Servers, systems, information processing methods, and computer programs

Abstract

This will allow us to prevent the sharing of past data with external parties when the user has not consented to sharing their data with external parties. [Solution] The server 5, which can communicate with the vehicle 2, includes a transmission control unit 533 that controls the transmission from the vehicle to the server of data previously acquired by the vehicle, based on information received from the vehicle, and whether or not the vehicle user consented to the provision of the data to an external party at the time the data was acquired by the vehicle.

Description

Technical Field

[0004] , , , , , , ,

[0006] , , , ,

[0005] , , , , , ,

[0001] The present disclosure relates to a server, a system, an information processing method, and a computer program.

Background Art

[0002] Conventionally, regarding providing data acquired during driving by a vehicle to an external device, when the driver gives consent, the data is transmitted to the external device, and when the driver does not give consent, the data is not transmitted to the external device (Patent Document 1).

[0003] In particular, in the information processing apparatus described in Patent Document 1, for each driver and each data type, the presence or absence of consent regarding data transmission is stored in the storage unit of the vehicle, and only the data for which consent exists is transmitted to the external device.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] By the way, in the information processing apparatus described in Patent Document 1, for each driver and each data type, the presence or absence of the current consent regarding data transmission is stored. Therefore, once the driver gives consent, all the data acquired in the past can be provided to the external device. That is, even if there is a period during which the driver has not consented to the data provision, there is a possibility that the data acquired during that period is also provided to the external device.

[0006] In view of the above problems, an object of the present disclosure is to be able to prevent past data from being provided externally when the user has not consented to the external provision of the data. [Means for solving the problem]

[0007] The gist of this disclosure is as follows:

[0008] (1) A server capable of communicating with the vehicle, A server comprising a transmission control unit that controls the transmission from the vehicle to the server of data previously acquired by the vehicle, based on information received from the vehicle, whether or not the user of the vehicle consented to the provision of the data to an external party at the time the data was acquired by the vehicle. (2) The system further includes a storage control unit that stores in the storage unit consent information indicating whether the user of the vehicle had previously consented to the provision of data acquired by the vehicle to an external party, based on the information received from the vehicle. The transmission control unit controls the transmission of data previously acquired in the vehicle to the server, based on the consent information, as described in (1) above. (3) The consent information includes consent period information relating to the period during which the user of the vehicle consented to the provision of data acquired by the vehicle to an external party, as described in (2) above. (4) The transmission control unit controls the transmission of data previously acquired in the vehicle to the server, when the conditions for reading data from the vehicle are met, and is the server according to any one of (1) to (3) above. (5) The server described in (4) above, wherein the transmission control unit controls the transmission of the data from the vehicle to the server based on whether the user of the vehicle consented to providing the data to an external party at the time the data was acquired by the vehicle, and whether the user of the vehicle consented to providing the data to an external party when the data reading condition is met. (6) The transmission control unit prevents the vehicle from transmitting regulatory data, which is at least a part of the data, to the server if the user of the vehicle has not consented to providing the data to an external party at the time the data is acquired, as described in any one of (1) to (5) above. (7) The transmission control unit, if the user of the vehicle has not consented to providing the data to an external party at the time the data is acquired, will process the regulatory data, which is at least a part of the data, to reduce the accuracy of the information and then transmit it from the vehicle to the server, as described in any one of (1) to (5) above. (8) The transmission control unit, if the user of the vehicle has consented to providing the data to an external party at the time the data is acquired, causes the vehicle to transmit the data, including the regulatory data, to the server as described in (6) or (7) above. (9) The transmission control unit prevents the vehicle from transmitting the regulated data to the server if, even if the vehicle user has consented to providing the data to an external party at the time the data is acquired, the vehicle user has not consented to providing the data to an external party when the conditions for reading data from the vehicle are met, as described in (6) or (7) above. (10) The transmission control unit, even if the user of the vehicle has consented to providing the data to an external party at the time the data is acquired, if the user of the vehicle has not consented to providing the data to an external party when the conditions for reading data from the vehicle are met, will cause the vehicle to process the regulated data in a way that reduces the accuracy of the information and then transmit it to the server as described in (6) or (7) above. (11) The transmission control unit causes the vehicle to transmit the data, including the regulatory data, to the server as described in (9) or (10) above, if the user of the vehicle has consented to providing the data to an external party at the time the data is acquired, and the user of the vehicle has consented to providing the data to an external party when the conditions for reading data from the vehicle are met. (12) The server described in (7) or (10) above, which performs processing that reduces the accuracy of the information, including processing that anonymizes the privacy information contained in the regulated data. (13) The server described in any one of (6) to (12) above, which includes the privacy information of the user of the vehicle or any person who was around the vehicle at the time the data was acquired. (14) The data reading conditions include any one of the conditions in (4), (5) and (9) to (11) above, which include conditions that are met periodically. (15) A server according to any one of (4), (5), (9) to (11), and (14) above, wherein the data reading conditions include conditions that are met when a predetermined incident occurs in the vehicle. (16) A system including a server described in any one of (1) to (15) above and a vehicle capable of communicating with the server, The vehicle is a system that includes an information management unit that transmits to the server information regarding whether or not the user of the vehicle has consented to the provision of data to an external party. (17) The information management unit transmits to the server information indicating that the consent status of the vehicle user has been changed when the consent status of the user has been changed. (18) A system including the server described in (3) above and a vehicle capable of communicating with the server, The vehicle includes a vehicle storage control unit that, when storing data acquired by the vehicle in the vehicle storage unit, also stores data representing the time the data was acquired in the vehicle storage unit. The system includes a data transmission unit that transmits data representing the time the aforementioned data was acquired to the server, The transmission control unit determines, based on the consent period information and data representing the time of transmission from the vehicle, whether the user of the vehicle had consented to the provision of the data to an external party at the time the data was acquired by the vehicle. (19) An information processing method performed on a server capable of communicating with a vehicle, An information processing method including controlling transmission of data acquired in the past by the vehicle to the server from the vehicle by referring to information received from the vehicle and based on whether or not the user of the vehicle agreed to provide the data externally at the time when the data was acquired by the vehicle. (20) A computer program executed in a server communicable with a vehicle, causing the computer of the server to control transmission of data acquired in the past by the vehicle to the server from the vehicle by referring to information received from the vehicle and based on whether or not the user of the vehicle agreed to provide the data externally at the time when the data was acquired by the vehicle.

Effect of the Invention

[0009] According to the present disclosure, it is possible not to provide past data when the user has not agreed to provide the data externally.

