Could insurers' use of aerial images violate data privacy law?

When a California resident recently called out his insurance company for canceling his homeowner's policy after taking aerial photos of his backyard and finding "clutter," it was a surprise to many. The homeowner had been a customer of California State Automobile Association (CSAA) Insurance Group for 15 years, had never filed a claim and did not live in a wildfire zone.

Insurers' use of AI and aerial photography is relatively new and not in the public eye. And it may infringe on state data privacy laws.

California is one of twelve states that have passed laws that restrict companies' use of consumers' personally identifiable information. 

"Personal information is defined incredibly broadly under all of the state legislation to include not only things you would think of, like name, email, address, physical address, but it's also inferences, things that you can derive about a person," said Shannon Yavorsky, head of Orrick's global cyber, privacy and data Innovation group. "It's things like your GPS coordinates, your geolocation, your IP address. So the definition of personal information is any information that can be directly or indirectly linkable to an individual. So all of the information captured by [aerial imagery] above a property is arguably personal information."

In a statement, CSAA said, "CSAA Insurance Group evaluates many sources of information to assess the condition of properties it insures, including third-party proprietary aerial imagery captured by fixed-wing aircraft and satellites, in compliance with all provisions of applicable state law. The third-party proprietary aerial imagery we evaluate provides accurate inspections, a less-intrusive customer experience, and produces better pricing, improved underwriting decisions, and stronger risk selection."

When insurers use aerial images in coverage decisions, the consequences for insurance policyholders can be dire, as their policies can be revoked at any moment due to images they didn't know were being taken.

"It's jarring to think you are so vulnerable to these sweeping decisions that affect your financial life," said Allison Sagraves, an adjunct professor at Carnegie Mellon and former chief data officer at a large financial institution. "Who knew anybody was looking at this?"
 

Legal questions

The California Privacy Protection Agency, which created and enforces California's law, declined a request for comment, but pointed me to an FAQs page.

The law follows several basic principles that are also incorporated in other state laws and Europe's General Data Protection Rule, according to Yavorsky. 

The first principle is notice and consent: Companies need to tell customers what information is going to be collected about them and get their consent to gather personal information. 

Another core principle is data minimization, which means capturing only the data needed and, for instance, not picking up data about a neighbor's property. A third is purpose limitation – only using the data for the purpose for which it was collected and not for, say, marketing. A fourth is data security. 

"When I'm thinking through those privacy principles that are enshrined in all of the 12 state privacy laws, I don't know if the insurance companies are providing notice to people that the data is being collected," Yavorsky said. "I see potential challenges in relation to all of these really core privacy principles." 

CJ Sveen, the CSAA customer who said his insurance policy was canceled due to an aerial image taken of his property, told ABC News that he only found out about the aerial photos after his policy was terminated and he called the company to ask about it and was told that the company had flown a drone over his backyard and taken pictures of it. Later, a spokesperson for CSAA told Digital Insurance it did not use a drone, it used an analysis of aerial imagery conducted by Cape Analytics, a provider of AI-based property intelligence data. 

Typically, insurance carriers obtain aerial images from providers like Geospatial Insurance Consortium, EagleView or Maxar Technologies, which operate drones, planes or satellites that fly over large metropolitan areas and capture images. 

An insurance carrier passes the images of a property on to a property intelligence firm like Cape Analytics to find potential risks on a property, such as solar panels or a swimming pool. The company might compile the characteristics relevant to a wildfire (such as vegetation close to a property and a wood roof) and come up with a wildfire risk score for the property. 

Property intelligence companies know their AI models are not infallible, so they advise carriers to not make decisions that affect a policy based on this data alone, but to use corroborating information. And when a high risk is flagged, they recommend that a human underwriter review the information and preferably send an inspector to the home to verify it. 

State privacy laws are still new, Yavorsky noted, which may explain why state regulators haven't cracked down. California's law came first; it took effect in January 2020.

Only four state data privacy laws are in effect today, in California, Virginia, Colorado, and Connecticut. Utah's law will take effect in December.

"Right now, the laws are very new," Yavorsky said. "So I think a lot of these things just haven't worked their way through the system yet." 

Consequences for policyholders

Sagraves pointed out that from an insurance company's point of view, aerial imagery could theoretically help it make more informed decisions about coverage and pricing.

"There's certainly a compelling business case from the insurance industry to argue that, now we're able to tell if people have pools," she said. "Apparently a lot of people put pools in during covid. Now we're able to see, is there a tree hanging over the roof? Is there vegetation in a yard that could present wildfire risks? So now with very sophisticated aerial surveillance, very precise data about what's going on, that's rich information for insurers to be much more targeted in assessing and pricing risk, which is becoming a huge issue as we're seeing with these catastrophes, climate change and so forth."

However, she noted, the use of aerial images and AI creates "information asymmetry."

"Before, the customer in some ways had a little more information about, did they put an addition on [their house]? Do they have a pool? How old is the roof, really?" Sagraves said. "You could argue that tilted in some cases toward the individual who may not have revealed everything about their property, whether that was intentional or by design or by default."

Technology like aerial image analysis tilts the information asymmetry in the favor of insurance companies, she said. 

"The public is not really aware that this shift has happened," Sagraves said. "And the implications of such a shift in the power dynamics between the insurer and the consumer are massive and have significant consequences in terms of even the potential value of your property."

Such surveillance could also be considered overreach.

"It is surprising that this is not a discussion that seems to be very visible in the public square," Sagraves said. "And I think this is an example of how technology is advancing so quickly and the implications of that technology for people, for towns, for communities, for society are sweeping. This is a great example, once again, where we have technological capabilities that are more advanced than the regulatory frameworks to govern them."