Information management device, information management method, and information management program

Abstract

To appropriately reflect the intention of a user as to whether or not to collect privacy information even when a vehicle moves from a first jurisdiction to a second jurisdiction.SOLUTION: An on-board ECU determines whether or not a list concerning a second jurisdiction has been stored in an information storage module before a vehicle starts traveling in the second jurisdiction which is adjacent to a first jurisdiction in which the vehicle is located (S402). When a determination is made that the list concerning the second jurisdiction has not been stored in the information storage module (S402: NO), the on-board ECU receives the list concerning the second jurisdiction from a data center before the vehicle starts traveling in the second jurisdiction (S404). The on-board ECU inquires of a user whether or not to permit storage of privacy information relating to items included in the list concerning the second jurisdiction in the information storage module (S412).SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to an information management device, an information management method, and an information management program to be mounted on a vehicle. [Background technology]

[0002] Patent Document 1 discloses an information management device mounted on a vehicle. The information management device queries the vehicle user as to whether or not to allow the user's privacy information to be stored in a persistent storage device. Here, the privacy information includes, for example, the user's name, user location information, and vehicle speed.

[0003] If the user permits the storage of the privacy information in the persistent storage device, the information management device stores the user's privacy information in the persistent storage device. If the user refuses the storage of the privacy information in the persistent storage device, the information management device loads the user's privacy information into volatile memory and uses it. In such a case, the user's privacy information is not stored in the persistent storage device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2021-170016 Summary of the Invention [Problem to be solved by the invention]

[0005] Privacy laws applicable in one jurisdiction, such as a country, state, or territory, may differ from those applicable in another jurisdiction.

[0006] For example, if a vehicle user permits collection of privacy information in a country where privacy laws with loose restrictions on collection of privacy information are applied, and then the vehicle moves to a country where strict privacy laws are applied, there is a possibility that privacy information will be collected in the country where strict privacy laws are applied in the same manner as in the country where the loose privacy laws are applied. [Means for solving the problem]

[0007] The means for solving the above problems and their effects will be described below. According to one aspect of the present disclosure, there is provided an information management device to be mounted on a vehicle, the information management device comprising a processing circuit and a storage device, wherein the processing circuit is configured to store in the storage device, for each of a plurality of jurisdictions, a list consisting of one or more items indicating privacy information that cannot be collected without the user's permission, and the processing circuit is configured to: determine whether the list for a second jurisdiction different from a first jurisdiction in which the vehicle is located is stored in the storage device before the vehicle starts traveling in the second jurisdiction; if it is determined that the list for the second jurisdiction is not stored in the storage device, receive the list for the second jurisdiction from a data center before the vehicle starts traveling in the second jurisdiction; and query the user before the vehicle starts traveling in the second jurisdiction to confirm whether or not the user allows privacy information related to the items included in the list for the second jurisdiction to be stored in the storage device. [Effects of the Invention]

[0008] Even when the vehicle moves from a first jurisdiction to a second jurisdiction, the user's intention regarding whether or not to collect privacy information can be appropriately reflected according to the list prepared for each jurisdiction. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram of an information management device according to an embodiment. [Figure 2] FIG. 2 is a flowchart showing a process in which the information management device of FIG. 1 switches between the normal mode and the restricted mode based on whether or not vehicle position information can be acquired. [Figure 3] FIG. 3 is a flow chart illustrating a process for storing privacy settings for the jurisdiction in which the vehicle is currently located. [Figure 4] FIG. 4 is a flow chart illustrating a process for storing privacy settings for jurisdictions to which a vehicle may be directed. [Figure 5] FIG. 5 is a flow chart illustrating the process for authorizing the deletion of a jurisdiction listing. DETAILED DESCRIPTION OF THE INVENTION

[0010] An information management device according to an embodiment will be described below with reference to the drawings. <Outline of Information Management Device 100> Referring to FIG. 1, an overview of an information management device 100 mounted on a vehicle will be described. A current jurisdiction determination module 12 (described later) repeatedly acquires vehicle location information via a GPS sensor 22 (described later) from the time the ignition key is turned on until the time it is turned off. A list consisting of one or more items indicating privacy information that cannot be collected without the user's permission is defined for each of multiple jurisdictions. A storage permission data determination module 16 (described later) is configured to store a list consisting of one or more items indicating privacy information that cannot be collected without the user's permission in an information storage module 20 for each of multiple jurisdictions. Here, a jurisdiction refers to the geographical area within which a law or regulation applies. Examples of jurisdictions include a country, a state, and a territory. Privacy information includes information that does not change during a vehicle trip, such as the user's name, phone number, address, and facial photograph. A trip refers to the period from the time the ignition key is turned on until the time it is turned off. Privacy information includes information that changes from moment to moment during a trip, such as the vehicle's location information and vehicle speed.