Brief Description of the Drawings

[0010] [Figure 1] FIG. 1 is a schematic configuration diagram of a data collection system. [Figure 2] FIG. 2 is a schematic configuration diagram of a vehicle. [Figure 3] FIG. 3 is a configuration diagram showing the configuration of an ECU. [Figure 4] FIG. 4 is a diagram showing an example of accumulated data stored in a vehicle storage unit by a vehicle storage control unit. [Figure 5] FIG. 5 is a configuration diagram showing the configuration of a server. [Figure 6] FIG. 6 is an example of consent period information stored in a server storage unit by a consent information storage control unit. [Figure 7] FIG. 7 is a flowchart showing the flow of change notification processing. [Figure 8] FIG. 8 is a flowchart showing the flow of vehicle storage processing. [Figure 9]FIG. 9 is an operation sequence diagram regarding communication between a vehicle and a server. [Figure 10] FIG. 10 is a flowchart showing the flow of transmission control processing. [Figure 11] FIG. 11 is a flowchart similar to FIG. 10 showing the flow of transmission control processing according to a modified example. [Figure 12] FIG. 12 is a diagram similar to FIG. 4 showing an example of accumulated data stored in a vehicle storage unit by a vehicle storage control unit in the second embodiment. [Figure 13] FIG. 13 is a flowchart similar to FIG. 10 showing the flow of transmission control processing according to the second embodiment.

Mode for Carrying Out the Invention

[0011] Hereinafter, embodiments will be described in detail with reference to the drawings. In the following description, the same reference numerals are assigned to similar components.

[0012] First Embodiment <Configuration of Data Collection System> First, referring to FIG. 1, the configuration of a data collection system 1 according to the first embodiment will be described. FIG. 1 is a schematic configuration diagram of the data collection system 1 according to the first embodiment. The data collection system 1 collects data acquired by the vehicle 2 to the server 5.

[0013] As shown in Figure 1, the data collection system 1 comprises multiple communication-enabled vehicles 2 and a server 5. The server 5 is an example of an external device located outside the vehicles 2. Each of the multiple vehicles 2 and the server 5 are configured to communicate with each other via a communication network 6, which consists of optical communication lines or the like, and a wireless base station 7 connected to the communication network 6 via a gateway (not shown). Various wide-area wireless communication methods with long communication distances can be used for communication between the vehicles 2 and the wireless base station 7. Specifically, such communication can be compliant with any communication standard such as 4G, LTE, 5G, or WiMAX, which have been established by 3GPP and IEEE (both registered trademarks).

[0014] In this embodiment, the data collection system 1 collects data from a large number of vehicles 2 while each vehicle 2 is in motion. The collected data is used as big data to provide various services. Specifically, the collected data can be used, for example, as training data for autonomous driving or to analyze the driving of a large number of vehicles 2.

[0015] <Vehicle Configuration> Next, with reference to Figure 2, the configuration of Vehicle 2 will be described. Each Vehicle 2 may be a vehicle operated manually by a driver, a vehicle that can receive driving assistance from its ECU, or a vehicle that is driven autonomously by its ECU.

[0016] In this embodiment, when any incident occurs, the vehicle 2 stores data detected by its sensors and, based on a request from the server 5, transmits at least a portion of the stored data to the server 5.

[0017] Figure 2 is a schematic diagram of the vehicle 2. In this embodiment, the vehicle 2 has a plurality of sensors 10, a human-machine interface (hereinafter referred to as "HMI") 20, an external communication module 25, and an electronic control unit (hereinafter referred to as "ECU") 30. These components of the vehicle 2 are connected to each other in a way that allows communication, for example, via an in-vehicle network 26 that conforms to a standard such as CAN (Controller Area Network), or they are connected directly via signal lines.

[0018] Sensor 10 detects various types of information related to the vehicle 2 (including information related to the occupants of the vehicle 2, and information related to the environment or conditions surrounding the vehicle 2) and generates corresponding data. Sensor 10 includes, for example, an exterior camera 11, an interior camera 12, a distance measuring sensor 13, a positioning sensor 14, a microphone 15, a driving state sensor 16, and a driver operation sensor 17.

[0019] The exterior camera 11 is a sensor that captures images of the area around the vehicle 2 and generates data representing the image of the area around the vehicle 2. In this embodiment, the exterior camera 11 captures images of the area in front of the vehicle 2. The interior camera 12 is a sensor that captures images of the interior of the vehicle 2 and generates data representing the image of the interior of the vehicle 2. In this embodiment, the interior camera 12 captures images of the user of the vehicle 2 (the occupants of the vehicle 2, especially the driver). The distance measuring sensor 13 is a sensor that measures the distance to objects present around the vehicle 2, especially objects present in front of the vehicle 2, and generates data representing the distance to such objects. The distance measuring sensor 13 is, for example, a radar such as a millimeter-wave radar, a LiDAR, or a sonar.

[0020] The positioning sensor 14 is a sensor that measures the vehicle's own position and generates data representing the vehicle's own position. The positioning sensor 14 is, for example, a GNSS receiver. The microphone 15 is a sensor that detects sound and generates data representing the sound. The microphone 15 detects sound from inside or outside the vehicle 2.

[0021] The driving state sensor 16 is a sensor that detects the driving state of the vehicle 2 and generates data representing the driving state. The driving state sensor 16 detects, for example, the speed, acceleration, and yaw rate (rate of change of yaw angle during turning) of the vehicle 2. The driver operation sensor 17 is a sensor that detects the operation status of the vehicle 2's controls (for example, the accelerator pedal, brake pedal, and steering wheel) by the driver and generates data representing the operation status of the controls. The driver operation sensor 17 includes, for example, an accelerator sensor that detects the amount the accelerator pedal is pressed, a brake sensor that detects the amount the brake pedal is pressed, and a steering sensor that detects the steering angle of the steering wheel.

[0022] Each sensor 10 generates data at predetermined intervals and outputs the generated data to the ECU 30 at predetermined intervals via the in-vehicle network 26. In this way, various data is acquired in vehicle 2 by the sensors 10.

[0023] Furthermore, sensor 10 may include other sensors that detect various types of information related to vehicle 2. For example, sensor 10 may include a grip sensor that detects whether or not the driver is gripping the steering wheel, a rotational speed sensor that detects the rotational speed of the prime mover (engine or electric motor), an air pressure sensor that detects the air pressure of the vehicle 2's tires, and a wheel speed sensor that detects the speed of the vehicle 2's wheels.

[0024] The HMI 20 is a user interface for information exchange between the ECU 30 of the vehicle 2 and the passengers of the vehicle 2. The HMI 20 has an input device 21 for receiving inputs from the passengers of the vehicle 2 and an output device 22 for notifying the passengers of the vehicle 2. The input device 21 is a device that receives physical or voice operations by the passengers as inputs, and includes, for example, at least one of a touch panel, a switch, a button, a microphone 15, etc. On the other hand, the output device 22 is a device that notifies the passengers through the five senses of the passengers (e.g., vision, hearing, touch, etc.), and includes, for example, at least one of a display device (e.g., a liquid crystal display, a head-up display, a warning light, etc.), a speaker, a vibration unit, etc.

[0025] The HMI 20 transmits the input data received from the passengers via the input device 21 to the ECU 30 via the in-vehicle network 26. Also, the HMI 20 notifies the passengers via the output device 22 of the information corresponding to the signal received from the ECU 30 via the in-vehicle network 26.

