in the vehicle 10. The data collection device 12 is an example of a consent confirmation device. The vehicle 10 connects to the server 30 via the macrocell base station 41 and the communication network 42 by accessing, for example, a wireless base station 41 (hereinafter also referred to as macrocell base station 41) that provides a macrocell, which is connected to the communication network 42 to which the server 30 is connected via a gateway (not shown), etc. The vehicle 10 may be a vehicle operated only by manual driving. Alternatively, the vehicle 10 may be a vehicle having a driving assistance function that automatically controls at least one of acceleration, braking, and steering.

[0022] Although only one vehicle 10 is shown in Figure 1, the data collection system 1 may have multiple vehicles 10. Similarly, multiple macrocell base stations 41 may be connected to the communication network 42.

[0023] In the example shown in Figure 1, vehicle 10 is traveling on road 50. Road 50 has two lanes 51 and 52. Vehicle 10 is traveling in lane 51. Lane 51 and lane 52 are separated by lane markings 53.

[0024] The data acquisition device 12 installed in the vehicle 10 transmits the data acquired in the vehicle 10 (hereinafter referred to as "collected data") to the server 30.

[0025] Server 30 receives collected data from vehicle 10 via communication network 42. This collected data is used to improve vehicle control, generate or update high-precision maps. The collected data is used, for example, as training data for machine learning. The high-precision maps are referenced by the autonomous vehicle for autonomous driving.

[0026] The collected data may include personal information that could identify the occupants of vehicle 10. Therefore, it is desirable to obtain the consent of the occupants of vehicle 10 before providing the collected data to parties outside of vehicle 10. However, repeatedly seeking consent from occupants who have already consented to the provision of collected data can be burdensome for them.

[0027] Therefore, in this embodiment, when the occupant identification information that identifies the occupants of the vehicle 10 matches the consenter identification information that identifies the consenter who has consented to the provision of the collected data, the data acquisition device 12 provides the collected data to an external party without seeking consent from the occupants of the vehicle 10. In this way, when the occupant identification information and the consenter identification information match, the collected data is provided to an external party without contacting the occupants, thus placing no burden on the occupants.

[0028] Figure 2 is a sequence diagram of the data collection process of data collection system 1. Referring to Figure 2, the general operation of data collection system 1 is described below. Although only one vehicle 10 is shown in Figure 1, the server 30 can perform the same processing for multiple vehicles.

[0029] First, the server 30 transmits collection information, which represents the data to be collected, to the vehicle 10 via the communication network 42 and the macrocell base station 41 (step S101). The collection information includes, for example, the type of data to be collected, the collection conditions under which the data is collected (for example, the location of the vehicle 10, the driving status of the vehicle 10, the status of the occupants of the vehicle 10, etc.).

[0030] Next, the data acquisition device 12 starts collecting data according to the information to be collected (step S102). That is, the data acquisition device 12 acquires predetermined data in the vehicle 10.

[0031] Next, the data acquisition device 12 acquires occupant identification information to identify the occupants of the vehicle 10 (step S103). The occupant identification information is the same type of information as the consent-person identification information. Details of the occupant identification information and consent-person identification information will be described later.

[0032] Next, the data collection device 12 compares the occupant identification information with the consenter identification information to determine whether the occupants of the vehicle 10 have consented to the provision of the collected data to external parties (step S104). If the occupant identification information and the consenter identification information match, the data collection device 12 determines that the occupants of the vehicle 10 have consented to the provision of the collected data to external parties. On the other hand, if the occupant identification information and the consenter identification information do not match, the data collection device 12 confirms with the occupants of the vehicle 10 whether they consent to the provision of the collected data to external parties.

[0033] If the occupant identification information matches the consenter identification information, or if the occupant consents to the provision of the collected data, the data collection device 12 provides the collected data to an external party outside the vehicle 10. Specifically, the data collection device 12 transmits the collected data to the server 30 via the macrocell base station 41 and the communication network 42 (step S105).

[0034] When server 30 receives the collected data, it stores the collected data (step S106).

[0035] On the other hand, if the occupant identification information and the consenting party identification information do not match, and the occupant does not consent to the provision of the collected data, the data collection device 12 discards the collected data without transmitting it to the server 30 (step S107). As a result, the collected data is removed from the vehicle 10.

[0036] According to the data collection system 1 of this embodiment described above, it is possible to confirm whether or not the occupants consent to providing the collected data acquired in the vehicle 10 to an external party while reducing the burden on the occupants.

[0037] Although the data collection system 1 may include multiple vehicles 10, each vehicle only needs to have the same configuration and perform the same processing for data collection. Therefore, the following description will focus on a single vehicle 10.

[0038] Figure 3 is a hardware configuration diagram of vehicle 10, and Figure 4 is a diagram showing the passenger compartment 35 of vehicle 10.

[0039] As shown in Figure 3, the vehicle 10 includes a forward camera 2a, a surveillance camera 2b, a communication device 3, a positioning information receiving device 4, an air conditioning device 5, a vehicle sensor 6, a user interface (UI) 7, a steering wheel 32, an accelerator pedal 33, a brake pedal 34, and a data acquisition device 12. As shown in Figure 4, the driver 40 is seated in the driver's seat 31 within the passenger compartment 35, with the steering wheel 32, accelerator pedal 33, and brake pedal 34 operable.

[0040] Vehicle 10 may have any sensors or operating devices other than those described above. Such sensors include, for example, sensors that detect the environment or conditions around vehicle 10, sensors that detect the conditions inside vehicle 10 (including the conditions of the occupants), and sensors that detect the state of vehicle 10. Operating devices include, for example, devices related to driving the vehicle and devices related to the environment inside the passenger compartment 35. Sensors that detect the environment around vehicle 10 include, for example, distance measuring sensors (not shown) for measuring the distance to objects around vehicle 10, such as LiDAR sensors.

