Information management device, information management method, and information management program

Abstract

To appropriately reflect the intention of a user as to whether to collect privacy information even when a vehicle moves from a first jurisdiction to a second jurisdiction.SOLUTION: An information storage module of an information management device mounted on a vehicle stores a list including one or more items indicating privacy information that cannot be collected without permission from a user in each of a plurality of jurisdictions. When the vehicle moves from a first jurisdiction to a second jurisdiction that is adjacent to the first jurisdiction, the information management device confirms the user whether or not to permit storage of the privacy information relating to items included in the list concerning the second jurisdiction in a storage device before the vehicle starts traveling in the second jurisdiction (S400 to S404). The information management device stores the privacy information relating to the items included in the list concerning the second jurisdiction in the information storage module, on condition that the vehicle is located in the second jurisdiction and that the user gives the permission.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to an information management device, an information management method, and an information management program to be mounted on a vehicle. [Background technology]

[0002] Patent Document 1 discloses an information management device mounted on a vehicle. The information management device queries the vehicle user as to whether or not to allow the user's privacy information to be stored in a persistent storage device. Here, the privacy information includes, for example, the user's name, user location information, and vehicle speed.

[0003] If the user permits the storage of the privacy information in the persistent storage device, the information management device stores the user's privacy information in the persistent storage device. If the user refuses the storage of the privacy information in the persistent storage device, the information management device loads the user's privacy information into volatile memory and uses it. In such a case, the user's privacy information is not stored in the persistent storage device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2021-170016 Summary of the Invention [Problem to be solved by the invention]

[0005] Privacy laws applicable in one jurisdiction, such as a country, state, or territory, may differ from those applicable in another jurisdiction.

[0006] For example, if a vehicle user permits collection of privacy information in a country where privacy laws with loose restrictions on collection of privacy information are applied, and then the vehicle moves to a country where strict privacy laws are applied, there is a possibility that privacy information will be collected in the country where strict privacy laws are applied in the same manner as in the country where the loose privacy laws are applied. [Means for solving the problem]

[0007] The means for solving the above problems and their effects will be described below. According to one aspect of the present disclosure, there is provided an information management device to be mounted on a vehicle, the information management device comprising a processing circuit and a storage device, wherein the storage device stores a list consisting of one or more items indicating privacy information that cannot be collected without the user's permission, for each of a plurality of jurisdictions, and the processing circuit is configured to: when the vehicle moves from a first jurisdiction to a second jurisdiction different from the first jurisdiction, make a query to the user before the vehicle begins traveling in the second jurisdiction to confirm whether or not the user allows privacy information related to the items included in the list related to the second jurisdiction to be stored in the storage device; and, when the vehicle is located in the second jurisdiction and the user has given permission, store the privacy information related to the items included in the list related to the second jurisdiction in the storage device. [Effects of the Invention]

[0008] Even when the vehicle moves from a first jurisdiction to a second jurisdiction, the user's intention regarding whether or not to collect privacy information can be appropriately reflected according to the list prepared for each jurisdiction. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram of an information management device according to an embodiment. [Figure 2]FIG. 2 is a flowchart showing a process in which the information management device of FIG. 1 switches between the normal mode and the restricted mode based on whether or not vehicle position information can be acquired. [Figure 3] FIG. 3 is a flow chart illustrating a process for storing privacy settings for the jurisdiction in which the vehicle is currently located. [Figure 4] FIG. 4 is a flow chart illustrating a process for storing privacy settings for jurisdictions to which a vehicle may be directed. DETAILED DESCRIPTION OF THE INVENTION