[0026] The out-vehicle communication module 25 communicates with out-vehicle devices. The out-vehicle communication module 25 is a device that wirelessly communicates with a radio base station 7 in accordance with a predetermined mobile communication standard. For example, the out-vehicle communication module 25 transmits the data generated by each of the sensors 10 of the vehicle 2 to the server 5 via the radio base station 7. Also, the out-vehicle communication module 25 receives the data transmitted from the server 5 via the radio base station 7 and transmits it to the ECU 30.

[0027] <Configuration of the ECU> Next, the configuration and operation of the ECU 30 will be described with reference to Figure 3. Figure 3 is a configuration diagram showing the configuration of the ECU 30. In this embodiment, the ECU 30 transmits at least a portion of the data generated by the vehicle 2's sensor 10 to the server 5. In the example shown in Figures 2 and 3, the vehicle 2 is equipped with one ECU 30, but it may be equipped with multiple ECUs separated by function. As shown in Figure 3, the ECU 30 has a communication interface 31, a vehicle storage unit 32, and a vehicle processor 33. Note that the communication interface 31, the vehicle storage unit 32, and the vehicle processor 33 may be separate circuits, or they may be configured as a single integrated circuit.

[0028] The communication interface 31 has a circuit for connecting the ECU 30 to the in-vehicle network 26, etc. The communication interface 31 transmits signals received from the input devices 21 of the sensor 10 and HMI 20 to the vehicle processor 33. The communication interface 31 also transmits signals received from the vehicle processor 33 to the external communication module 25 and the output devices 22 of the HMI 20.

[0029] The vehicle storage unit 32 is a device for storing data and is a non-temporary storage medium. The vehicle storage unit 32 includes, for example, at least one of volatile semiconductor memory (e.g., RAM), non-volatile semiconductor memory (e.g., ROM), a hard disk drive (HDD), and a solid-state drive (SSD). The vehicle storage unit 32 stores computer programs executed by the vehicle processor 33. The vehicle storage unit 32 also stores various types of data, such as data containing identification information of the vehicle 2 and data received from the sensor 10.

[0030] The vehicle processor 33 has one or more CPUs (Central Processing Units) and their peripheral circuits. The vehicle processor 33 may further have other arithmetic circuits such as a logic unit, a numerical unit, or a graphics processing unit. The vehicle processor 33 executes computer programs stored in the vehicle storage unit 32.

[0031] As shown in Figure 3, the vehicle processor 33 comprises a driver identification unit 331, an information management unit 332, a vehicle memory control unit 333, and a data transmission unit 334. Each of these units of the vehicle processor 33 is, for example, a functional module realized by a computer program running on the vehicle processor 33. Alternatively, each unit of the vehicle processor 33 may be implemented in the ECU 30 as an independent integrated circuit, microprocessor, or firmware.

[0032] ≪Driver Identification Section≫ The driver identification unit 331 identifies the user of vehicle 2, particularly the driver of vehicle 2. In this embodiment, the driver identification unit 331 identifies the driver based on images generated by the in-vehicle camera 12, especially images of the driver. Specifically, the driver identification unit 331 extracts feature quantities about the current driver by inputting, for example, an image of the driver into an encoder. If the distance between the feature quantities extracted in this way and the feature quantities extracted from previously captured images of the driver is less than or equal to a certain distance, the driver identification unit 331 identifies the two drivers as the same person.

[0033] When the driver identification unit 331 identifies the driver of vehicle 2, it transmits information about the current driver of the identified vehicle 2 to the information management unit 332.

[0034] ≪Information Management Department≫ The information management unit 332 sends information to the server 5 regarding whether the user of vehicle 2 has currently consented to the provision of data acquired by vehicle 2 to external parties. By sending this information regarding the consent of the user of vehicle 2 to the server 5, the server 5 can appropriately determine whether the user has consented to the provision of data to external parties.

[0035] In this embodiment, the information management unit 332, at any time, asks the user of vehicle 2, via the output device 22 of the HMI 20, whether or not they consent to providing data to an external party. Such an inquiry may be made, for example, by displaying the inquiry on the display device of vehicle 2, or by outputting an audio message representing the inquiry from the speaker. The information management unit 332 makes such an inquiry, for example, when vehicle 2 is started (for example, when the ignition switch is turned ON) or when a driver gets into the driver's seat of vehicle 2. The information management unit 332 may also make such an inquiry at other times, for example, when any incident occurs.

[0036] Furthermore, the information management unit 332 receives input from the user of vehicle 2 regarding whether or not they consent to the provision of data to external parties. User input is performed via the input device 21 of the HMI 20. For example, information is entered by the user operating a touch panel or button in response to an inquiry displayed on the display device of vehicle 2. Alternatively, information is entered by the user operating the input device at a time unrelated to any inquiry to the user.

[0037] When the information management unit 332 receives consent information from the user of vehicle 2, it retains the entered consent information. Therefore, if the user of vehicle 2 enters information indicating consent to the provision of data to an external party, the information indicating consent is retained thereafter. If the user of vehicle 2 then enters information indicating that they do not consent to the provision of data to an external party, the information indicating that they do not consent is retained thereafter.

[0038] In particular, in this embodiment, the information management unit 332 maintains information regarding input consent for each user. Specifically, the information management unit 332 maintains information regarding consent for each driver identified by the driver identification unit 331. However, the information management unit 332 may maintain information regarding input consent independently of the user. In this case, the information management unit 332 queries whether or not the user consents to providing the data to an external party each time the user changes. Also, in this case, the vehicle processor 33 does not need to include the driver identification unit 331.

[0039] In addition, when the consent status of the user of vehicle 2 changes, the information management unit 332 sends information to the server 5 indicating that the consent status has changed. This allows for the appropriate transmission of information about the user's consent status to the server 5 while minimizing the amount of data transmitted from vehicle 2 to the server 5.

[0040] For example, when the consent status changes, the information management unit 332 sends information about the user's consent after the change to the server 5. Specifically, if the information management unit 332 has information that a certain user consents to the provision of data to external parties, and then receives input that the user does not consent to the provision of data to external parties, the information management unit 332 sends information to the server 5 indicating that the user's consent status has changed from consented to not consented.

[0041] ≪Vehicle Memory Control Unit≫ The vehicle memory control unit 333 controls the storage of data acquired by the vehicle 2 into the vehicle memory unit 32. In this embodiment, the vehicle memory control unit 333 controls which data generated by the vehicle 2's sensor 10 is to be stored in the vehicle memory unit 32.

[0042] In this embodiment, when a predetermined incident occurs, the vehicle memory control unit 333 stores data generated by the sensor 10 before and after the incident in the vehicle memory unit 32. A predetermined incident includes, for example, sudden acceleration exceeding a predetermined acceleration, sudden braking exceeding a predetermined braking force, sudden steering exceeding a predetermined steering speed, a sudden change in the driver's physical condition, the cancellation of the driver assistance system when driver assistance is provided by the vehicle 2, and the pressing of the SOS switch when the vehicle 2 is equipped with an SOS switch. In addition to these situations, or in place of these situations, the predetermined incident may also include other situations.