[0041] The front camera 2a, the surveillance camera 2b, the communication device 3, the positioning information receiving device 4, the air conditioning unit 5, the vehicle sensor 6, the user interface (UI) 7, the steering wheel 32, the accelerator pedal 33, the brake pedal 34, and the data acquisition device 12 are all connected to each other via an in-vehicle network 13 that conforms to standards such as a controller area network.

[0042] The front camera 2a is mounted on the vehicle 10 so as to face forward. The front camera 2a acquires a forward image representing the environment of a predetermined area in front of the vehicle 10, for example, at a predetermined period. The forward image is an example of information representing the environment around the vehicle 10. The forward image may represent roads included within the predetermined area in front of the vehicle 10, and road features around those roads.

[0043] The forward camera 2a has a two-dimensional detector composed of an array of photoelectric conversion elements sensitive to visible light, such as a CCD or C-MOS, and an imaging optical system that forms an image of the area to be acquired on the two-dimensional detector. Each time the forward camera 2a acquires a forward image, it outputs the forward image and the time the forward image was acquired to the data acquisition device 12 via the in-vehicle network 13.

[0044] The surveillance camera 2b is positioned inside the vehicle compartment 35 so as to be able to acquire surveillance images including the face of the driver 40 who is driving the vehicle 10. The surveillance camera 2b is positioned, for example, on the dashboard. The surveillance camera 2b may also be positioned inside the vehicle compartment 35 so as to be able to acquire surveillance images including the faces of occupants other than the driver 40 who are seated in each seat of the vehicle 10. In this case, the vehicle 10 may be equipped with multiple surveillance cameras 2b. The surveillance camera 2b acquires surveillance images representing the vicinity of the driver's seat 31, for example, at a predetermined period. The surveillance images are an example of information representing the conditions inside the vehicle 10. The surveillance images show the face of the driver 40 seated in the driver's seat 31.

[0045] The surveillance camera 2b has a two-dimensional detector composed of an array of photoelectric conversion elements sensitive to infrared light, such as a CCD or C-MOS, and an imaging optical system that forms an image of the area to be acquired on the two-dimensional detector. Each time a surveillance image is acquired, the surveillance camera 2b outputs the surveillance image and the time the surveillance image was acquired to the data acquisition device 12 via the in-vehicle network 13. The surveillance image is used, for example, to monitor the status of the driver 40.

[0046] The communication device 3 has an interface circuit for connecting the data acquisition device 12 to the macrocell base station 41. The communication device 3 is configured to communicate with the server 30 via the macrocell base station 41 and the communication network 42. The communication device 3 is an example of a device communication unit.

[0047] The positioning information receiving device 4 outputs positioning information representing the current location of the vehicle 10. For example, the positioning information receiving device 4 can be a GNSS receiver. Positioning information is an example of information representing the status of the vehicle 10. Each time the positioning information receiving device 4 acquires GNSS information at a predetermined reception cycle, it outputs the positioning information and the time the GNSS information was acquired to the data collection device 12 via the in-vehicle network 13. Positioning information includes, for example, the current location of the vehicle 10 expressed in world coordinates. The current location of the vehicle 10 includes, for example, latitude and longitude.

[0048] The air conditioning unit 5 is controlled by the occupants, including the driver 40, to adjust the temperature or humidity and airflow inside the passenger compartment 35 to a set temperature or humidity and airflow. The occupants, including the driver 40, control the air conditioning unit 5 by operating the UI 7. The air conditioning unit 5 is an example of equipment related to the environment inside the passenger compartment 35.

[0049] The air conditioning unit 5 outputs an operation signal indicating the operating status of the air conditioning unit 5 to the data acquisition device 12 via the in-vehicle network 13. Based on the operation signal, the data acquisition device 12 can acquire the set temperature or set humidity and set airflow rate of the air conditioning unit 5.

[0050] The vehicle sensor 6 detects the state of the vehicle 10 and outputs a sensor signal representing the state of the vehicle 10 to the data acquisition device 12 via the in-vehicle network 13. For example, the vehicle sensor 6 detects the speed, angular velocity, and acceleration of the vehicle 10.

[0051] The steering wheel 32 is a device operated by the driver 40 and is an example of a device related to the operation of the vehicle 10. The steering wheel 32 also generates a steering signal corresponding to the steering angle set by the driver 40. In addition, the steering wheel 32 outputs the steering signal to the data acquisition device 12, etc., via the in-vehicle network 13 at predetermined intervals.

[0052] The accelerator pedal 33 is a device operated by the driver 40 and is an example of a device related to the operation of the vehicle 10. The accelerator pedal 33 also generates an accelerator signal corresponding to the accelerator opening degree by the driver. In addition, the accelerator pedal 33 outputs the accelerator signal to the data acquisition device 12, etc., via the in-vehicle network 13 at predetermined intervals.

[0053] The brake pedal 34 is a device operated by the driver 40 and is an example of a device related to the operation of the vehicle 10. The brake pedal 34 also generates a brake signal corresponding to the amount of braking performed by the driver. In addition, the brake pedal 34 outputs the brake signal to the data acquisition device 12, etc., via the in-vehicle network 13 at predetermined intervals.

[0054] UI7 is an example of a notification unit that provides notifications to the occupants. UI7 is controlled by a data acquisition device 12, etc., and notifies the driver 40 of information related to the vehicle 10. UI7 has a display device 7a, such as a liquid crystal display or a touch panel, for displaying information. UI7 may also have an acoustic output device (not shown) for notifying the driver 40 of information. UI7 also has an input device, such as a touch panel or operation buttons, for inputting operation information from the driver 40 to the vehicle 10. UI7 outputs the input information to the data acquisition device 12, etc., via the in-vehicle network 13.