[0010] An information management device according to an embodiment will be described below with reference to the drawings. <Outline of Information Management Device 100> Referring to FIG. 1, an overview of an information management device 100 mounted on a vehicle will be described. A current jurisdiction determination module 12 (described later) repeatedly acquires vehicle location information via a GPS sensor 22 (described later) from the time the ignition key is turned on until the time it is turned off. An information storage module 20 (described later) stores, for each of a plurality of jurisdictions, a list of one or more items indicating privacy information that cannot be collected without the user's permission. Here, a jurisdiction refers to the geographical area within which a law or regulation applies. Examples of jurisdictions include a country, a state, and a territory. Privacy information includes information that does not change during a vehicle trip, such as the user's name, phone number, address, and facial photograph. A trip refers to the period from the time the ignition key is turned on until the time it is turned off. Privacy information includes information that changes from moment to moment during a trip, such as the vehicle's location information and vehicle speed. A storage permission data determination module 16 (described later) stores privacy settings for each of a plurality of jurisdictions in the information storage module 20. The privacy settings are not erased even when the ignition key is turned off. The privacy settings indicate whether the user has permitted the storage of privacy information related to the items included in the list in the information storage module 20. The privacy settings are stored in response to the user's response to a query made to the user. The timing of the query will be described later with reference to Figures 3 and 4. The information storage module 20 stores privacy information according to a list related to the jurisdiction in which the vehicle is located based on a positive privacy setting related to the jurisdiction. A positive privacy setting is a privacy setting indicating that the user has permitted the collection of privacy information related to the items included in the list. The information storage module 20 prevents the storage of privacy information according to a list related to the jurisdiction in which the vehicle is located based on a negative privacy setting related to the jurisdiction. A negative privacy setting is a privacy setting indicating that the user has refused to collect privacy information related to the items included in the list. For example, when a vehicle moves from a first jurisdiction to a second jurisdiction, the following (A) to (C) are assumed.(A) The privacy laws of a first jurisdiction do not require user permission to store vehicle location information in the information storage module 20. (B) The privacy laws of a second jurisdiction require user permission to store vehicle location information in the information storage module 20. (C) The privacy setting for the second jurisdiction is negative. In such cases, the vehicle location information from when the vehicle enters the first jurisdiction to when it leaves the first jurisdiction is stored in the information storage module 20. The vehicle location information from when the vehicle enters the second jurisdiction to when it leaves the second jurisdiction is prevented from being stored in the information storage module 20. The vehicle location information from when the vehicle enters the first jurisdiction to when it leaves the first jurisdiction may be erased after the vehicle enters the second jurisdiction, or may continue to be stored.

[0011] The information management device 100 includes an in-vehicle ECU 10. The information management device 100 further includes a GPS sensor 22, a user interface 24, and a DCM (data communication module) 26. The in-vehicle ECU 10 includes a current jurisdiction determination module 12, a user consent acquisition module 14, a storage permission data determination module 16, and a control module 18. The in-vehicle ECU 10 further includes an information storage module 20. The in-vehicle ECU 10 is capable of connecting to an update tool 28 and receiving data from the update tool 28.

[0012] The current jurisdiction determination module 12 repeatedly acquires vehicle location information via the GPS sensor 22. The current jurisdiction determination module 12 determines the jurisdiction in which the vehicle is currently located based on the vehicle location information. The current jurisdiction determination module 12 provides current jurisdiction information, which is information indicating the jurisdiction in which the vehicle is currently located, to the storage permission data determination module 16. The current jurisdiction determination module 12 provides determination information to the user consent acquisition module 14 when the distance from the boundary of the jurisdiction in which the vehicle is currently located to the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located is equal to or less than a predetermined distance. Here, the determination information is information indicating that the distance from the boundary of the jurisdiction in which the vehicle is currently located to the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located is equal to or less than a predetermined distance. The predetermined distance is, for example, 5 kilometers.

[0013] The user consent acquisition module 14 makes a query when the ignition key is turned on if no privacy settings are stored for the jurisdiction in which the vehicle is currently located. The query is made via the user interface 24. The query is a process of confirming with the user whether or not to allow privacy information related to items included in the list related to the jurisdiction in which the vehicle is currently located to be stored. The query can be omitted if privacy settings for the jurisdiction in which the vehicle is currently located are stored. Making the query when the ignition key is turned on means that the query is made before the vehicle starts traveling in the jurisdiction in which the vehicle is currently located. A possible embodiment is one in which the user decides whether or not to consent to the storage of privacy information for all items included in the list at once. Alternatively, a user may choose to consent to the storage of privacy information for only some of the items included in the list.