[0043] Therefore, when the vehicle memory control unit 333 detects, for example, an acceleration of vehicle 2 exceeding a predetermined acceleration by the driving state sensor 16, it stores the data generated by the sensor 10 before and after such acceleration detection in the vehicle memory unit 32. By storing data in the vehicle memory unit 32 only when a specific incident occurs, it is possible to obtain the necessary data while keeping the amount of data stored in the vehicle memory unit 32 small.

[0044] In particular, in this embodiment, when a predetermined incident occurs, the vehicle memory control unit 333 stores in the vehicle memory unit 32 data representing images generated by the external camera 11 and the internal camera 12, data representing the vehicle's own position generated by the positioning sensor 14, and data representing audio generated by the microphone 15, before and after the incident. In addition, each time a predetermined incident occurs, the vehicle memory control unit 333 stores in the vehicle memory unit 32 data including identification information of the vehicle 2.

[0045] In addition, in this embodiment, when a predetermined incident occurs, the vehicle memory control unit 333 stores in the vehicle memory unit 32 data representing the driving state generated by the driving state sensor 16 and data representing the operation status of the control device generated by the driver operation sensor 17, both before and after the incident occurred.

[0046] Furthermore, in this embodiment, the vehicle memory control unit 333 stores in the vehicle memory unit 32 data representing the time when the data was acquired, in addition to the data acquired by the vehicle 2. This allows the server 5 to determine whether or not the user consented to each piece of data acquired in the past at the time the data was acquired by the vehicle 2.

[0047] Figure 4 shows an example of stored data stored in the vehicle memory unit 32 by the vehicle memory control unit 333. As shown in Figure 4, various data acquired before and after an incident occurs are stored linked to a single data ID. For example, in the example shown in Figure 4, the stored data with data ID 1 includes data generated by various sensors 10 when the driving state sensor 16 detects a sudden steering maneuver exceeding a predetermined steering speed.

[0048] As shown in Figure 4, one stored data set includes data containing vehicle identification information (identification data), image data, self-position data, and driving status data. In addition, one stored data set includes other data acquired by sensor 10, such as voice data and data indicating the operation status of the control device. Furthermore, one stored data set includes data indicating the time the data was acquired (time data).

[0049] In the above embodiment, the vehicle memory control unit 333 stores data generated by the sensor 10 before and after an incident in the vehicle memory unit 32 when a predetermined incident occurs. However, the vehicle memory control unit 333 may store data generated by the sensor 10 in the vehicle memory unit 32 regardless of an incident. For example, the vehicle memory control unit 333 may always store data generated by the sensor 10 in the vehicle memory unit 32, or it may store data generated by the sensor 10 in the vehicle memory unit 32 when any predetermined condition is met.

[0050] ≪Data Transmission Section≫ The data transmission unit 334 transmits the data stored in the vehicle storage unit 32 of the vehicle 2 to the server 5. In this embodiment, when the data transmission unit 334 receives a data read request signal from the server 5, it transmits to the server 5 data representing the time when each of the multiple stored data stored in the vehicle storage unit 32 was acquired. For example, when stored data is stored in the vehicle storage unit 32 shown in Figure 4, the vehicle storage unit 32 transmits the time data for data IDs 1, 2, 3, ... to the server 5. As a result, the server 5 can easily determine whether the user of the vehicle 2 consented to the provision of the data to an external party when the data was acquired by referring to the data representing the time when each stored data was acquired in conjunction with the consent period information described later.

[0051] Furthermore, the data read request signal may include information about the type of data to be read. For example, the data read request signal may include information indicating that data related to a specific incident is being requested. Therefore, for example, if a data read request signal is received for an emergency braking incident, the data transmission unit 334 will send the time data of the stored data with data IDs 2 and 3 to the server 5 in the example shown in Figure 4, but will not send the time data of the stored data with data ID 1 to the server 5.

[0052] Furthermore, when the data transmission unit 334 receives a signal from the server 5 (in particular the transmission control unit 533 of the server 5, which will be described later) that instructs it to transmit specific stored data, it transmits the specific stored data to the server 5 in accordance with that instruction.

[0053] <Server Configuration> Next, the configuration of server 5 will be described with reference to Figure 5. Figure 5 is a configuration diagram showing the configuration of server 5. Server 5 controls the transmission of data to server 5 by multiple vehicles 2 that can communicate via the communication network 6. Server 5 also receives data acquired by multiple vehicles 2 that can communicate via the communication network 6. The data received by server 5 in this manner is used as training data for autonomous driving or to analyze the driving of multiple vehicles 2.

[0054] In this embodiment, the server 5 comprises an external communication module 51, a server storage unit 52, and a server processor 53. The external communication module 51 and the server storage unit 52 are connected to the server processor 53 via signal lines. The server 5 may further include input devices such as a keyboard and mouse, and output devices such as a display and speakers. The server 5 may also be composed of multiple computers.

[0055] The external communication module 51 communicates with devices outside the server 5. The external communication module 51 has an interface circuit for connecting the server 5 to the communication network 6. The external communication module 51 is configured to communicate with the vehicle 2 via the communication network 6 and the wireless base station 7.

[0056] The server storage unit 52 is a device for storing data and is a non-temporary storage medium. The server storage unit 52 has at least one of the following: volatile semiconductor memory, non-volatile semiconductor memory, HDD, or SSD. The server storage unit 52 stores computer programs executed by the server processor 53. In addition, the server storage unit 52 stores various data, including data received from the vehicle 2.

[0057] The server processor 53 has one or more CPUs and their peripheral circuits. The server processor 53 may further have other arithmetic circuits such as a logic unit, a numerical unit, or a graphics processing unit. The server processor 53 executes computer programs stored in the server storage unit 52.

[0058] As shown in Figure 5, the server processor 53 comprises a consent information storage control unit 531, a data request unit 532, a transmission control unit 533, and a data storage control unit 534. Each of these components of the server processor 53 is a functional module implemented, for example, by a computer program running on the server processor 53.

[0059] The consent information storage control unit 531 stores consent information in the server storage unit 52 based on the information received from vehicle 2, indicating whether or not the user of vehicle 2 had previously consented to the provision of data acquired by vehicle 2 to an external party. In this embodiment, the consent information storage control unit 531 stores consent period information in the server storage unit 52 regarding the period during which the user of vehicle 2 consented to the provision of data to an external party. In particular, the consent information storage control unit 531 stores consent period information in the server storage unit 52 based on consent information for each vehicle and each user.

[0060] Specifically, in this embodiment, based on the consent information transmitted from the information management unit 332 of each vehicle 2, whenever the consent status of the user of vehicle 2 changes, the consent information storage control unit 531 stores the change in consent status as synchronization period information in the server storage unit 52, for example, when the consent information received from vehicle 2 changes from information indicating consent to information indicating non-consent, or vice versa.

[0061] Figure 6 shows an example of consent period information stored in the server storage unit 52 by the consent information storage control unit 531. As shown in Figure 6, in this embodiment, the consent period information includes the identification information of the vehicle 2 (vehicle ID), the time, and the change in the consent status. This makes it possible to understand from the consent period information the period during which each vehicle 2 user consented to the provision of data to external parties and the period during which they did not consent.