[0055] The data acquisition device 12 performs data collection, acquisition, verification, generation, management, and registration processes. To this end, the data acquisition device 12 includes a communication interface (IF) 21, a memory 22, and a processor 23. The communication interface 21, the memory 22, and the processor 23 are connected via a signal line 24. The communication interface 21 has an interface circuit for connecting the data acquisition device 12 to the in-vehicle network 13. For example, a computer can be used as the data acquisition device 12.

[0056] Memory 22 is an example of a storage unit and includes, for example, volatile semiconductor memory and non-volatile semiconductor memory. Memory 22 may further include other storage devices such as a hard disk drive. Memory 22 stores computer programs and various data of applications used in information processing performed by the processor 23. Memory 22 also stores registration table 22a and collected data 22b.

[0057] Registration form 22a registers one or more consenter identification information that identifies consenters who have consented to the provision of data acquired in vehicle 10, associated with a consenter ID representing the consenter. The consenter identification information is registered in registration form 22a, associated with the registration date on which the consenter identification information was registered and the most recent confirmation date on which it was confirmed that the consenter identification information matches the occupant identification information.

[0058] The consenter identification information used to identify each consenter may include one type of information or multiple types of information. Examples of the types of consenter identification information include terminal identification information to identify the consenter's terminal device, the parking location of vehicle 10, country information where vehicle 10 is registered, owner information of vehicle 10, the consenter's biometric information, or the consenter's vehicle operation information. Furthermore, the consenter identification information may include the identification information of only one consenter or the identification information of multiple consenters.

[0059] Figure 5(A) shows an example of registration table 22a. In the example shown in Figure 5(A), registration table 22a registers terminal identification information 102, registration date 103, and confirmation date 104 in association with consentee ID 101. In the example shown in Figure 5(A), registration table 22a registers consentee ID 101 for one consentee. Terminal identification information is an example of consentee identification information. Registration date 103 is the date the terminal identification information was registered in registration table 22a. Confirmation date 104 is the most recent date on which it was confirmed that the consentee identification information matches the crew identification information. In the example shown in Figure 5(A), registration table 22a registers one consentee ID.

[0060] Figure 5(B) shows another example of registration table 22a. Multiple consenter IDs 101 are registered in registration table 22a. Terminal identification information 102, registration date 103, and confirmation date 104 are registered in association with each of the multiple consenter IDs 101. In the example shown in Figure 5(B), multiple consenter IDs are registered in registration table 22a.

[0061] Figure 5(C) shows another example of registration table 22a. In registration table 22a, terminal identification information 102, parking location 105, registration date 103, and confirmation date 104 are registered in association with consentee ID 101. Terminal identification information and parking location are examples of consentee identification information. In the example shown in Figure 5(C), two types of consentee identification information are registered for each consentee ID in registration table 22a.

[0062] If vehicle 10 is owned by an individual, consent identification information identifying one consenting party may be registered. If vehicle 10 is owned by a corporation, or if one vehicle 10 is driven by multiple drivers, multiple consent identification information identifying multiple consenting parties may be registered.

[0063] Terminal identification information includes MAC address (physical address) and application ID. The parking location of vehicle 10 is represented, for example, by latitude and longitude in a world coordinate system. The country information to which vehicle 10 is registered is represented, for example, by a country ID representing the country. The owner information of vehicle 10 is represented, for example, by an owner ID representing the owner. The occupant's biometric information includes, for example, facial feature quantities or weight. The occupant's vehicle operation information includes, for example, the sequence of operations when vehicle 10 is started, the settings of the air conditioning unit 5 (temperature, humidity, airflow), the offset amount from the center of the road, the driving route, and the utilization rate of driver assistance functions (e.g., ACC: Adaptive Cruise Control).

[0064] The collected data 22b acquired in vehicle 10 includes specific data related to the characteristics or behavior of the vehicle occupants and non-specific data not related to the characteristics or behavior of the vehicle occupants. The specific data includes, for example, forward images, surveillance images, occupant biometric information (e.g., facial features and weight), vehicle 10 location information, parking location, terminal identification information, and owner ID. The non-specific data includes, for example, the vehicle 10's speed, angular velocity, acceleration, occupant vehicle operation information (steering signals, accelerator signals, brake signals, etc.), country ID, the sequence of operations when the vehicle 10 is started, the set temperature of the air conditioning unit 5, the offset amount from the center of the road, the driving route, and the utilization rate of the driver assistance function.

[0065] All or part of the functions of the data acquisition device 12 are functional modules implemented by, for example, computer programs running on the processor 23. The processor 23 has, as functional modules, a collection unit 231, an acquisition unit 232, a verification unit 233, a generation unit 234, a management unit 235, and a registration unit 236. The management unit 235 is an example of a data management unit. The functional modules of the processor 23 may also be dedicated arithmetic circuits provided on the processor 23. The processor 23 has one or more CPUs (Central Processing Units) and their peripheral circuits. The processor 23 may further have other arithmetic circuits such as a logic unit, a numerical unit, or a graphics processing unit. The data acquisition device 12 is configured, for example, as an Electronic Control Unit (ECU). The data acquisition device 12 may be composed of multiple ECUs. In this case, the collection unit 231, acquisition unit 232, verification unit 233, generation unit 234, management unit 235, and registration unit 236 may be functional modules implemented in at least partially different ECUs.

[0066] The collection unit 231 collects data according to the information to be collected and stores the collected data 22b in the memory 22.

[0067] Figure 6 is an example of an operation flowchart for the verification process of the data acquisition device 12. The verification process of the data acquisition device 12 will be described below with reference to Figure 6. The data acquisition device 12 executes the verification process shown in Figure 6 at predetermined verification process start timings, such as when the data acquisition device 12 is started, when collection information is transmitted from the server 30 to the vehicle 10, or when a certain amount of collection data 22b is stored in the memory 22 by the collection unit 231.