[0014] The user consent acquisition module 14 issues a query when the distance from the border of a jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or less than a predetermined distance. This means that the query is issued before the vehicle starts traveling in the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located. The query is issued via the user interface 24. The query is a process of confirming with the user whether or not to allow the storage of privacy information related to items included in a list related to the jurisdiction in which the vehicle is currently located. The query can be omitted if privacy settings related to the jurisdiction in which the vehicle is currently located and adjacent to the jurisdiction in which the vehicle is currently located are stored. A possible embodiment is that the user decides whether or not to consent to the storage of privacy information for all items included in the list at once. Alternatively, a user may choose to consent to the storage of privacy information for only some of the items included in the list.

[0015] The storage permission data determination module 16 stores privacy information for items included in the list for the jurisdiction in which the vehicle is currently located in the information storage module 20. This is done only if there is a positive privacy setting for the jurisdiction in which the vehicle is currently located.

[0016] The storage permission data determination module 16 can receive an update request to update the list for one of the jurisdictions stored in the information storage module 20. When the update request is received, the storage permission data determination module 16 updates the list for one of the jurisdictions in accordance with the update request. The storage permission data determination module 16 may receive the update request, for example, via the DCM 26. Here, over-the-air (OTA) technology is used. Alternatively or additionally, the storage permission data determination module 16 may receive the update request from an update tool 28 connected to the on-vehicle ECU 10.

[0017] The control module 18 acquires various control data and provides the acquired various control data to the information storage module 20 . <Normal mode and restricted mode> The above description with reference to FIG. 1 is based on the assumption that the in-vehicle ECU 10 can repeatedly acquire vehicle position information via the GPS sensor 22. That is, the processing in the normal mode has been described. However, there may be cases where the in-vehicle ECU 10 cannot acquire vehicle position information via the GPS sensor 22. The in-vehicle ECU 10 is in the normal mode when it is able to acquire vehicle position information. The in-vehicle ECU 10 is in the restricted mode when it is unable to acquire vehicle position information. In this way, the in-vehicle ECU 10 can switch between two control modes.

[0018] As shown in FIG. 2, while the ignition key is on, the in-vehicle ECU 10 repeatedly determines whether or not the vehicle position information can be acquired. First, in step S200, the in-vehicle ECU 10 determines whether or not it is possible to acquire vehicle position information. If the in-vehicle ECU 10 makes a positive determination in step S200 (step S200: YES), the process proceeds to step S202. The in-vehicle ECU 10 selects the normal mode in step S202. If the in-vehicle ECU 10 makes a negative determination in step S200 (step S200: NO), the process proceeds to step S204. The in-vehicle ECU 10 selects the restricted mode in step S204.

[0019] In the restricted mode, if the vehicle location information cannot be obtained, the vehicle ECU 10 determines whether to store privacy information related to items included in the default list in the information storage module 20. The default list is a comprehensive list of items indicating privacy information that cannot be collected without the user's permission, covering all of a plurality of jurisdictions. In the restricted mode, the vehicle ECU 10 queries the user to confirm whether to allow privacy information related to items included in the default list to be stored in the information storage module 20. The query can be omitted if privacy settings related to the default list are stored.

[0020] <Processing flow in normal mode> The flow of the process executed by the in-vehicle ECU 10 in the normal mode will be described in detail with reference to FIGS.

[0021] Fig. 3 shows a flow of processing that is executed when the control mode is the normal mode when the ignition switch is turned on. The processing shown in Fig. 3 is also executed when the control mode is switched from the restricted mode to the normal mode.

[0022] In step S300, the in-vehicle ECU 10 determines whether the privacy settings related to the jurisdiction in which the vehicle is currently located have been stored. If the determination in step S300 is affirmative (step S300: YES), the in-vehicle ECU 10 ends the flow of FIG.

[0023] If the in-vehicle ECU 10 makes a negative determination in step S300 (step S300: NO), the in-vehicle ECU 10 proceeds to step S302. In step S302, the in-vehicle ECU 10 queries the user to confirm whether or not to allow privacy information related to items included in the list related to the jurisdiction in which the vehicle is currently located to be stored in the information storage module 20. Since the query is made when the ignition key is turned on, it can be said that the query is made before the vehicle starts traveling in the jurisdiction in which the vehicle is currently located. Next, the in-vehicle ECU 10 proceeds to step S304.