[0062] Furthermore, the consent period information can be stored in any manner as long as it allows us to understand the periods during which each vehicle 2 user consented to the provision of data to external parties and the periods during which they did not consent. Therefore, the consent period information may include, for example, the start and end times of the period during which the user of vehicle 2 consented to the provision of data to external parties, and the start and end times of the period during which the user of vehicle 2 did not consent to the provision of data to external parties.

[0063] The data request unit 532 transmits a data read request signal to each vehicle 2 when a predetermined data read condition is met. The data read condition is, for example, a condition that is met periodically (for example, at regular time intervals). This allows the server 5 to periodically receive data acquired by each vehicle 2.

[0064] Furthermore, the data retrieval condition may be, for example, a condition that is met when a predetermined incident occurs in vehicle 2. Specifically, the data retrieval condition may be a condition that is met when a signal indicating that an incident has occurred is received from vehicle 2. In this case, the ECU 30 of each vehicle 2 sends a signal to the server 5 indicating that an incident has occurred when a predetermined incident occurs. By sending data each time an incident occurs in this way, the data required by the server 5 can be quickly provided to the server 5. Alternatively, the data request unit 532 sends a data retrieval request signal to each vehicle 2 when, for example, an analyst needs data to perform an analysis on the operation of vehicle 2, etc., and the analyst operates the input device of the server 5.

[0065] In this embodiment, the data read request signal includes information about the type of data to be read. For example, the data read request signal includes information indicating that data relating to a specific incident is being requested. Therefore, for example, the data request unit 532 transmits a data read request signal when an emergency braking incident occurs, and in this case, the data transmission unit 334 of the vehicle 2 transmits time data of stored data, for example, in the example shown in Figure 4, where the data IDs are 2 and 3, to the server 5.

[0066] ≪Transmission Control Unit≫ The transmission control unit 533 controls the transmission of data previously acquired by the vehicle 2 to the server 5. Specifically, in this embodiment, the transmission control unit 533 sends a signal to the vehicle 2 instructing it to transmit specific data from the stored data generated by the sensor 10 in the vehicle 2 and stored in the vehicle storage unit 32, in the form of a specified data.

[0067] In this embodiment, the transmission control unit 533 refers to the information received from the vehicle 2 and controls the transmission of the data to the server 5 based on whether the user of the vehicle 2 (driver or occupant) consented to providing the data to the outside of the vehicle 2 at the time the data was acquired by the vehicle 2. By controlling the transmission to the server 5 based on whether the user consented to providing the data to the outside at the time the data was acquired, the provision of past data to the outside when the user did not consent to providing the data to the outside is suppressed. Furthermore, if past data to the outside of the vehicle 2 when the user did not consent to providing the data to the outside is provided, the user will prohibit the provision of all past data to the outside of the vehicle 2 in order to prevent the provision of past data. However, by controlling the transmission to the server 5 based on the consent status at the time the data was acquired, the user will be prevented from prohibiting the provision of all past data to the outside of the vehicle 2 even when the user is willing to provide some of the past data to the outside of the vehicle 2.

[0068] In this embodiment, the transmission control unit 533 controls the transmission of data acquired by the vehicle 2 to the server 5 based on consent information stored in the server storage unit 52. Therefore, the server 5 can control the transmission of data acquired by the vehicle 2 to the server 5 based on the information stored in the server storage unit 52. In particular, in this embodiment, the transmission control unit 533 controls the transmission of data to the server 5 based on consent period information and data representing the time each data was acquired. Since the capacity of the consent period information and the data representing the time each data was acquired is relatively small, the transmission of data acquired by the vehicle 2 to the server 5 can be controlled by receiving only the minimum amount of data from the vehicle 2.

[0069] Specifically, in this embodiment, if the transmission control unit 533 determines that the user of vehicle 2 did not consent to providing the data to an external party at the time the data was acquired by vehicle 2, it will not transmit the restrictive data, which is part of that data, to the server 5. Therefore, in this embodiment, in such a case, the transmission control unit 533 will transmit the data other than the restrictive data to the server 5. On the other hand, if the transmission control unit 533 determines that the user of vehicle 2 consented to providing the data to an external party at the time the data was acquired by vehicle 2, it will transmit all of that data (including the restrictive data) to the server 5.

[0070] In this embodiment, the regulatory data is data that includes the privacy information of the user of vehicle 2 or people who were around vehicle 2 at the time the data was acquired. On the other hand, in this embodiment, data other than the regulatory data is data that does not include such privacy information.

[0071] Therefore, the regulatory data includes, for example, data containing identification information of vehicle 2 (e.g., vehicle identification number (VIN)). The data containing identification information of vehicle 2 is stored in the vehicle storage unit 32 at the time of manufacture or registration of vehicle 2. The regulatory data also includes, for example, data representing images captured by the exterior camera 11 and the interior camera 12. This is because the image data from the exterior camera 11 contains privacy information of the user of vehicle 2 and people around vehicle 2, and the image data captured by the interior camera 12 contains privacy information of the user of vehicle 2.

[0072] Furthermore, in this embodiment, the regulatory data includes data representing the user's own position measured by the positioning sensor 14. This is because the data representing the user's own position indicates the user's activity history in vehicle 2 and therefore contains private information. In addition, in this embodiment, the regulatory data includes data representing the voice detected by the microphone 15. This is because the data detected by the microphone 15 contains private information of the user in vehicle 2.

[0073] On the other hand, in this embodiment, the regulatory data does not include data representing the driving status of vehicle 2 detected by the driving status sensor 16. This is because data representing the driving status of vehicle 2 is not data that can lead to the identification of an individual, and therefore does not include the privacy information of the vehicle 2 user. In addition, the regulatory data does not include data representing the operation status of the control devices detected by the driver operation sensor 17. This is because data representing the operation status of the control devices is not data that can lead to the identification of an individual, and therefore does not include the privacy information of the vehicle 2 user. Furthermore, in this embodiment, the regulatory data does not include data representing the distance to surrounding objects detected by the distance measuring sensor 13. This is because data representing distance is not data that can lead to the identification of an individual, and therefore does not include the privacy information of the vehicle 2 user and people who were around vehicle 2.

[0074] In this embodiment, if the user of vehicle 2 has not consented to the provision of data to an external party at the time data is acquired by vehicle 2, the restricted data among that data will not be sent to server 5. However, if the user of vehicle 2 has consented to the provision of data to an external party, all of that data will be sent to server 5. This prevents the provision of restricted data from past data when the user has not consented to the provision of data to an external party from being provided to an external party. In addition, since past data including restricted data is provided when the user has consented to the provision of data to an external party, it prevents unnecessary restrictions on the provision of data to an external party. In particular, in this embodiment, if the user of vehicle 2 has not consented to the provision of data to an external party, the transmission of restricted data including privacy information is stopped. This prevents the provision of privacy information to server 5 without the user's consent.