[0011] The storage permission data determination module 16 determines whether a list for a second jurisdiction that is adjacent to the first jurisdiction in which the vehicle is located is stored in the information storage module 20 before the vehicle starts traveling in the second jurisdiction. If the storage permission data determination module 16 determines that a list for the second jurisdiction is not stored in the information storage module 20, the storage permission data determination module 16 receives a list for the second jurisdiction from the data center 30 before the vehicle starts traveling in the second jurisdiction.

[0012] As described above, the storage permission data determination module 16 receives a list of jurisdictions adjacent to the jurisdiction in which the vehicle is currently located from the data center 30. This is based on the premise that the on-vehicle ECU 10 is able to communicate with the data center 30. The information storage module 20 stores information indicating that the on-vehicle ECU 10 is unable to communicate with the data center 30 for some of the multiple jurisdictions. The lists for the respective some of the multiple jurisdictions are stored in advance in the information storage module 20.

[0013] The storage permission data determination module 16 stores the privacy settings for each of a plurality of jurisdictions in the information storage module 20. The privacy settings are not erased even when the ignition key is turned off. The privacy settings indicate whether the user has permitted privacy information related to the items included in the list to be stored in the information storage module 20. The privacy settings are stored in response to a user's response to a query made to the user. The timing of the query will be described later with reference to FIGS. 3 and 4.

[0014] The information storage module 20 stores privacy information according to a list for a jurisdiction in which the vehicle is located based on a positive privacy setting for that jurisdiction. A positive privacy setting is a privacy setting indicating that a user has given permission for privacy information related to items on the list to be collected. The information storage module 20 prevents storage of privacy information according to a list for a jurisdiction in which the vehicle is located based on a negative privacy setting for that jurisdiction. A negative privacy setting is a privacy setting indicating that a user has refused to collect privacy information related to items on the list. For example, when a vehicle moves from a first jurisdiction to a second jurisdiction, assume the following (A) to (C): (A) The privacy laws of the first jurisdiction do not require user permission to store vehicle location information in the information storage module 20. (B) The privacy laws of the second jurisdiction require user permission to store vehicle location information in the information storage module 20. (C) The privacy setting for the second jurisdiction is negative. In such a case, the vehicle's location information from when the vehicle enters the first jurisdiction to when it leaves the first jurisdiction is stored in the information storage module 20. The vehicle's location information from when the vehicle enters the second jurisdiction to when it leaves the second jurisdiction is prevented from being stored in the information storage module 20. The vehicle's location information from when the vehicle enters the first jurisdiction to when it leaves the first jurisdiction may be erased after the vehicle enters the second jurisdiction, or may continue to be stored.

[0015] The information management device 100 includes an in-vehicle ECU 10. The information management device 100 further includes a GPS sensor 22, a user interface 24, and a DCM 26 (data communication module). The in-vehicle ECU 10 includes a current jurisdiction determination module 12, a user consent acquisition module 14, a storage permission data determination module 16, and a control module 18. The in-vehicle ECU 10 further includes an information storage module 20. The in-vehicle ECU 10 is connected to an update tool 28 and can receive data from the update tool 28. The in-vehicle ECU 10 can communicate with a data center 30 via the DCM 26.

[0016] The current jurisdiction determination module 12 repeatedly acquires vehicle location information via the GPS sensor 22. The current jurisdiction determination module 12 determines the jurisdiction in which the vehicle is currently located based on the vehicle location information. The current jurisdiction determination module 12 provides current jurisdiction information, which is information indicating the jurisdiction in which the vehicle is currently located, to the storage permission data determination module 16. The current jurisdiction determination module 12 provides determination information to the user consent acquisition module 14 when the distance from the boundary of the jurisdiction in which the vehicle is currently located to the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located is equal to or less than a predetermined distance. Here, the determination information is information indicating that the distance from the boundary of the jurisdiction in which the vehicle is currently located to the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located is equal to or less than a predetermined distance. The predetermined distance is, for example, 5 kilometers.

[0017] The user consent acquisition module 14 makes a query when the ignition key is turned on if no privacy settings are stored for the jurisdiction in which the vehicle is currently located. The query is made via the user interface 24. The query is a process of confirming with the user whether or not to allow privacy information related to items included in the list related to the jurisdiction in which the vehicle is currently located to be stored. The query can be omitted if privacy settings for the jurisdiction in which the vehicle is currently located are stored. Making the query when the ignition key is turned on means that the query is made before the vehicle starts traveling in the jurisdiction in which the vehicle is currently located. A possible embodiment is one in which the user decides whether or not to consent to the storage of privacy information for all items included in the list at once. Alternatively, a user may choose to consent to the storage of privacy information for only some of the items included in the list.