[0024] In step S304, the in-vehicle ECU 10 determines whether the user has given permission. If the determination in step S304 is affirmative (step S304: YES), the in-vehicle ECU 10 proceeds to step S306. In step S306, the in-vehicle ECU 10 stores in the information storage module 20 a privacy setting indicating that the user has given permission.

[0025] When the determination in step S304 is negative (step S304: NO), the in-vehicle ECU 10 proceeds to step S308. In step S308, the in-vehicle ECU 10 stores in the information storage module 20 a privacy setting indicating that the user has refused.

[0026] After executing the process of step S306 or step S308, the in-vehicle ECU 10 ends the flow of FIG. According to the process shown in Figure 3, the following can be said: Consider a case where a vehicle moves from a first jurisdiction to a second jurisdiction adjacent to the first jurisdiction. For example, consider a case where the user turns off the ignition key in the second jurisdiction without responding to a query made regarding the second jurisdiction before the vehicle entered the second jurisdiction.

[0027] According to steps S300 and S302, the in-vehicle ECU 10 queries the user before the vehicle starts traveling in the second jurisdiction to confirm whether or not to allow privacy information related to the items included in the list related to the second jurisdiction to be stored in the information storage module 20. According to steps S202 and S306, the in-vehicle ECU 10 stores privacy information related to the items included in the list related to the second jurisdiction in the information storage module 20, on the condition that the vehicle is located in the second jurisdiction and the user has given permission.

[0028] According to step S300, if the privacy setting for the second jurisdiction is stored in the information storage module 20, the in-vehicle ECU 10 does not make an inquiry. Fig. 4 shows a flow of processing that is repeatedly executed after the ignition switch is turned on, provided that the control mode is the normal mode. The processing shown in Fig. 4 is also repeatedly executed after the control mode is switched from the limited mode to the normal mode.

[0029] In step S400, the in-vehicle ECU 10 determines whether the distance from the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located is equal to or shorter than a predetermined distance. If the determination in step S400 is negative (step S400: NO), the in-vehicle ECU 10 repeats the process of step S400.

[0030] If the determination in step S400 is affirmative (step S400: YES), the in-vehicle ECU 10 proceeds to step S402. In step S402, the in-vehicle ECU 10 determines whether privacy settings related to jurisdictions adjacent to the jurisdiction in which the vehicle is currently located have been stored. If the determination in step S402 is affirmative (step S402: YES), the in-vehicle ECU 10 ends the flow in FIG.

[0031] When the in-vehicle ECU 10 makes a negative determination in step S402 (step S402: NO), the in-vehicle ECU 10 proceeds to step S404. In step S404, the in-vehicle ECU 10 queries the user to confirm whether or not to allow privacy information related to items included in the list related to adjacent jurisdictions to be stored in the information storage module 20. According to steps S400 to S404, the query is made when the distance from the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or less than a predetermined distance. Therefore, it can be said that the query is made before the vehicle starts traveling in the adjacent jurisdiction. Next, the in-vehicle ECU 10 proceeds to step S406.

[0032] In step S406, the in-vehicle ECU 10 determines whether the user has given permission. If the determination in step S406 is affirmative (step S406: YES), the in-vehicle ECU 10 proceeds to step S408. In step S408, the in-vehicle ECU 10 stores the privacy setting indicating that the user has given permission.

[0033] When the determination in step S406 is negative (step S406: NO), the in-vehicle ECU 10 proceeds to step S410. In step S410, the in-vehicle ECU 10 stores the privacy setting indicating that the user has refused.

[0034] After executing the process of step S408 or step S410, the in-vehicle ECU 10 ends the flow of FIG. According to the process shown in Fig. 4, the following can be said: Assume that a vehicle moves from a first jurisdiction to a second jurisdiction adjacent to the first jurisdiction.

[0035] According to steps S400 to S404, the in-vehicle ECU 10 makes an inquiry when the vehicle is located in the first jurisdiction and the distance from the boundary of the second jurisdiction is equal to or shorter than the predetermined distance.