[0075] In this embodiment, the restricted data is data containing privacy information, while data other than the restricted data does not contain privacy information. However, the restricted data may be data with a higher level of privacy than a predetermined level. Therefore, for example, data containing the identification information of vehicle 2 and data representing images may be treated as restricted data, while data representing the vehicle's own position may not be treated as restricted data. In any case, the restricted data includes at least one of the following: data containing the identification information of vehicle 2, data representing images generated by the external camera 11 and the internal camera 12, data representing the vehicle's own position generated by the positioning sensor 14, and data representing sound generated by the microphone 15. Furthermore, the restricted data does not include at least one of the multiple data representing the driving status of vehicle 2 or the multiple data representing the operating status of the control device.

[0076] Alternatively, regulatory data may be data selected independently of privacy information. Furthermore, all data detected by the vehicle 2's sensor 10 may be treated as regulatory data.

[0077] In addition, in this embodiment, the transmission control unit 533 controls the transmission of previously acquired data to the server 5 when the conditions for reading data from the vehicle 2 are met. In this embodiment, for data that the user of the vehicle 2 did not consent to providing to an external party at the time of data acquisition, the transmission control unit 533 sends only the data other than the restricted data to the server 5 when the conditions for reading data from the vehicle 2 are met, without sending the restricted data. On the other hand, for data that indicates the user of the vehicle 2 consented to providing the data to an external party at the time of data acquisition, the transmission control unit 533 sends all of that data (including the restricted data) to the server 5 when the conditions for reading data from the vehicle 2 are met.

[0078] More specifically, in this embodiment, as described above, when the conditions for reading data from vehicle 2 are met, the data request unit 532 sends a data read request signal to each vehicle 2. When the data transmission unit 334 of vehicle 2 receives the data read request signal from the server 5, it sends data to the server 5 representing the time when each of the multiple stored data stored in vehicle storage unit 32 was acquired, as described above. Based on the time data received in this way and the synchronization period information stored in server storage unit 52, the transmission control unit 533 determines whether the user of vehicle 2 consented to providing the data to an external party at the time the data was acquired in vehicle 2. Based on this determination result, the transmission control unit 533 controls the transmission of previously acquired data from vehicle 2 to server 5. As a result, when the conditions for reading data from vehicle 2 are met, the transmission control unit 533 controls the transmission of previously acquired data to server 5.

[0079] In this embodiment, data is provided to the external system when any data retrieval condition is met. Therefore, data is transmitted in batches after a certain amount of data has been stored in the vehicle storage unit 32 of vehicle 2. As a result, server 5 receives the data in batches, making it easier for server 5 to organize the data.

[0080] ≪Data Storage Control Unit≫ The data storage control unit 534 controls the storage of data received from the vehicles 2 into the server storage unit 52. In this embodiment, when the data storage control unit 534 receives data generated by the sensors 10 from each vehicle 2, it stores the received data in the server storage unit 52. This data stored in the server storage unit 52 is used as training data for autonomous driving or to analyze the operation of multiple vehicles 2.

[0081] <Processing flow> Next, with reference to Figures 7 to 10, the processing flow executed by the vehicle processor 33 or the server processor 53 will be explained. First, the change notification process that notifies the server 5 of a change in the agreement status will be explained. Figure 7 is a flowchart showing the flow of the change notification process. The change notification process shown in Figure 7 is executed by the vehicle processor 33 at regular time intervals.

[0082] As shown in Figure 7, in the change notification process, the information management unit 332 first determines whether the consent status of the user of vehicle 2 has changed (step S11). The change in the consent status of the user of vehicle 2 is determined based on input from the input device, as described above. If it is determined in step S11 that the user's consent status has not changed, the change notification process is terminated. On the other hand, if it is determined in step S11 that the user's consent status has changed, information indicating that the consent status has changed is sent to the server 5 (step S12). As a result, the consent period information shown in Figure 6 is stored in the server storage unit 52.

[0083] Next, we will explain the vehicle storage process, which involves storing data generated by the vehicle's sensor 10 in the vehicle storage unit 32. Figure 8 is a flowchart showing the flow of the vehicle storage process. The storage process shown in Figure 8 is executed by the vehicle processor 33 at regular time intervals.

[0084] As shown in Figure 8, in the vehicle memory processing, first, the vehicle memory control unit 333 determines whether a predetermined incident has occurred based on, for example, the speed, acceleration, and steering angle change rate of the vehicle 2 detected by the driving state sensor 16 (step S21). If it is determined in step S21 that no predetermined incident has occurred, the vehicle memory processing is terminated.

[0085] On the other hand, if it is determined in step S21 that a predetermined incident has occurred, the vehicle memory control unit 333 acquires the data generated by each of the sensors 10 and the current time (step S22). The vehicle memory control unit 333 may also acquire data generated by the sensors 10 in step S22 in addition to the data currently being generated by the sensors 10, by temporarily storing the data generated by the sensors 10 in the vehicle memory unit 32 for a certain period of time.

[0086] Next, the vehicle memory control unit 333 stores the data acquired in step S22 and the current time as a single stored data in the vehicle memory unit 32 (step S23). As a result, the vehicle memory unit 32 stores the stored data as shown in Figure 4.

[0087] Next, referring to Figures 9 and 10, we will explain the communication between vehicle 2 and server 5 regarding the transmission of data acquired by vehicle 2, and the operation of vehicle 2 and server 5 in relation to this communication. Figure 9 is an operation sequence diagram regarding the communication between vehicle 2 and server 5.

[0088] In the example shown in Figure 9, first, when an arbitrary data retrieval condition is met, the data request unit 532 of the server 5 determines that the data retrieval condition has been met (step S31) and sends a data retrieval request signal to the vehicle 2 (step S32). The data retrieval request signal includes information indicating a request to retrieve data related to a specific incident.

[0089] When vehicle 2 receives a data read request signal from server 5, the data transmission unit 334 of vehicle 2 identifies the data corresponding to the request contained in the data read request signal (step S33). For example, if the data read request signal contains information indicating a request to read data related to a specific incident, the data transmission unit 334 identifies the data related to that specific incident as the stored data to which time data will be transmitted. Specifically, for example, if a data read request signal is received for an emergency braking incident, the data transmission unit 334 identifies the stored data with data IDs 2 and 3 as the target data, for example, in the example shown in Figure 4. Next, the data transmission unit 334 transmits the time data of each identified stored data to server 5 (step S34).

[0090] When server 5 receives the time data for each stored data, the transmission control unit 533 of server 5 executes a transmission control process that controls the transmission of data previously acquired by vehicle 2 to server 5 (step S35). In this embodiment, the transmission control unit 533 determines, based on the received time data and the synchronization period information stored in server storage unit 52, whether the user of vehicle 2 consented to providing the data to an external party at the time each stored data corresponding to each time data was acquired. The transmission control unit 533 then sends a signal to vehicle 2 instructing it to transmit the stored data to server 5 if it has been determined that the user consented to providing the data to an external party.

[0091] Figure 10 is a flowchart showing the flow of the transmission control process. Steps S41 to S43 are performed for each of the received time data.