[0018] The user consent acquisition module 14 issues a query when the distance from the border of a jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or less than a predetermined distance. This means that the query is issued before the vehicle starts traveling in the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located. The query is issued via the user interface 24. The query is a process of confirming with the user whether or not to allow the storage of privacy information related to items included in a list related to the jurisdiction in which the vehicle is currently located. The query can be omitted if privacy settings related to the jurisdiction in which the vehicle is currently located and adjacent to the jurisdiction in which the vehicle is currently located are stored. A possible embodiment is that the user decides whether or not to consent to the storage of privacy information for all items included in the list at once. Alternatively, a user may choose to consent to the storage of privacy information for only some of the items included in the list.

[0019] The storage permission data determination module 16 stores privacy information for items included in the list for the jurisdiction in which the vehicle is currently located in the information storage module 20. This is done only if there is an affirmative privacy setting for the jurisdiction in which the vehicle is currently located.

[0020] The storage permission data determination module 16 can receive an update request to update the list for one of the jurisdictions stored in the information storage module 20. When the update request is received, the storage permission data determination module 16 updates the list for one of the jurisdictions in accordance with the update request. The storage permission data determination module 16 may receive the update request, for example, via the DCM 26. Here, over-the-air (OTA) technology is used. Alternatively or additionally, the storage permission data determination module 16 may receive the update request from an update tool 28 connected to the on-vehicle ECU 10.

[0021] The control module 18 acquires various control data and provides the acquired various control data to the information storage module 20 . <Normal mode and restricted mode> The above description with reference to FIG. 1 is based on the assumption that the in-vehicle ECU 10 can repeatedly acquire vehicle position information via the GPS sensor 22. That is, the processing in the normal mode has been described. However, there may be cases where the in-vehicle ECU 10 cannot acquire vehicle position information via the GPS sensor 22. The in-vehicle ECU 10 is in the normal mode when it is able to acquire vehicle position information. The in-vehicle ECU 10 is in the restricted mode when it is unable to acquire vehicle position information. In this way, the in-vehicle ECU 10 can switch between two control modes.

[0022] As shown in FIG. 2, while the ignition key is on, the in-vehicle ECU 10 repeatedly determines whether or not the vehicle position information can be acquired. First, in step S200, the in-vehicle ECU 10 determines whether or not it is possible to acquire vehicle position information. If the in-vehicle ECU 10 makes a positive determination in step S200 (step S200: YES), the process proceeds to step S202. The in-vehicle ECU 10 selects the normal mode in step S202. If the in-vehicle ECU 10 makes a negative determination in step S200 (step S200: NO), the process proceeds to step S204. The in-vehicle ECU 10 selects the restricted mode in step S204.

[0023] In the restricted mode, if the vehicle location information cannot be obtained, the vehicle ECU 10 determines whether to store privacy information related to items included in the default list in the information storage module 20. The default list is a comprehensive list of items indicating privacy information that cannot be collected without the user's permission, covering all of a plurality of jurisdictions. In the restricted mode, the vehicle ECU 10 queries the user to confirm whether to allow privacy information related to items included in the default list to be stored in the information storage module 20. The query can be omitted if privacy settings related to the default list are stored.

[0024] <Processing flow in normal mode> The flow of the process executed by the vehicle-mounted ECU 10 in the normal mode described above will be described in detail with reference to Figures 3 and 4. The process of Figures 3 and 4 is based on the premise that the vehicle-mounted ECU 10 is able to communicate with the data center 30, as described above. If the vehicle-mounted ECU 10 is unable to communicate with the data center 30, the vehicle-mounted ECU 10 queries the user to confirm whether or not to allow privacy information related to items included in the list stored in the information storage module 20 to be stored in the information storage module 20. If privacy settings related to the list are stored, the query can be omitted.

[0025] Fig. 3 shows a flow of processing that is executed when the control mode is the normal mode when the ignition switch is turned on. The processing shown in Fig. 3 is also executed when the control mode is switched from the restricted mode to the normal mode.

[0026] In step S300, the on-vehicle ECU 10 determines whether a list related to the jurisdiction in which the vehicle is currently located has been stored in the information storage module 20. The on-vehicle ECU 10 searches for a list related to the jurisdiction in which the vehicle is currently located using the information stored in the information storage module 20. The on-vehicle ECU 10 searches for the list related to the jurisdiction in which the vehicle is currently located using the information stored in the information storage module 20 and determines whether a corresponding list has been stored in the information storage module 20.