[0036] According to steps S400 to S404, the in-vehicle ECU 10 queries the user before the vehicle starts traveling in the second jurisdiction to confirm whether or not to allow privacy information related to the items included in the list related to the second jurisdiction to be stored in the information storage module 20. According to steps S202 and S408, the in-vehicle ECU 10 stores privacy information related to the items included in the list related to the second jurisdiction in the information storage module 20, on the condition that the vehicle is located in the second jurisdiction and the user has given permission.

[0037] According to step S402, if the privacy setting for the second jurisdiction is stored in the information storage module 20, the in-vehicle ECU 10 does not make an inquiry. <Effects of this embodiment> (1) Even when a vehicle moves from a first jurisdiction to a second jurisdiction, the user's intention regarding whether or not to collect privacy information can be appropriately reflected according to the list prepared for each jurisdiction.

[0038] (2) The vehicle-mounted ECU 10 is configured to store, for each of a plurality of jurisdictions, a privacy setting in the information storage module 20 indicating whether the user has permitted privacy information related to items included in the list to be stored in the information storage module 20. If the privacy setting for the second jurisdiction is stored in the information storage module 20, the vehicle-mounted ECU 10 does not make an inquiry.

[0039] For example, before a vehicle moves from a first jurisdiction to a second jurisdiction, privacy settings for the second jurisdiction may already be stored in the information storage module 20. In such a case, the information management device 100 does not query the user to confirm whether or not to allow privacy information related to the list for the second jurisdiction to be stored in the information storage module 20. This reduces the likelihood that the user will feel bothered by responding to the query.

[0040] (3) The on-board ECU 10 is configured to make an inquiry when the vehicle is located within the first jurisdiction and the distance from the border of the second jurisdiction is equal to or less than a predetermined distance. The information management device 100 makes an inquiry when it becomes highly likely that the vehicle will move into the second jurisdiction. This reduces the possibility that an inquiry will be made even when the vehicle is unlikely to move into the second jurisdiction. In other words, unnecessary inquiries are less likely to occur.

[0041] (4) When the vehicle location information cannot be acquired, the in-vehicle ECU 10 is configured to determine whether or not to store privacy information related to items included in the default list in the information storage module 20. The default list is a list that covers all items indicating privacy information that cannot be collected without the user's permission, for multiple jurisdictions. The information management device 100 can switch between normal mode and restricted mode based on whether or not the vehicle location information can be acquired. In the restricted mode, the information management device 100 uses the default list to determine whether or not to store privacy information in the information storage module 20. Even when the information management device 100 cannot acquire vehicle location information, the privacy information can be appropriately protected.

[0042] (5) When the in-vehicle ECU 10 receives an update request to update the list related to one of the multiple jurisdictions stored in the information storage module 20, the in-vehicle ECU 10 updates the list related to one of the multiple jurisdictions in accordance with the update request. Updating the list allows for appropriate protection of privacy information.

[0043] <Example of change> This embodiment can be modified as follows: This embodiment and the following modifications can be combined and implemented within the scope of technical compatibility.

[0044] In the above embodiment, when a vehicle moves from a first jurisdiction to a second jurisdiction adjacent to the first jurisdiction, the information management device 100 queries the user before the vehicle starts traveling in the second jurisdiction to confirm whether or not privacy information related to items included in the list related to the second jurisdiction is to be stored in the information storage module 20. The information management device 100 may be configured not to query if privacy settings for a list related to one of multiple jurisdictions other than the second jurisdiction that is the same as the list related to the second jurisdiction are stored in the information storage module 20. For example, it is possible that the list related to the first jurisdiction and the list related to the second jurisdiction are the same, and privacy settings for the first jurisdiction are already stored in the information storage module 20. In such a case, the information management device 100 does not query the user to confirm whether or not privacy information related to the list related to the second jurisdiction is to be stored in the information storage module 20. This reduces the likelihood that the user will feel bothered by responding to the query.

[0045] In the above embodiment, examples of jurisdictions include countries, states, and territories. However, jurisdictions are not necessarily limited to these. For example, if multiple neighboring countries apply the same privacy laws, these multiple neighboring countries may be considered as a single jurisdiction.