[0092] First, the transmission control unit 533 determines whether the time represented by one of the multiple time data received in step S34 falls within a period in which the user consented to the provision of data to an external party (step S41). Specifically, the transmission control unit 533 determines whether the user consented based on the time data and the consent period information stored in the vehicle storage unit 32. For example, in the examples shown in Figures 4 and 6, the time data of the stored data with data ID 2 indicates a period in which the consent status is non-consented, so it is determined that the time represented by this time data is a period in which consent was not given.

[0093] If, in step S41, the time represented by the time data is determined to be within the period during which the user has consented to the provision of data to an external party, the transmission control unit 533 instructs the transmission of all of the stored data (including regulatory data) corresponding to this time data to the server 5 (step S42). On the other hand, if, in step S41, the time represented by the time data is determined to be outside the period during which the user has consented to the provision of data to an external party, the transmission control unit 533 instructs the transmission of all stored data other than regulatory data corresponding to that time data to the server 5 (step S43). After that, once the processing in steps S41 to S43 has been performed for all of the time data received in step S34, the transmission process is terminated. Note that in step S43, the transmission control unit 533 instructs the transmission of all stored data other than regulatory data to the server 5, but it may also instruct the server not to transmit any of the corresponding stored data to the server.

[0094] When the transmission control process is executed in the server 5 in this manner, the transmission control unit 533 sends a signal to the vehicle 2 instructing it to transmit data (step S36). When the data transmission unit 334 of the vehicle 2 receives the signal instructing it to transmit data, it transmits the stored data stored in the vehicle storage unit 32 to the server 5 in accordance with this signal (step S37).

[0095] <Variation> Next, a modified version of the first embodiment will be described with reference to Figure 11. In the first embodiment described above, if the transmission control unit 533 determines that the user of vehicle 2 did not consent to the provision of data to an external party at the time the data was acquired based on the consent information, it will transmit data other than the restricted data from the data previously acquired by vehicle 2, without transmitting the restricted data.

[0096] In contrast, in this modified version, if the transmission control unit 533 determines that the user of vehicle 2 did not consent to the provision of the data to an external party at the time the data was acquired based on the consent information, it processes the regulated data to reduce its accuracy before sending it to the server 5, while sending data other than the regulated data to the server 5 without processing it.

[0097] Processing that reduces the accuracy of information includes processes that anonymize private information contained in regulated data. For example, processing that reduces the accuracy of information includes processes that reduce the resolution of images or apply mosaics to images of characters or people so that the characters on license plates or people in the images cannot be identified. Processing that reduces the accuracy of information also includes processes that reduce the resolution of images or apply mosaics to images of occupants so that occupants in the images cannot be identified. Processing that reduces the accuracy of information also includes processes that process the audio data generated by the microphone 15 so that the occupant who spoke cannot be identified. In addition, processing that reduces the accuracy of information includes processes that broaden the range in which the vehicle 2 may be located so that the specific location cannot be identified in the data representing its own position generated by the positioning sensor 14.

[0098] By processing the information in this way to reduce its accuracy before sending it to server 5, it is possible to provide the minimum necessary data used for analyzing the driving of vehicle 2, etc., while protecting the privacy of users who have not consented to the provision of their data to external parties.

[0099] Figure 11 is a flowchart similar to Figure 10, showing the flow of the transmission control process according to this modified example. Steps S51 and S52 in Figure 11 are the same as steps S41 and S42 in Figure 10, so their explanation is omitted.

[0100] If, in step S51, it is determined that the time represented by the time data is not within the period during which the user has consented to the provision of data to an external party, the transmission control unit 533 instructs the server 5 to transmit the data that has been processed from the regulated data among the stored data corresponding to that time data (step S53). The transmission control unit 533 also instructs the server 5 to transmit data other than the regulated data as is, without processing.

[0101] Second Embodiment Next, the data acquisition system 1 according to the second embodiment will be described with reference to Figures 12 and 13. The configuration and operation of the data acquisition system 1 according to the second embodiment are basically the same as those of the data acquisition system 1 according to the first embodiment. The following description will focus on the differences from the data acquisition system 1 according to the first embodiment.

[0102] In the first embodiment described above, the transmission control unit 533 controlled the transmission of previously acquired data to the server 5 based on whether the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired. In this embodiment, the transmission control unit 533 controls the transmission of previously acquired data to the server 5 based not only on the time the data was acquired, but also on whether the user of vehicle 2 had consented to the provision of the data to an external party when the data read condition was met. By controlling the transmission of data to the server 5 based on the user's consent status at the time the data was acquired, as well as the consent status at the time the data was provided to an external party, it is possible to make a more careful decision regarding the transmission of data containing privacy information to the outside of vehicle 2.

[0103] More specifically, in this embodiment as well, if the transmission control unit 533 determines, based on the consent period information and data representing the time each data was acquired, that the user of vehicle 2 did not consent to the provision of the data to an external party at the time the data was acquired, it will not transmit the restrictive data, which is part of that data, to the server 5. Therefore, in this embodiment, in such a case, the transmission control unit 533 transmits the data other than the restrictive data from the target data to the server 5.

[0104] On the other hand, in this embodiment, even if the transmission control unit 533 determines, based on the consent period information and data representing the time each data was acquired, that the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired, if the transmission control unit 533 determines, based on the consent period information, that the user of vehicle 2 had not consented to the provision of the data to an external party at the time the data reading condition was met, it will not transmit the restrictive data, which is part of that data, to the server 5. Therefore, in this embodiment, even in such a case, the transmission control unit 533 transmits the data other than the restrictive data from the target data to the server 5.

[0105] In this embodiment, the transmission control unit 533 determines, based on the consent period information and data representing the time each data was acquired, that the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired. Furthermore, if the transmission control unit 533 determines, based on the consent period information, that the user of vehicle 2 has consented to the provision of the data to an external party when the data reading condition is met, it transmits all of that data (including regulatory data) to the server 5.

[0106] In this way, by controlling the transmission of regulated data to server 5 depending on whether the user has consented to the provision of the data to an external party when the data reading conditions are met, even if the user consented to the provision of the data to an external party at the time the data was acquired, if they later change their mind and no longer consent to the provision of the data to an external party, the transmission of the data to server 5 is suppressed.

[0107] In particular, in this embodiment, consent is determined for each user. Therefore, the transmission control unit 533 determines whether the user who acquired the data also consented to providing the data to an external party when the data reading conditions were met.

[0108] Therefore, in this embodiment, the vehicle memory control unit 333 stores in the vehicle memory unit 32 the user of vehicle 2 at the time the data was acquired, in addition to the data acquired by vehicle 2. In particular, in this embodiment, the vehicle memory control unit 333 stores in the vehicle memory unit 32 the current driver identified by the driver identification unit 331 or their information as the user of vehicle 2 at the time the data was acquired. The information of the current driver may be a feature quantity extracted from the driver's facial image, as described above.

[0109] Figure 12 is a diagram similar to Figure 4, showing an example of stored data stored in the vehicle storage unit 32 by the vehicle storage control unit 333 in this embodiment. As shown in Figure 12, in this embodiment, each stored data stored in association with each data ID includes user data about the user of the vehicle 2, in addition to the data shown in Figure 4.