[0027] If the determination in step S300 is negative (S300: NO), the in-vehicle ECU 10 proceeds to step S302. In step S302, the in-vehicle ECU 10 communicates with the data center 30 to receive a list of jurisdictions in which the vehicle is currently located.

[0028] If the on-vehicle ECU 10 makes a positive determination in step S300 (S300: YES), the process proceeds to step S304. In step S304, the on-vehicle ECU 10 determines whether or not there is a newer version of the list than the list already stored in the information storage module 20. For example, the on-vehicle ECU 10 receives data indicating the version number of the list related to the jurisdiction in which the vehicle is currently located from the data center 30. The update date of the list can also be used as the version number of the list. The on-vehicle ECU 10 compares the version number received from the data center 30 with the version number of the list already stored in the information storage module 20. This allows the on-vehicle ECU 10 to determine whether or not there is a newer version of the list.

[0029] If the determination in step S304 is affirmative (S304: YES), the in-vehicle ECU 10 proceeds to step S306. In step S306, the in-vehicle ECU 10 receives the list of new versions from the data center 30.

[0030] If the on-vehicle ECU 10 makes a negative determination in step S304 (S304: NO), the process proceeds to step S308. In step S308, the on-vehicle ECU 10 determines whether the privacy settings related to the jurisdiction in which the vehicle is currently located have been stored. If the on-vehicle ECU 10 makes a positive determination in step S308 (step S308: YES), the process ends.

[0031] After completing the process of step S302 or S306, or if a negative determination is made in step S308 (S308: NO), the in-vehicle ECU 10 proceeds to step S310. In step S310, the in-vehicle ECU 10 queries the user to confirm whether or not to allow privacy information related to items included in the list related to the jurisdiction in which the vehicle is currently located to be stored in the information storage module 20. Since the query is made when the ignition key is turned on, it can be said that the query is made before the vehicle starts traveling in the jurisdiction in which the vehicle is currently located. Next, the in-vehicle ECU 10 proceeds to step S312.

[0032] In step S312, the in-vehicle ECU 10 determines whether the user has given permission. If the in-vehicle ECU 10 determines yes in step S312 (step S312: YES), the in-vehicle ECU 10 proceeds to step S314. In step S314, the in-vehicle ECU 10 stores in the information storage module 20 a privacy setting indicating that the user has given permission.

[0033] When the determination in step S312 is negative (step S312: NO), the in-vehicle ECU 10 proceeds to step S316. In step S316, the in-vehicle ECU 10 stores in the information storage module 20 a privacy setting indicating that the user has refused.

[0034] After executing the process of step S314 or step S316, the in-vehicle ECU 10 ends the flow of FIG. Assume that a vehicle moves from a first jurisdiction to a second jurisdiction adjacent to the first jurisdiction and the ignition key is turned off. In this case, according to the process shown in Figure 3, the following can be said.

[0035] According to step S310, before the vehicle starts traveling in the second jurisdiction, the in-vehicle ECU 10 queries the user to confirm whether or not to allow privacy information related to the items included in the list related to the second jurisdiction to be stored in the information storage module 20. According to steps S202 and S314, the in-vehicle ECU 10 stores privacy information related to the items included in the list related to the second jurisdiction in the information storage module 20, on the condition that the vehicle is located in the second jurisdiction and the user has given permission.

[0036] According to step S308, if the privacy setting for the second jurisdiction is stored in the information storage module 20, the in-vehicle ECU 10 does not make an inquiry. Fig. 4 shows a flow of processing that is repeatedly executed after the ignition switch is turned on, provided that the control mode is the normal mode. The processing shown in Fig. 4 is also repeatedly executed after the control mode is switched from the limited mode to the normal mode.

[0037] In step S400, the in-vehicle ECU 10 determines whether the distance from the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located is equal to or shorter than a predetermined distance. If the determination in step S400 is negative (step S400: NO), the in-vehicle ECU 10 repeats the process of step S400.

[0038] If the determination in step S400 is affirmative (step S400: YES), the in-vehicle ECU 10 proceeds to step S402. In step S402, the on-vehicle ECU 10 determines whether a list of jurisdictions adjacent to the jurisdiction in which the vehicle is currently located has been stored in the information storage module 20. The on-vehicle ECU 10 searches the information stored in the information storage module 20 for a list of jurisdictions adjacent to the jurisdiction in which the vehicle is currently located, the distance from the border of which is within a predetermined distance. The on-vehicle ECU 10 searches the information stored in the information storage module 20 to determine whether a corresponding list has been stored in the information storage module 20.

[0039] When the determination in step S402 is negative (S402: NO), the vehicle ECU 10 proceeds to step S404. In step S404, the vehicle ECU 10 communicates with the data center 30 to receive a list of neighboring jurisdictions.