[0068] First, the acquisition unit 232 acquires occupant identification information (step S201). As described above, occupant identification information is information that corresponds to consenter identification information and is of the same type as consenter identification information. That is, occupant identification information includes, for example, at least one of the following types of information: terminal identification information that identifies the occupant's terminal equipment, the parking location of the vehicle 10, country information in which the vehicle 10 is registered, owner information of the vehicle 10, biometric information of the occupant, and vehicle operation information of the occupant.

[0069] If multiple types of consenter identification information are registered in registration table 22a, the acquisition unit 232 acquires at least one type of consenter identification information and the corresponding occupant identification information. For example, if terminal identification information identifying the consenter's terminal device and the parking position of vehicle 10 are registered as consenter identification information in registration table 22a, the acquisition unit 232 acquires one or both of the terminal identification information and the parking position of vehicle 10 as occupant identification information.

[0070] If there are multiple occupants in the vehicle 10, the acquisition unit 232 may acquire the occupant identification information of each of the multiple occupants. Alternatively, if there are multiple occupants in the vehicle 10, the acquisition unit 232 may acquire the occupant identification information of at least one of the multiple occupants. In this case, it is preferable that the acquisition unit 232 acquires the occupant identification information of at least the driver 40.

[0071] If the crew identification information includes terminal identification information, the acquisition unit 232 acquires the MAC address that identifies the crew member's terminal device, or the application ID, which is information that identifies the consent confirmation application program installed on the crew member's terminal device, as terminal identification information. The acquisition unit 232 communicates with the crew member's terminal device via wireless or wired communication and acquires the terminal identification information from the crew member's terminal device.

[0072] If the occupant identification information includes the parking position of vehicle 10, the acquisition unit 232 acquires the parking position of vehicle 10 based on the output of the positioning information receiving device 4, which is the position where vehicle 10 was parked for a total period of time equal to or greater than the standard time, or the position where vehicle 10 was parked continuously for a period of time equal to or greater than the standard time. The predetermined period can be, for example, 1 to 7 days. The standard time can be, for example, 5 to 12 hours.

[0073] If the occupant identification information includes country information to which the vehicle 10 is registered, the acquisition unit 232 acquires, for example, the country ID stored in the vehicle 10's memory (e.g., the ECU's memory).

[0074] If the occupant identification information includes the owner information of vehicle 10, the acquisition unit 232 accesses an external server, such as server 30, via communication device 3, to acquire the owner ID of vehicle 10 as owner information. The external server stores an ID management table in which the vehicle ID that identifies vehicle 10 and the owner ID are associated and registered. In response to a request from the acquisition unit 232, the external server, for example, refers to the ID management table to acquire the vehicle ID of vehicle 10 and the associated owner ID, and transmits it to the acquisition unit 232. When vehicle 10 is transferred, the owner ID of the new owner is associated with the vehicle ID of vehicle 10 in the ID management table.

[0075] If the occupant identification information includes the occupant's biometric information, the acquisition unit 232 acquires the occupant's facial features as biometric information based on the surveillance image acquired by the surveillance camera 2b. For example, the distance between the left and right eyes and the distance between the nose and mouth can be used as facial features. The acquisition unit 232 may also acquire the occupant's weight as biometric information. In this case, the acquisition unit 232 acquires the occupant's weight based on signals from, for example, seating sensors (not shown) placed in the seats in the passenger compartment 35. If the surveillance camera 2b is capable of acquiring images including the faces of each occupant seated in each seat in the passenger compartment 35, or if seating sensors are placed in each seat in the passenger compartment 35, then biometric information for multiple occupants can be acquired.

[0076] If the occupant identification information includes the occupant's vehicle operation information, the acquisition unit 232 acquires the sequence of operations performed when the vehicle 10 is started as vehicle operation information. For example, the acquisition unit 232 may acquire the sequence of ignition on (power switch on) and fastening the seat belt as the sequence of operations performed when the vehicle 10 is started. Alternatively, the acquisition unit 232 may acquire the sequence of operations performed when the vehicle 10 is started, which may include at least several of the following: ignition on (power switch on), setting the air conditioning system 5, setting the navigation system or sound system, fastening the seat belt, adjusting the seat position, adjusting the direction of the rearview mirror, releasing the parking brake, and shifting gears. Furthermore, the sequence of operations may include operations other than those described above, because the sequence of these operations will differ depending on the occupant. The acquisition unit 232 may also acquire the set temperature, set humidity, or set airflow of the air conditioning system 5 as vehicle operation information. Furthermore, the acquisition unit 232 may acquire the offset amount from the center of the road (lane) when the vehicle 10 is traveling as vehicle operation information. For example, the acquisition unit 232 can identify the left and right lane markings from the forward image, determine the widthwise center position of the vehicle 10 in the forward image based on the internal and external parameters of the forward camera 2a, and calculate the offset amount from the difference between the center of the road determined from the positions of the left and right lane markings and the widthwise center position of the vehicle 10. Internal parameters include information such as focal length, and external parameters include information such as the installation position and mounting direction of the forward camera 2a. Furthermore, the acquisition unit 232 may acquire the travel route of the vehicle 10 within a predetermined period as vehicle operation information. For example, the travel route is acquired as the trajectory of the vehicle 10's position estimated based on the output of the positioning information receiving device 4. Furthermore, the acquisition unit 232 may acquire the utilization rate of driver assistance functions (e.g., ACC, etc.) as vehicle operation information.

[0077] Next, the verification unit 233 compares the crew identification information acquired by the acquisition unit 232 with the consenter identification information registered in the registration table 22a stored in the memory 22, and determines whether the crew identification information matches the consenter identification information (step S202).

[0078] If the consenter identification information and crew identification information include terminal identification information, the verification unit 233 determines whether the terminal identification information obtained by the acquisition unit 232 matches the terminal identification information registered in the registration table 22a.