[0110] Then, when the data transmission unit 334 of vehicle 2 sends data representing the time for each stored data to the server 5 in response to a data read signal from the server 5, it also sends information about the driver for that stored data.

[0111] When the transmission control unit 533 of server 5 receives data representing the time for each stored data, if it determines, based on the consent period information, that the user represented by the user data corresponding to each stored data has currently consented to the provision of the data to an external party, it instructs the transmission of that stored data to server 5 according to the consent status at the time of data acquisition. On the other hand, when the transmission control unit 533 receives data representing the time for each stored data, if it determines, based on the consent period information, that the user represented by the user data corresponding to each stored data has not currently consented to the provision of the data to an external party, it does not instruct the transmission of the restricted data for that stored data to server 5.

[0112] By determining consent for each user in this way, it is possible to prevent data from being provided to server 5 if a different user than the one who acquired the data has consented to its provision to an external party when the data retrieval conditions are met.

[0113] Figure 13 is a flowchart similar to Figure 10, showing the flow of the transmission control process according to this embodiment. Steps S61, S63, and S64 in Figure 13 are the same as steps S41 to S43 in Figure 10, so their explanation is omitted.

[0114] If, in step S61, it is determined that the time represented by the time data falls within a period during which the user consented to the provision of data to an external party, the transmission control unit 533 determines whether the user at the time the stored data corresponding to that time data was acquired currently consented to the provision of data to an external party (step S62). Whether the user currently consented to the provision of data to an external party is determined based on the consent period information. If, in step S62, it is determined that the user currently consented to the provision of data to an external party, the transmission control unit 533 instructs the transmission of all stored data (including regulatory data) corresponding to the time data to the server 5 (step S63). On the other hand, if, in step S62, it is determined that the user currently did not consent to the provision of data to an external party, the transmission control unit 533 instructs the transmission of all stored data other than regulatory data corresponding to that time data to the server 5 (step S64).

[0115] <Variation> Next, a modified version of the second embodiment will be described. In the modified version of the second embodiment, similar to the modified version of the first embodiment, if it is determined that the user of vehicle 2 did not consent to the provision of the data to an external party at the time the data was acquired, the transmission control unit 533 processes the regulatory data to reduce its accuracy before sending it to the server 5, and also sends data other than the regulatory data to the server 5 without processing it.

[0116] In addition, in this modified example, even if it is determined that the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired, if it is determined that the user of vehicle 2 did not consent to the provision of the data to an external party at the time the data reading condition was met based on the consent period information, the transmission control unit 533 will send the restricted data to the server 5 after processing it to reduce the accuracy of the information, and will send the data other than the restricted data to the server 5 without processing it.

[0117] By processing the information in this way to reduce its accuracy before sending it to server 5, it is possible to provide the minimum necessary data used for analyzing the driving of vehicle 2, etc., while protecting the privacy of users who have not consented to the provision of their data to external parties.

[0118] While preferred embodiments of the present disclosure have been described above, the present disclosure is not limited to these embodiments, and various modifications and changes can be made within the scope of the claims. [Explanation of Symbols]

[0119] 1. Data Acquisition System 2 vehicles 5 Servers 10 sensors 30 ECU 33 Vehicle Processor 53 Server Processors

Claims

1. A server capable of communicating with a vehicle, A server comprising a transmission control unit that controls the transmission from the vehicle to the server of data previously acquired by the vehicle, based on information received from the vehicle, whether or not the user of the vehicle consented to the provision of the data to an external party at the time the data was acquired by the vehicle.

2. The system further includes a storage control unit that stores consent information in a storage unit indicating whether or not the user of the vehicle had previously consented to the provision of data acquired by the vehicle to an external party, based on information received from the vehicle. The server according to claim 1, wherein the transmission control unit controls the transmission of data previously acquired in the vehicle to the server based on the consent information.

3. The server according to claim 2, wherein the consent information includes consent period information relating to the period during which the user of the vehicle consented to the provision of data acquired by the vehicle to an external party.

4. The server according to claim 1 or 2, wherein the transmission control unit controls the transmission of data previously acquired in the vehicle to the server when the conditions for reading data from the vehicle are met.

5. The server according to claim 4, wherein the transmission control unit controls the transmission of the data from the vehicle to the server based on whether the user of the vehicle consented to providing the data to an external party at the time the data was acquired by the vehicle, and whether the user of the vehicle consented to providing the data to an external party when the data reading condition is met.

6. The server according to claim 1, wherein the transmission control unit prevents the vehicle from transmitting regulatory data, which is at least a part of the data, to the server if the vehicle user has not consented to providing the data to an external party at the time the data is acquired.

7. The server according to claim 1, wherein if the user of the vehicle has not consented to providing the data to an external party at the time the data is acquired, the transmission control unit causes the vehicle to transmit regulatory data, which is at least a part of the data, to the server after processing it in a way that reduces the accuracy of the information.

8. The server according to claim 6 or 7, wherein the transmission control unit causes the vehicle to transmit the data, including the regulatory data, to the server if the vehicle user has consented to providing the data to an external party at the time the data is acquired.

9. The server according to claim 6 or 7, wherein the transmission control unit prevents the vehicle from transmitting the regulatory data to the server if, even if the vehicle user has consented to providing the data to an external party at the time the data is acquired, the vehicle user has not consented to providing the data to an external party when the conditions for reading data from the vehicle are met.

10. The server according to claim 6 or 7, wherein even if the user of the vehicle consented to providing the data to an external party at the time the data was acquired, if the user of the vehicle did not consent to providing the data to an external party when the conditions for reading data from the vehicle were met, the transmission control unit causes the vehicle to process the regulated data in a way that reduces the accuracy of the information and then transmit it to the server.

11. The server according to claim 9, wherein the transmission control unit causes the vehicle to transmit the data, including the regulatory data, to the server if the vehicle user has consented to providing the data to an external party at the time the data is acquired, and the vehicle user has consented to providing the data to an external party when the conditions for reading data from the vehicle are met.

12. The server according to claim 7, wherein the processing that reduces the accuracy of the aforementioned information includes a process of anonymizing the privacy information contained in the regulated data.

13. A system comprising a server according to claim 1 or 2 and a vehicle capable of communicating with the server, The vehicle is a system that includes an information management unit that transmits to the server information regarding whether or not the user of the vehicle has consented to the provision of data to an external party.

14. An information processing method performed on a server capable of communicating with a vehicle, An information processing method that includes controlling the transmission of data previously acquired by the vehicle from the vehicle to the server based on information received from the vehicle, on whether the user of the vehicle consented to providing the data to an external party at the time the data was acquired by the vehicle.

15. A computer program that runs on a server capable of communicating with a vehicle, A computer program that causes the server's computer to control the transmission of data previously acquired by the vehicle from the vehicle to the server, based on information received from the vehicle, whether or not the vehicle's user consented to the provision of the data to an external party at the time the data was acquired by the vehicle.

Images