[0040] If the in-vehicle ECU 10 makes a positive determination in step S402 (S402: YES), the vehicle ECU 10 proceeds to step S406. In step S406, the in-vehicle ECU 10 determines whether or not there is a newer version of the list than the list already stored in the information storage module 20. For example, the in-vehicle ECU 10 receives data indicating the version number of the list related to the neighboring jurisdiction from the data center 30. It is also possible to use the update date of the list as the version number of the list. The in-vehicle ECU 10 compares the version number received from the data center 30 with the version number of the list already stored in the information storage module 20. This allows the in-vehicle ECU 10 to determine whether or not there is a newer version of the list.

[0041] If the determination in step S406 is affirmative (S406: YES), the in-vehicle ECU 10 proceeds to step S408. In step S408, the in-vehicle ECU 10 receives the list of the new version from the data center 30.

[0042] If the determination in step S406 is negative (S406: NO), the vehicle ECU 10 proceeds to step S410. In step S410, the vehicle ECU 10 determines whether or not privacy settings related to adjacent jurisdictions have been stored. If the determination in step S410 is positive (step S410: YES), the vehicle ECU 10 ends the flow in FIG. 4.

[0043] After completing the process of step S404 or S408, or if a negative determination is made in step S410 (S410: NO), the in-vehicle ECU 10 proceeds to step S412. In step S412, the in-vehicle ECU 10 queries the user to confirm whether or not to allow privacy information related to items included in the list related to adjacent jurisdictions to be stored in the information storage module 20. According to steps S400 to S412, the query is made when the distance from the boundary of the jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or less than a predetermined distance. Therefore, it can be said that the query is made before the vehicle starts traveling in the adjacent jurisdiction. Next, the in-vehicle ECU 10 proceeds to step S414.

[0044] In step S414, the in-vehicle ECU 10 determines whether the user has given permission. If the determination in step S414 is affirmative (step S414: YES), the in-vehicle ECU 10 proceeds to step S416. In step S416, the in-vehicle ECU 10 stores in the information storage module 20 a privacy setting indicating that the user has given permission.

[0045] When the determination in step S414 is negative (step S414: NO), the in-vehicle ECU 10 proceeds to step S418. In step S418, the in-vehicle ECU 10 stores in the information storage module 20 a privacy setting indicating that the user has refused.

[0046] After executing the process of step S416 or step S418, the in-vehicle ECU 10 ends the flow of FIG. Assume that a vehicle moves from a first jurisdiction to a second jurisdiction adjacent to the first jurisdiction. In this case, according to the process shown in FIG. 4, the following can be said.

[0047] According to steps S400 and S402, the on-board ECU 10 determines whether a list relating to the second jurisdiction adjacent to the first jurisdiction in which the vehicle is located is stored in the information storage module 20 before starting travel in the second jurisdiction.

[0048] According to steps S402 and S404, if the vehicle ECU 10 determines that the list for the second jurisdiction is not stored in the information storage module 20, it receives the list for the second jurisdiction from the data center 30 before the vehicle starts traveling in the second jurisdiction.

[0049] According to steps S402 and S406, when the in-vehicle ECU 10 determines that the list for the second jurisdiction is already stored in the information storage module 20, the in-vehicle ECU 10 determines whether or not there is a newer version of the list for the second jurisdiction than the list for the second jurisdiction already stored in the information storage module 20. According to steps S406 and S408, if there is a newer version of the list for the second jurisdiction than the list for the second jurisdiction already stored in the information storage module 20, the in-vehicle ECU 10 receives the newer version of the list for the second jurisdiction from the data center 30 and updates the list for the second jurisdiction stored in the information storage module 20.

[0050] According to steps S400 to S412, the in-vehicle ECU 10 makes an inquiry when the vehicle is located in the first jurisdiction and the distance from the boundary of the second jurisdiction is equal to or shorter than the predetermined distance.

[0051] According to steps S400 to S412, the in-vehicle ECU 10 queries the user before the vehicle starts traveling in the second jurisdiction to confirm whether or not to allow privacy information related to the items included in the list related to the second jurisdiction to be stored in the information storage module 20. According to steps S202 and S416, the in-vehicle ECU 10 stores privacy information related to the items included in the list related to the second jurisdiction in the information storage module 20, on the condition that the vehicle is located in the second jurisdiction and the user has given permission.

[0052] According to step S410, if the privacy setting for the second jurisdiction is stored in the information storage module 20, the in-vehicle ECU 10 does not make an inquiry. <Clear list> The process of deleting the list will be described with reference to Figure 5. Here, the process after the vehicle moves from a first jurisdiction to a second jurisdiction adjacent to the first jurisdiction will be described. There are cases where the on-vehicle ECU 10 can acquire the list related to the first jurisdiction from the data center 30 within a predetermined distance from the boundary of the first jurisdiction. There are cases where the on-vehicle ECU 10 cannot acquire the list related to the first jurisdiction from the data center 30 within a predetermined distance from the boundary of the first jurisdiction.