[0079] If the consenter identification information and occupant identification information include the parking position of vehicle 10, the verification unit 233 determines whether the parking position of vehicle 10 obtained by the acquisition unit 232 matches the parking position of vehicle 10 registered in the registration table 22a. The verification unit 233 may determine that the occupant identification information matches the consenter identification information if the parking position of vehicle 10 obtained by the acquisition unit 232 satisfies predetermined determination conditions. These determination conditions are generated by the generation unit 234 based on the parking position of vehicle 10 registered in the registration table 22a. The process by which the generation unit 234 generates the determination conditions will be described later.

[0080] If the consenter identification information and occupant identification information include country information in which the vehicle 10 is registered, the verification unit 233 determines whether the country ID obtained by the acquisition unit 232 matches the country ID registered in the registration table 22a.

[0081] If the consenter identification information and occupant identification information include the owner information of the vehicle 10, the verification unit 233 determines whether the owner ID obtained by the acquisition unit 232 matches the owner ID registered in the registration table 22a.

[0082] If the consenter identification information and crew identification information include the crew's biometric information, the verification unit 233 determines whether the crew's biometric information acquired by the acquisition unit 232 matches the biometric information registered in the registration table 22a. The verification unit 233 may determine that the crew identification information matches the consenter identification information if the crew's biometric information acquired by the acquisition unit 232 satisfies predetermined determination conditions. These determination conditions are generated by the generation unit 234 based on the biometric information registered in the registration table 22a. The process by which the generation unit 234 generates the determination conditions will be described later.

[0083] If the consenter identification information and occupant identification information include the occupant's vehicle operation information, the confirmation unit 233 determines whether the sequence of operations performed when the vehicle 10 is started, as acquired by the acquisition unit 232, matches the sequence of operations performed when the vehicle 10 is started, as registered in the registration table 22a.

[0084] Furthermore, if the consenter identification information and the occupant identification information include the occupant's vehicle operation information, the verification unit 233 may determine whether the set temperature of the air conditioning unit 5 acquired by the acquisition unit 232 matches the set temperature of the air conditioning unit registered in the registration table 22a. In this case, if the set temperature of the air conditioning unit 5 satisfies predetermined determination conditions, the verification unit 233 may determine that the occupant identification information matches the consenter identification information. These determination conditions are generated by the generation unit 234 based on the set temperature of the air conditioning unit registered in the registration table 22a. The process by which the generation unit 234 generates the determination conditions will be described later.

[0085] Furthermore, if the consenter identification information and occupant identification information include occupant vehicle operation information, the verification unit 233 may determine whether the offset amount from the center of the road when the vehicle 10 is traveling, as acquired by the acquisition unit 232, matches the offset amount registered in the registration table 22a. In this case, if the verification unit 233 satisfies predetermined determination conditions, it considers that the occupant identification information matches the consenter identification information. These determination conditions are generated by the generation unit 234 based on the offset amount registered in the registration table 22a. The process by which the generation unit 234 generates the determination conditions will be described later.

[0086] Furthermore, if the consenter identification information and the occupant identification information include the occupant's vehicle operation information, the verification unit 233 may determine whether the travel route of the vehicle 10 acquired by the acquisition unit 232 matches the travel route of the vehicle registered in the registration table 22a. In this case, for example, if the overlap rate between the travel route of the vehicle 10 acquired by the acquisition unit 232 and the travel route registered in the registration table 22a exceeds a predetermined standard percentage, the verification unit 233 may determine that the occupant identification information matches the consenter identification information. The standard percentage can be, for example, 60% or more.

[0087] Furthermore, if the consenter identification information and occupant identification information include occupant vehicle operation information, the confirmation unit 233 may determine whether the utilization rate of the driver assistance function (e.g., ACC, etc.) acquired by the acquisition unit 232 matches the utilization rate of the driver assistance function registered in the registration table 22a. In this case, the confirmation unit 233 may determine that the occupant identification information matches the consenter identification information if the utilization rate of the driver assistance function acquired by the acquisition unit 232 satisfies predetermined determination conditions. These determination conditions are generated by the generation unit 234 based on the utilization rates of the driver assistance function registered in the registration table 22a. The process by which the generation unit 234 generates the determination conditions will be described later.

[0088] Furthermore, if the consenter identification information and occupant identification information include multiple types of information, the verification unit 233 may determine whether the occupant identification information matches the consenter identification information for each type of information. Therefore, for example, as shown in Figure 5(C), if the consenter identification information and occupant identification information include terminal identification information and parking position, the verification unit 233 may determine whether the occupant identification information and the parking position of the vehicle 10 acquired by the acquisition unit 232 match the terminal identification information and the parking position of the vehicle 10 registered in the registration table 22a, respectively.

[0089] If the occupant identification information matches the consenter identification information (step S202-Yes), the management unit 235 allows the collected data to be provided to an external party of the vehicle 10 and transmits the collected data to the server 30 (step S205). If the collected data 22b is already stored in the memory 22, the management unit 235 transmits the collected data 22b stored in the memory 22 to the server 30. The management unit 235 also transmits to the server 30 any collected data 22b subsequently collected by the collection unit 231 and stored in the memory 22. In this case, the management unit 235 may continue to transmit the collected data 22b collected by the collection unit 231 to the server 30, for example, until the next confirmation process is performed. The registration unit 236 may also register the latest confirmation date on which the consenter identification information matches the occupant identification information in the registration table 22a, associating it with the consenter identification information.

[0090] Furthermore, if the consenter identification information and the occupant identification information include multiple types of information, the management unit 235 may allow the collected data to be provided to the outside of the vehicle 10 and transmit the collected data to the server 30 if the occupant identification information matches the consenter identification information for some of the multiple types of information. Alternatively, the management unit 235 may allow the collected data to be provided to the outside of the vehicle 10 and transmit the collected data to the server 30 if the occupant identification information matches the consenter identification information for all of the multiple types of information.