[0046] In the above embodiment, the in-vehicle ECU 10 makes an inquiry when the distance from the border of a jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or shorter than a predetermined distance. However, this is merely an example. For example, a geofence may be configured to surround the adjacent jurisdiction. In such a case, the in-vehicle ECU 10 makes an inquiry when the vehicle enters the geofence.

[0047] In the above embodiment, the in-vehicle ECU 10 makes an inquiry based on the fact that the distance from the border of a jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or shorter than a predetermined distance. However, this is merely an example. The in-vehicle ECU 10 may also make an inquiry based on the fact that the distance from the border of a jurisdiction different from the jurisdiction in which the vehicle is currently located becomes equal to or shorter than a predetermined distance. In other words, another jurisdiction may exist between the jurisdiction in which the vehicle is currently located and the jurisdiction related to the inquiry.

[0048] In the above embodiment, the privacy settings are not erased when the ignition key is turned off. Alternatively, the privacy settings may be erased when the ignition key is turned off.

[0049] In the above embodiment, the information management device 100 includes an in-vehicle ECU 10 having a plurality of modules 12 to 18 and an information storage module 20. The in-vehicle ECU 10 executes software processing. However, this is merely an example. For example, some of the plurality of modules 12 to 18 may constitute a single module. Furthermore, for example, the in-vehicle ECU 10 may include a dedicated hardware circuit (e.g., ASIC, etc.) that processes at least part of the software processing executed in the above embodiment. That is, the in-vehicle ECU 10 may have any of the following configurations (a) to (c): (a) The in-vehicle ECU 10 includes a processing device that executes all processing according to a program and a program storage device such as a ROM that stores the program. That is, the in-vehicle ECU 10 includes a software execution device. (b) The in-vehicle ECU 10 includes a processing device that executes part of the processing according to a program and a program storage device. Furthermore, the in-vehicle ECU 10 includes a dedicated hardware circuit that executes the remaining processing. (c) The in-vehicle ECU 10 includes a dedicated hardware circuit that executes all processing. Here, there may be a plurality of software executing devices and / or dedicated hardware circuits. That is, the above processes may be performed by processing circuitry including at least one of a software executing device and a dedicated hardware circuit. The processing circuitry may include a plurality of software executing devices and dedicated hardware circuits. Program storage devices, i.e., computer-readable media, include storage devices, which are any available media that can be accessed by a general-purpose or special-purpose computer.

[0050] <Additional Notes> The technical ideas that can be understood from the above-described embodiment and modified examples will be described. [Appendix 1] An information management device mounted on a vehicle, processing circuitry and storage; The storage device stores, for each of a plurality of jurisdictions, a list of one or more items indicating privacy information that cannot be collected without a user's permission; When the vehicle moves from a first jurisdiction to a second jurisdiction different from the first jurisdiction, before the vehicle starts traveling in the second jurisdiction, a query is made to the user to confirm whether or not the user allows privacy information related to the items included in the list related to the second jurisdiction to be stored in the storage device. and storing, in the storage device, privacy information associated with the items included in the list related to the second jurisdiction, if the vehicle is located in the second jurisdiction and the user has authorized it. Information management device.

[0051] [Appendix 2] the processing circuitry is configured to store in the storage device a privacy setting for each of the plurality of jurisdictions that indicates whether the user has authorized the storage device to store privacy information related to the items included in the list; The processing circuitry is configured to not perform the query if the privacy setting for the list for one of the plurality of jurisdictions other than the second jurisdiction is the same as the list for the second jurisdiction stored in the storage device. 2. The information management device according to claim 1.

[0052] [Appendix 3] the processing circuitry is configured to store in the storage device a privacy setting for each of the plurality of jurisdictions that indicates whether the user has authorized the storage device to store privacy information related to the items included in the list; The processing circuitry is configured to not perform the query if the privacy setting for the second jurisdiction is stored in the storage device. 2. The information management device according to claim 1.

[0053] [Appendix 4] The processing circuitry is configured to perform the query based on the vehicle being located within the first jurisdiction and being less than a predetermined distance from a boundary of the second jurisdiction. 2. The information management device according to claim 1.