[0053] Immediately after the vehicle leaves the first jurisdiction, the information storage module 20 stores a list related to the first jurisdiction. In step S500, the on-vehicle ECU 10 determines whether the distance from the boundary between the first jurisdiction and the second jurisdiction is equal to or greater than a specified distance. The specified distance is greater than a predetermined distance. If the on-vehicle ECU 10 makes a positive determination in step S500 (S500: YES), the process proceeds to step S502.

[0054] In step S502, the on-vehicle ECU 10 determines whether or not a list related to the first jurisdiction can be acquired from the data center 30 within a predetermined distance from the boundary of the first jurisdiction. As described above, the information storage module 20 stores information indicating that the on-vehicle ECU 10 is unable to communicate with the data center 30 for some of the multiple jurisdictions. That is, in step S502, the on-vehicle ECU 10 determines whether or not information indicating that communication with the data center 30 is unable for the first jurisdiction is stored in the information storage module 20. In step S502, if the information storage module 20 does not store information indicating that communication with the data center 30 is unable for the first jurisdiction, the on-vehicle ECU 10 makes a positive determination. In step S502, if the information storage module 20 stores information indicating that communication with the data center 30 is unable for the first jurisdiction, the on-vehicle ECU 10 makes a negative determination. If the determination in step S502 is affirmative, the in-vehicle ECU 10 proceeds to step S504.

[0055] In step S504, the in-vehicle ECU 10 permits erasure of the list related to the first jurisdiction stored in the information storage module 20. In step S504, for example, the list related to the first jurisdiction may be completely erased. Alternatively, the area in which the list related to the first jurisdiction is stored may be overwritten. Similarly, erasure of the privacy settings related to the first jurisdiction may also be permitted.

[0056] According to steps S500 to S504, the on-board ECU 10 can erase the list related to the first jurisdiction when the vehicle moves from the first jurisdiction to the second jurisdiction, and then is located outside the first jurisdiction and the distance from the boundary between the first jurisdiction and the second jurisdiction is equal to or greater than a specified distance that is greater than a predetermined distance.

[0057] <Effects of this embodiment> (1) A comparative example can be considered in which a list consisting of one or more items indicating privacy information that cannot be collected without the user's permission is stored in the information storage module 20 for each of multiple jurisdictions. In this embodiment, the on-vehicle ECU 10 receives from the data center 30 a list related to jurisdictions adjacent to the jurisdiction in which the vehicle is currently located that is not already stored in the information storage module 20. That is, the on-vehicle ECU 10 acquires the list appropriately depending on the vehicle's location. This makes it easier to increase the free space in the information storage module 20 compared to the comparative example. The on-vehicle ECU 10 can confirm the user's intention regarding whether or not to collect privacy information using the list acquired in this manner. Even when the vehicle moves from a first jurisdiction to a second jurisdiction, the user's intention regarding whether or not to collect privacy information can be appropriately reflected according to the list prepared for each jurisdiction.

[0058] (2) When the vehicle ECU 10 determines that the list for the second jurisdiction is already stored in the information storage module 20, the vehicle ECU 10 is configured to determine whether the information storage module 20 has a newer version of the list for the second jurisdiction than the list for the second jurisdiction already stored, and if the information storage module 20 has a newer version of the list for the second jurisdiction than the list for the second jurisdiction already stored, receive the newer version of the list for the second jurisdiction from the data center 30 and update the list for the second jurisdiction stored in the information storage module 20.

[0059] When there is a newer version of the list than the one already stored in the information storage module 20, the in-vehicle ECU 10 receives the newer version from the data center 30. Therefore, it becomes possible to appropriately handle privacy information using the new version of the list.

[0060] (3) The in-vehicle ECU 10 is configured to receive the list related to the second jurisdiction from the data center 30 when the distance from the boundary between the first jurisdiction and the second jurisdiction becomes equal to or shorter than a predetermined distance.

[0061] According to this embodiment, the in-vehicle ECU 10 receives the list related to the second jurisdiction from the data center 30 when it becomes highly likely that the vehicle will move to the second jurisdiction. This reduces the possibility that the in-vehicle ECU 10 will receive the list related to the second jurisdiction even when the vehicle is unlikely to move to the second jurisdiction. In other words, unnecessary processing is less likely to occur.