[0091] If there are multiple occupants in the vehicle 10, the management unit 235 may consider the occupant identification information to match the consenting person identification information if the occupant identification information of each of the multiple occupants matches the consenting person identification information registered in the registration table 22a. Alternatively, if there are multiple occupants in the vehicle 10, the management unit 235 may consider the occupant identification information to match the consenting person identification information if the occupant identification information of one of the multiple occupants (for example, the driver 40) matches the consenting person identification information registered in the registration table 22a.

[0092] On the other hand, if the crew identification information does not match the consenter identification information (step S202-No), the confirmation unit 233 confirms with the crew whether they consent to the provision of the collected data (step S203). If the consenter identification information and the crew identification information include multiple types of information, the confirmation unit 233 may confirm with the crew whether they consent to the provision of the collected data if the crew identification information does not match the consenter identification information for all types of information.

[0093] For example, the confirmation unit 233 uses the UI 7 to visually or audibly confirm with the crew whether or not they consent to the provision of collected data. If visual confirmation is performed, the confirmation unit 233 displays, for example, text or an image on the display device 7a of the UI 7 confirming whether or not they consent to the provision of collected data. If audible confirmation is performed, the confirmation unit 233 outputs, for example, audio information via the UI 7 confirming whether or not they consent to the provision of collected data. The crew inputs a response indicating consent or non-consent to the UI 7 by touch operation, voice input, etc. If a predetermined standard time has elapsed since the confirmation unit 233 requested a response from the crew and no response has been received from the crew, the confirmation unit 233 may consider that the crew does not consent to the provision of collected data.

[0094] If the occupant consents to the provision of collected data (step S203-Yes), the registration unit 236 registers the occupant identification information as consenter identification information in the registration table 22a, associated with the registration date (step S204). As a result, when the same occupant uses the vehicle 10 again in the future, the occupant identification information will match the consenter identification information, and the collected data can be provided to an external party of the vehicle 10 without having to ask the occupant for consent again.

[0095] After step S204, the management unit 235 allows the collected data to be provided to an external party outside the vehicle 10 and transmits the collected data to the server 30 (step S205).

[0096] On the other hand, if the occupant does not consent to the provision of collected data (step S203-No), the management unit 235 discards the collected data (step S206). Specifically, if the collected data 22b is already stored in the memory 22, the management unit 235 erases the collected data 22b stored in the memory 22 and removes the collected data 22b from the vehicle 10. Alternatively, even if the collected data 22b is subsequently collected by the collection unit 231, the management unit 235 may erase the collected data 22b without storing it in the memory 22. Or, the management unit 235 may ensure that the collected data 22 is not collected by the collection unit 231. In this case, the management unit 235 may, for example, erase the collected data 22b without storing it in the memory 22 until the next confirmation process is performed, or ensure that the collected data 22 is not collected by the collection unit 231. This prevents collected data containing personal information, such as specific data, from being leaked outside the vehicle 10. After step S205 or S206, the series of processes ends.

[0097] Based on the above, the management unit 235 transmits the collected data to the server 30 if the crew identification information matches the consenter identification information or if the crew member consents to the provision of the collected data. On the other hand, the management unit 235 does not transmit the collected data to the server 30 if the crew identification information does not match the consenter identification information and the crew member does not consent to the provision of the collected data. Alternatively, the management unit 235 may transmit both specific and non-specific data from the collected data to the server 30 if the crew identification information matches the consenter identification information or if the crew member consents to the provision of the collected data, and transmit only the non-specific data from the collected data to the server 30 if the crew identification information does not match the consenter identification information and the crew member does not consent to the provision of the collected data.

[0098] Next, the process by which the generation unit 234 generates the determination conditions based on the consenter identification information will be explained below with reference to Figure 7.

[0099] The generation unit 234 generates determination conditions based on the consenter identification information registered in the registration table 22a. The generation unit 234 generates determination conditions for each type of consenter identification information (i.e., for the parking position of the vehicle 10, the consenter's biometric information, and the consenter's predetermined vehicle operation information).

[0100] If the identification information of one consentee is included as one type of consentee identification information, the generation unit 234 generates a determination condition based on the identification information of one consentee.

[0101] Furthermore, if one type of consenter identification information includes multiple identification pieces of information for one consenter, or if one type of consenter identification information includes identification pieces of information for multiple consenters, the generation unit 234 generates a determination condition based on the identification pieces of multiple consenters.

[0102] If the consenter identification information is the parking location of vehicle 10 for a single consenter, the generation unit 234 generates a determination condition having a predetermined radius centered on the coordinates representing the parking location of vehicle 10.

[0103] Furthermore, if the consenter identification information is for multiple parking positions of vehicle 10 for one consenter, or if the consenter identification information is for multiple consenters, the generation unit 234 generates a determination condition having a range in which the sum of the distances from the coordinates representing each of the multiple parking positions of vehicle 10 related to the consenter identification information is constant. The fact that the consenter identification information includes identification information for multiple consenters means that it includes multiple identification information for the same consenter, and that it includes the identification information for each of the multiple consenters.

[0104] Figure 7 illustrates the generation of a determination condition. In the example shown in Figure 7, the horizontal axis represents latitude p and the vertical axis represents longitude q. When the consenter identification information is two parking positions A1 and A2 for a vehicle 10 belonging to one consenter, the generation unit 234 generates a determination condition having a range R in which the sum of the distances from the coordinates representing each of the parking positions A1 and A2 is constant.