[0054] [Appendix 5] the processing circuitry is configured to determine whether to store privacy information associated with the items included in the default list in the storage device if location information of the vehicle cannot be obtained; The default list is a comprehensive list of the items indicating privacy information that cannot be collected without the user's permission, for all of the multiple jurisdictions. 5. The information management device according to any one of Supplementary notes 1 to 4.

[0055] [Appendix 6] The processing circuitry is configured, when receiving an update request to update the list for one of the plurality of jurisdictions stored in the storage device, to update the list for one of the plurality of jurisdictions according to the update request. 6. The information management device according to any one of Supplementary notes 1 to 5. [Explanation of symbols]

[0056] 10... In-vehicle ECU, 12... Current jurisdiction determination module, 14... User consent acquisition module, 16... Storage permission data determination module, 20... Information storage module, 22... GPS sensor, 24... User interface, 26... DCM, 28... Update tool, 100... Information management device

Claims

1. An information management device mounted on a vehicle, processing circuitry and storage; the storage device stores, for each of a plurality of jurisdictions, a list of one or more items indicating privacy information that cannot be collected without a user's permission; When the vehicle moves from a first jurisdiction to a second jurisdiction different from the first jurisdiction, before the vehicle starts traveling in the second jurisdiction, a query is made to the user to confirm whether or not the user allows privacy information related to the items included in the list related to the second jurisdiction to be stored in the storage device. and storing, in the storage device, privacy information associated with the items included in the list related to the second jurisdiction, if the vehicle is located within the second jurisdiction and the user has authorized it. Information management device.

2. the processing circuitry is configured to store in the storage device a privacy setting for each of the plurality of jurisdictions that indicates whether the user has authorized the storage device to store privacy information related to the items included in the list; The processing circuitry is configured to not perform the query if the privacy setting for the list for one of the plurality of jurisdictions other than the second jurisdiction is the same as the list for the second jurisdiction stored in the storage device. The information management device according to claim 1 .

3. the processing circuitry is configured to store in the storage device a privacy setting for each of the plurality of jurisdictions that indicates whether the user has authorized the storage device to store privacy information related to the items included in the list; The processing circuitry is configured to not perform the query if the privacy setting for the second jurisdiction is stored in the storage device. The information management device according to claim 1 .

4. The processing circuitry is configured to perform the query based on the vehicle being located within the first jurisdiction and being within a predetermined distance from a boundary of the second jurisdiction. The information management device according to claim 1 .

5. the processing circuitry is configured to determine whether to store privacy information associated with the items included in the default list in the storage device if location information of the vehicle cannot be obtained; The default list is a comprehensive list of the items indicating privacy information that cannot be collected without the user's permission, for all of the multiple jurisdictions. The information management device according to any one of claims 1 to 4.

6. The processing circuitry is configured, when receiving an update request to update the list for one of the plurality of jurisdictions stored in the storage device, to update the list for one of the plurality of jurisdictions according to the update request. The information management device according to any one of claims 1 to 4.

7. An information management method in a vehicle, comprising: storing, in the storage device, a list of one or more items for each of a plurality of jurisdictions indicating privacy information that may not be collected without user permission; When the vehicle moves from a first jurisdiction to a second jurisdiction different from the first jurisdiction, the processing circuit queries the user before the vehicle starts traveling in the second jurisdiction to confirm whether or not the user allows privacy information related to the items included in the list related to the second jurisdiction to be stored in the storage device. and storing, by the processing circuitry in the storage device, privacy information associated with the items included in the list related to the second jurisdiction, if the vehicle is located within the second jurisdiction and if authorized by the user. Information management method.

8. An information management program to be executed by an information management device mounted on a vehicle, The information management device includes a processing circuit and a storage device, and the information management program includes: storing in the storage device a list of one or more items for each of a plurality of jurisdictions that indicates privacy information that cannot be collected without user permission; When the vehicle moves from a first jurisdiction to a second jurisdiction different from the first jurisdiction, before the vehicle starts traveling in the second jurisdiction, a query is made to the user to confirm whether or not the user allows privacy information related to the items included in the list related to the second jurisdiction to be stored in the storage device. and storing, in the storage device, privacy information associated with the items included in the list related to the second jurisdiction, if the vehicle is located within the second jurisdiction and if authorized by the user. Information Management Program.

Images