[0062] (4) The on-board ECU 10 is configured to be able to erase the list related to the first jurisdiction when, after the vehicle moves from the first jurisdiction to the second jurisdiction, it is located outside the first jurisdiction and the distance from the boundary between the first jurisdiction and the second jurisdiction is greater than a specified distance that is greater than a predetermined distance.

[0063] According to this embodiment, the free space of the information storage module 20 can be easily increased. <Example of change> This embodiment can be modified as follows: This embodiment and the following modifications can be combined and implemented within the scope of technical compatibility.

[0064] In the above embodiment, the information storage module 20 stores information indicating that the in-vehicle ECU 10 cannot communicate with the data center 30 for some of the multiple jurisdictions. Respective lists for the some of the multiple jurisdictions are stored in advance in the information storage module 20. However, this is merely an example. For example, if the in-vehicle ECU 10 cannot communicate with the data center 30, a default list may be used.

[0065] The on-board ECU 10 is configured to determine a route to reach the destination based on information indicating the vehicle's destination set by the user, and the receiving of the list related to the second jurisdiction from the data center 30 and the sending of a query to the user to confirm whether or not the user allows privacy information related to items included in the list related to the second jurisdiction to be stored in the information storage module 20 may be performed only when part of the route is included in the second jurisdiction. This configuration avoids the waste of receiving the list related to the second jurisdiction even when the vehicle is not scheduled to travel through the second jurisdiction. Furthermore, it also avoids the waste of sending a query to the user using the list related to the second jurisdiction.

[0066] The on-board ECU 10 may be configured to determine a route to reach the destination based on information indicating the vehicle's destination set by the user, and if the route indicates that the vehicle will move from a first jurisdiction to a second jurisdiction and then return to the first jurisdiction, the on-board ECU 10 may be configured to not allow the list for the first jurisdiction to be deleted even if the vehicle is located outside the first jurisdiction and the distance from the boundary between the first and second jurisdictions is equal to or greater than a specified distance. This can avoid a situation in which the list for the first jurisdiction is deleted after the vehicle leaves the first jurisdiction, even though the vehicle plans to return to the first jurisdiction after leaving the first jurisdiction.

[0067] In the above embodiment, examples of jurisdictions include countries, states, and territories. However, jurisdictions are not necessarily limited to these. For example, if multiple neighboring countries apply the same privacy laws, these multiple neighboring countries may be considered as a single jurisdiction.

[0068] In the above embodiment, the in-vehicle ECU 10 makes an inquiry when the distance from the border of a jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or shorter than a predetermined distance. However, this is merely an example. For example, a geofence may be configured to surround the adjacent jurisdiction. In such a case, the in-vehicle ECU 10 makes an inquiry when the vehicle enters the geofence.

[0069] In the above embodiment, the in-vehicle ECU 10 makes an inquiry based on the fact that the distance from the border of a jurisdiction adjacent to the jurisdiction in which the vehicle is currently located becomes equal to or shorter than a predetermined distance. However, this is merely an example. The in-vehicle ECU 10 may also make an inquiry based on the fact that the distance from the border of a jurisdiction different from the jurisdiction in which the vehicle is currently located becomes equal to or shorter than a predetermined distance. In other words, another jurisdiction may exist between the jurisdiction in which the vehicle is currently located and the jurisdiction related to the inquiry.

[0070] In the above embodiment, the privacy settings are not erased when the ignition key is turned off. Alternatively, the privacy settings may be erased when the ignition key is turned off.

[0071] The process of step S502 shown in FIG. 5 may be omitted. The entire process flow shown in FIG. 5 may be omitted. In the above embodiment, the information management device 100 includes an in-vehicle ECU 10 having a plurality of modules 12 to 18 and an information storage module 20. The in-vehicle ECU 10 executes software processing. However, this is merely an example. For example, some of the plurality of modules 12 to 18 may constitute a single module. Furthermore, for example, the in-vehicle ECU 10 may include a dedicated hardware circuit (e.g., ASIC, etc.) that processes at least part of the software processing executed in the above embodiment. That is, the in-vehicle ECU 10 may have any of the following configurations (a) to (c): (a) The in-vehicle ECU 10 includes a processing device that executes all processing according to a program and a program storage device such as a ROM that stores the program. That is, the in-vehicle ECU 10 includes a software execution device. (b) The in-vehicle ECU 10 includes a processing device that executes part of the processing according to a program and a program storage device. Furthermore, the in-vehicle ECU 10 includes a dedicated hardware circuit that executes the remaining processing. (c) The in-vehicle ECU 10 includes a dedicated hardware circuit that executes all processing. Here, there may be a plurality of software executing devices and / or dedicated hardware circuits. That is, the above processes may be performed by processing circuitry including at least one of a software executing device and a dedicated hardware circuit. The processing circuitry may include a plurality of software executing devices and dedicated hardware circuits. Program storage devices, i.e., computer-readable media, include storage devices, which are any available media that can be accessed by a general-purpose or special-purpose computer. [Explanation of symbols]