[0105] Even if the vehicles 10 are parked in the same parking lot, there may be some difference in the measured parking positions. For example, if the vehicles 10 are parked in the same parking lot and their parking positions are measured as points A1 and A2, a determination condition with a range R is generated. If the measured parking position of the vehicle 10 is within range R, it is determined that the driver of the vehicle 10 matches the person corresponding to range R. This allows the generation unit 234 to automatically generate determination conditions that include measurement errors.

[0106] Furthermore, if the consenter identification information consists of parking positions A1 and A2 for the vehicle 10 for multiple consenters, the generation unit 234 may generate a determination condition having a range R in which the sum of the distances from the coordinates representing each of the parking positions A1 and A2 is constant. For example, if a company car is driven by multiple drivers, the determination can be made using a single determination condition, so the determination process can be performed quickly without having to compare the occupant identification information with multiple consenter identification information.

[0107] If the consenter identification information is a single facial feature, the generation unit 234 generates a determination condition that, for example, the distance from the vector representing the facial feature (an arbitrary distance such as Euclidean distance or Manhattan distance) is within a predetermined distance.

[0108] Furthermore, if the consenter identification information consists of multiple facial features of a single consenter, the generation unit 234 generates a determination condition that, for example, has a range in which the sum of the distances from the vectors representing each of the multiple facial features related to the consenter identification information is constant.

[0109] In the example shown in Figure 7, the horizontal axis represents the distance p between the left and right eyes, and the vertical axis represents the distance q between the nose and mouth. When the consenter identification information consists of two facial features A1 and A2, the generation unit 234 generates a determination condition having a range R in which the sum of the distances from the vectors representing points A1 and A2 is constant.

[0110] Even with the same driver, there can be some error in detecting facial features. For example, if the facial features of the same driver are detected as points A1 and A2, these two points are determined to belong to the same driver by generating a determination condition with a range R. This allows the generation unit 234 to automatically generate a determination condition that includes measurement errors.

[0111] Furthermore, if the consenter identification information consists of facial feature quantities for multiple consenters, the generation unit 234 may generate a determination condition that has a range in which the sum of the distances from the vectors representing each of the facial feature quantities of the multiple consenters is constant.

[0112] If the consenter identification information is the weight of one consenter, the generation unit 234 generates a determination condition having a predetermined range, centered on the weight related to the consenter identification information.

[0113] Furthermore, if the consenter identification information consists of multiple weights (different weights measured at different times for one consenter) or the weights of multiple consenters, the generation unit 234 generates, for example, a determination condition having a predetermined range from each of the multiple weights related to the consenter identification information.

[0114] If the consenter identification information is one set temperature for one consenter of the air conditioning unit 5, the generation unit 234 generates a determination condition having a predetermined range centered on the set temperature.

[0115] Furthermore, if the consenter identification information is multiple set temperatures for the air conditioning unit 5 (multiple set temperatures corresponding to one consenter or multiple set temperatures corresponding to multiple consenters), the generation unit 234 generates, for example, a determination condition having a predetermined range from each of the multiple set temperatures.

[0116] If the consenter identification information is a single offset amount from the center of the road for one consenter, the generation unit 234 generates a determination condition having a predetermined range centered on the offset amount.

[0117] Furthermore, if the consenter identification information consists of multiple offset amounts from the center of the road (multiple offset amounts corresponding to one consenter or offset amounts corresponding to multiple consenters), the generation unit 234 generates, for example, a determination condition having a predetermined range from each of the multiple offset amounts.

[0118] If the consenter identification information is the utilization rate of one driver assistance function by one consenter, the generation unit 234 generates, for example, a determination condition having a predetermined range centered on the utilization rate.

[0119] Furthermore, if the consenter identification information is multiple usage rates for the driver assistance function (multiple usage rates corresponding to one consenter or usage rates corresponding to multiple consenters), the generation unit 234 generates, for example, a determination condition having a predetermined range from each of the multiple usage rates.

[0120] If the consenter identification information registered in registration form 22a has not been confirmed to match the occupant identification information for a long period of time, it may be deleted from registration form 22a. This is because there is no need to perform verification processing for consenters who no longer ride in vehicle 10.

[0121] Figure 8 is an example of an operation flowchart for the update process of the data acquisition device 12. The update acquisition process of the data acquisition device 12 will be described below with reference to Figure 8. The data acquisition device 12 executes the update process shown in Figure 8 at update processing times that have a predetermined cycle. The predetermined cycle can be, for example, 6 months or 12 months.

[0122] The management unit 235 executes the processing in steps S302 to S305 for each of the one or more consenter identification information registered in the registration table 22a.

[0123] First, the management unit 235 obtains the latest confirmation date associated with the consenter identification information registered in the registration table 22a (step S302).

[0124] Next, if the current date is more than the specified reference period from the most recent confirmation date (step S303-Yes), the management unit 235 deletes this consenter identification information from the registration table 22a (step S304).

[0125] Next, the generation unit 234 updates the determination criteria for the type of deleted consenter identification information (step S305). The updating of the determination criteria will be described later.

[0126] For each of the one or more consenter identification information registered in registration table 22a, the processes in steps S302 to S305 are executed, and the series of processes is completed.

[0127] Figure 9 illustrates the updating of the judgment criteria. In the example shown in Figure 9, the horizontal axis represents latitude p and the vertical axis represents longitude q. When the consenter identification information is the parking positions A1 and A2 of two vehicles 10, a judgment criterion was generated that has a range R1 in which the sum of the distances from the coordinates representing points A1 and A2 is constant.

[0128] If parking position A2 is deleted, the generation unit 234 generates a new determination condition based on the parking position A1 of the vehicle 10. For example, the generation unit 234 generates a determination condition that has a range R2 with a predetermined radius centered on the parking position A1 of the vehicle 10. This updates the determination condition.

[0129] As detailed above, the data acquisition device of this embodiment can confirm whether or not the occupants have given their consent to provide the data acquired in the vehicle to an external party, while reducing the burden on the occupants.

[0130] In the present invention, the consent confirmation device, consent confirmation computer program, and consent confirmation method of the embodiments described above can be modified as appropriate without departing from the spirit of the invention. Furthermore, the technical scope of the present invention is not limited to those embodiments, but extends to the invention described in the claims and its equivalents.

[0131] For example, in the embodiment described above, the collection unit, acquisition unit, verification unit, generation unit, management unit, and registration unit were located in the vehicle. Of these, the verification unit, generation unit, management unit, and registration unit may be located on a server, while the collection unit and acquisition unit may be located in the vehicle. Figure 10 illustrates another form of the data collection device. The verification unit, generation unit, management unit, and registration unit located on the server cooperate with the collection unit and acquisition unit located in the vehicle to perform the verification process and the like described above. Here, some of the functions of the acquisition unit may be located on the server. For example, if the occupant identification information is the owner information of vehicle 10, the process of accessing an external server and obtaining the owner ID of vehicle 10 may be located on the server.

[0132] Furthermore, in the above-described embodiment, the consent confirmation device (data collection device) checked whether the occupant identification information and the consenting party identification information matched after the collected data had been collected. However, the consent confirmation device may also check whether the occupant identification information and the consenting party identification information match when the provision of collected data is requested from outside the vehicle. If the occupant identification information and the consenting party identification information do not match, the consent confirmation device may then ask the occupant whether or not they consent to the provision of the collected data.

[0133] Furthermore, if the occupant identification information and the consenter identification information do not match, the verification unit may ask the occupant whether they consent to the provision of specific data related to the occupant's characteristics or behavior, and non-specific data not related to the occupant's characteristics or behavior. The management unit may allow the verification unit to provide data to an external party if it has confirmed that the occupant has consented to its provision.

[0134] Furthermore, if the occupant identification information and the consenter identification information do not match, the management unit may allow the provision of non-specific data that is not related to the occupant's characteristics or behavior to an external party without the verification unit confirming with the occupant whether or not they consent to the provision of the collected data.

[0135] Furthermore, in the embodiments described above, when there are multiple consenter identification pieces for one type, the generation unit generates one determination condition based on the multiple consenter identification pieces. However, the generation unit may generate multiple determination conditions based on each of the multiple consenter identification pieces. For example, in the example shown in Figure 7, two determination conditions, indicated by dashed lines, are generated for each of the two consenter identification pieces. In this case, if the crew identification information satisfies either of the two determination conditions, the crew identification information and the consenter identification information are considered to match. [Explanation of Symbols]

[0136] 1. Data Acquisition System 2a Front camera 2b Surveillance camera 3. Communication device 4. Positioning information receiving device 5 Air conditioner 6. Vehicle Sensors 7. User Interface 7a Display device 10 vehicles 12 Data Acquisition Device 21 Communication Interface 22 memory 23 processors 231 Collection Department 232 Acquisition Department 233 Verification Section 234 Generation part 235 Management Department 236 Registration Department 24 signal lines 13. In-vehicle network 30 servers 41 Macrocell base stations 42 Communication Networks

Claims

1. A consent confirmation device characterized by comprising a confirmation unit that confirms with the occupant whether or not they consent to the provision of data when the occupant identification information that identifies the occupant of the vehicle and the consentee identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle do not match.

2. The consent confirmation device according to claim 1, wherein the confirmation unit determines whether the occupant identification information in the vehicle matches the consenter identification information.

3. The system further includes a data management unit for managing the aforementioned data, The consent confirmation device according to claim 1, wherein the data management unit stores the data in the vehicle's storage device until it is determined that the occupant identification information and the consenter identification information match, or until it is confirmed that the occupant has consented to the provision of the data, but does not provide the data to the outside of the vehicle.

4. The consent confirmation device according to claim 3, wherein the data management unit discards the data if the crew identification information and the consenter identification information do not match and the crew member has not consented to the provision of the data.

5. The consent confirmation device according to claim 1, wherein if the crew identification information satisfies the determination conditions generated based on the consenter identification information, the confirmation unit determines that the crew identification information and the consenter identification information are a match.

6. The consent confirmation device according to claim 5, wherein the consent-identifying information includes the identification information of multiple consent-holders, and further comprises a generation unit that generates the determination conditions based on the identification information of multiple consent-holders.

7. The consent confirmation device according to claim 1, wherein the consent-person identification information includes terminal identification information that identifies the consent-person's terminal, the parking location of the vehicle, country information in which the vehicle is registered, owner information of the vehicle, biometric information of the consent-person, or vehicle operation information of the consent-person.

8. The consent confirmation device according to claim 1, wherein the data acquired in the vehicle includes specific data that identifies the occupant.

9. The consent confirmation device according to any one of claims 1 to 8, further comprising a registration unit that registers the crew identification information as the consenting party identification information when the confirmation unit confirms that the crew has consented to the provision of the data.

10. A confirmation unit that, when the occupant identification information that identifies the occupants of the vehicle does not match the consenter identification information that identifies the consenter who has consented to the provision of data acquired in the vehicle, confirms with the occupant whether or not they consent to the provision of the data, If the occupant identification information and the consenting party identification information match, a data management unit provides the data to an external party of the vehicle. A consent confirmation device characterized by comprising:

11. If the occupant identification information that identifies the occupants of the vehicle does not match the consenter identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle, the occupant is asked whether or not they consent to the provision of the data. A computer program for confirming consent, characterized by causing a processor to perform a process that includes the following.

12. A consent confirmation method performed by a computer, If the occupant identification information that identifies the occupants of the vehicle does not match the consenter identification information that identifies the consentee who has consented to the provision of data acquired in the vehicle, the occupant is asked whether or not they consent to the provision of the data. A method for confirming consent, characterized by including the following:

Images