[0072] 10... In-vehicle ECU, 12... Current jurisdiction determination module, 14... User consent acquisition module, 16... Storage permission data determination module, 20... Information storage module, 22... GPS sensor, 24... User interface, 26... DCM, 28... Update tool, 30... Data center, 100... Information management device

Claims

1. An information management device mounted on a vehicle, processing circuitry and storage; the processing circuitry is configured to store in the storage device, for each of a plurality of jurisdictions, a list of one or more items indicating privacy information that may not be collected without user permission; The processing circuitry determining whether the list for a second jurisdiction different from the first jurisdiction in which the vehicle is located is stored in the storage device before commencing travel in the second jurisdiction; if it is determined that the list for the second jurisdiction is not stored in the storage device, receiving the list for the second jurisdiction from a data center before the vehicle starts traveling in the second jurisdiction; and querying the user before the vehicle begins traveling in the second jurisdiction to confirm whether or not privacy information related to the items included in the list related to the second jurisdiction is permitted to be stored in the storage device. Information management device.

2. The processing circuitry when determining that the list for the second jurisdiction is already stored in the storage device, determining whether there is a newer version of the list than the list for the second jurisdiction already stored in the storage device; if the storage device has a newer version of the list for the second jurisdiction than the list for the second jurisdiction already stored in the storage device, receiving the newer version of the list for the second jurisdiction from the data center and updating the list for the second jurisdiction stored in the storage device. The information management device according to claim 1 .

3. the processing circuitry is configured to receive the list for the second jurisdiction from the data center based on the first jurisdiction being a distance from a boundary between the first jurisdiction and the second jurisdiction being less than or equal to a predetermined distance; 3. The information management device according to claim 1 or 2.

4. the processing circuitry is configured to clear the list for the first jurisdiction when, after the vehicle moves from the first jurisdiction to the second jurisdiction, the vehicle is located outside the first jurisdiction and is a distance from the boundary between the first jurisdiction and the second jurisdiction that is equal to or greater than a predetermined distance that is greater than the predetermined distance. The information management device according to claim 3 .

5. the processing circuitry is configured to determine a route to reach the destination based on information indicating a destination of the vehicle set by the user; receiving the list for the second jurisdiction from the data center and querying the user to confirm whether or not privacy information related to the items included in the list for the second jurisdiction is permitted to be stored in the storage device only if a portion of the path is included in the second jurisdiction; The information management device according to claim 1 .

6. the processing circuitry is configured to determine a route to reach the destination based on information indicating a destination of the vehicle set by the user; configured to not allow the list for the first jurisdiction to be deleted if the route indicates that the vehicle will travel from the first jurisdiction to the second jurisdiction and then return to the first jurisdiction, even if the vehicle is located outside the first jurisdiction and the distance from the boundary between the first jurisdiction and the second jurisdiction is equal to or greater than the specified distance. The information management device according to claim 4 .

7. An information management method using an information management device mounted on a vehicle, comprising: the information management device comprises a processing circuit and a storage device; the processing circuitry is configured to store in the storage device, for each of a plurality of jurisdictions, a list of one or more items indicating privacy information that may not be collected without user permission; The information management method includes: the processing circuit determines whether the list for a second jurisdiction different from the first jurisdiction in which the vehicle is located is stored in the storage device before commencing travel in the second jurisdiction; if it is determined that the list for the second jurisdiction is not stored in the storage device, the processing circuit receives the list for the second jurisdiction from a data center before the vehicle starts traveling in the second jurisdiction; the processing circuit queries the user before the vehicle begins traveling in the second jurisdiction to confirm whether privacy information related to the items included in the list related to the second jurisdiction is permitted to be stored in the storage device. Information management method.

8. An information management program to be executed by an information management device mounted on a vehicle, The information management device includes a processing circuit and a storage device, and the processing circuit is configured to store in the storage device, for each of a plurality of jurisdictions, a list of one or more items indicating privacy information that cannot be collected without a user's permission. The information management program: determining whether the list for a second jurisdiction different from the first jurisdiction in which the vehicle is located is stored in the storage device before commencing travel in the second jurisdiction; if it is determined that the list for the second jurisdiction is not stored in the storage device, receiving the list for the second jurisdiction from a data center before the vehicle starts traveling in the second jurisdiction; and querying the user before the vehicle begins traveling in the second jurisdiction whether or not the user permits privacy information associated with the items included in the list for the second jurisdiction to be stored in the storage device. Information Management Program.

Images