Autonomous vehicles


Explore this page

Explore this page




Speed, fatigue and alcohol remain the main causes of death and injury on Australian roads.

Place of residence, age and medical conditions affect freedom of mobility.

Autonomous vehicles are reaching the capacity to positively influence those social issues and there is likely to be a significant shift in car ownership from individuals to conglomerates. It is a race now for our laws and other social responses to adapt in time so that there is confidence in the deployment of autonomous vehicles and so that economic and social benefits are realised rather than hindered.

Australia wants to keep pace with the rest of the world in the application of technology to the planning and management of future transport systems.

One of the fundamental underlying premises of the development and adoption of autonomous vehicles is that the result will be improvement, perhaps a very substantial improvement, in the rate of fatalities and other injuries associated with the use of motor vehicles. Aside from the obvious benefits to the community in decreasing the numbers of deaths and injuries, there is a substantial economic advantage in doing this; the cost to society of road crashes in Australia has been estimated at some AU$27 billion annually.

Our governments are working with industry, investors, academics and the private sector to position Australia as a place to test and develop autonomous vehicle technology so that existing infrastructure and social systems can accommodate emerging vehicles. However, in undertaking that work, Australia’s present policy position recognizes the importance of not getting ahead of international developments.1

This chapter draws on the insight and expertise of our lawyers to summarise the key legal issues as these innovative machines continue to be developed, tested and deployed in Australia. 

Those key legal issues include:

  • Regulatory
  • Product Liability
  • Privacy and Cybersecurity
  • Intellectual Property
  • Insurance

There is no doubt that the introduction of this technology will result in the most radical changes to the ground-based transport industry since the invention of the car over 130 years ago.

There will be a shift in car ownership to conglomerates such as mobility companies. Together with a potential decrease in the number of vehicles due to “ride sharing” of autonomous vehicles, there will also be a shift in emphasis from product supply to service provision. The shift will affect public transport options and bear upon what infrastructure will be necessary to support those services.

This section leads interested industry participants and observers through Australia’s legal response to the exciting and keenly anticipated introduction of autonomous vehicles.


Australia’s Transport Infrastructure Council has said that “Australia is aiming to have end-to-end regulation in place by 2020 to support the safe, commercial deployment and operation of autonomous vehicles at all levels of automation.”

In the meantime, a human driver must remain in control of vehicles driven in Australia. Nevertheless, guidelines for the trials of autonomous vehicles contemplate trials without drivers or operators by providing a basis for conditions of a permit or exemption.

This situation provides flexibility to foster innovation without compromising safety.

Indeed, vehicles that do not require human input for part or all of a trip are already being trialled on Australian roads and are likely to become commercially available from around 2020.

Like most innovation, rapid leaps forward follow long periods of hard work. A disciplined and comprehensive approach is important in order to raise awareness, identify infrastructure needs and assure the public about the ongoing safe use of our roads.

Some major work completed to date relates to identifying barriers to autonomous vehicles; issuing guidelines for trials of autonomous vehicles; and, as is discussed in the next section, the development of a safety assurance system for those vehicles based on mandatory self-certification.

Work will now begin on developing a harmonized, purpose built national law to facilitate vehicles being driven at higher levels of automation. The challenge here is whether Australia can truly lead developments or whether it needs to respect progress being made in other countries in order to avoid departing from a global approach. In 2018, the National Transport Commission will also review data access arrangements (see Privacy, cybersecurity and technology issues below) and insurance (see Insurance below).

The balance of this section addresses the framework for driving laws in Australia and some of the recent and expected regulatory developments. More detail also follows in later sections concerning product liability, cybersecurity, privacy, intellectual property and insurance.


Under the Australian Constitution, the federal government has law-making power in relation to defined matters only, while the states and territories have law-making power over all other matters that occur within their borders. The federal government’s law-making power does not cover the road network, vehicle operation, driver licensing or vehicle registration. Each state and territory has its own laws on these matters.

However, there is a large degree of consistency in the road rules adopted by each state and territory, as they are based on the Model Australian Road Rules. Other state and territory laws that govern the actions of road users and road safety include laws regulating the transport of dangerous goods, use of heavy vehicles and offences related to intoxication.

It is generally recognized that there is a need for a nationally consistent approach to addressing matters relevant to deployment of autonomous vehicles.

Relevant policy organisations

The National Transport Commission is an independent federal statutory body that provides advice and proposals for reform to government for consideration and approval through the Transport and Infrastructure Council. The Transport Infrastructure Council is made up of federal, state and territory ministers who are responsible for transport and infrastructure.

Austroads is the peak organisation of Australasian road transport and traffic agencies. The Austroads Connected and Autonomous Vehicles program is working with key government and industry stakeholders towards establishing the required supporting frameworks for automated and connected vehicles. The program has a Board, which provides strategic direction for the program, made up of senior representatives from Austroads, the federal government and the National Transport Commission. There is also an Industry Reference Group.2

Autonomous vehicles national reform program

The Australian Road Rules and other driving laws are currently based on the principle that a human driver is in control of the vehicle. For example, Australian Road Rule 297 provides that “a driver must not drive a vehicle unless the driver has proper control.” The terms “control” and “proper control” are not defined in the road rules.

As is the case in other countries, the National Transport Commission is using the levels of driving automation set out in SAE International Standard J3016 (SAE J3016). Under that standard, human-driven vehicles have been allocated Levels 0 to 2. Many vehicles operate at Level 0 or Level 1. Those levels involve no driving automation or some driver assistance (for example, cruise control). Level 2 vehicles are those where a driving system may take control of steering and braking in defined circumstances but a human must monitor the environment and intervene when required.

Most relevant, Level 3, 4 and 5 vehicles are vehicles capable of automated operation at conditional, high and full automation.

In its policy paper titled Changing driving laws to support autonomous vehicles May 2018 the National Transport Commission summarizes Levels 3, 4 and 5 as follows:

  • Conditional automation means the ADS undertakes the entire dynamic driving task for sustained periods in defined circumstances. The human driver does not have to monitor the driving environment or the ADS but must be receptive to ADS requests to intervene and any system failures.
  • High automation means that the ADS undertakes the entire dynamic driving task for sustained periods in some situations, or all of the time in defined places. When the system is driving the vehicle, a human driver is not required to monitor the driving environment and the driving task or to intervene and the ADS can bring the vehicle to a safe stop unassisted.
  • Full automation means all aspects of the dynamic driving task and monitoring of the driving environment are undertaken by the ADS. The ADS can operate on all roads at all times. No human driver is required.

Early work and recent legislative changes

Starting in 2015, the National Transport Commission began identifying regulatory barriers to the introduction of autonomous vehicles. Following a 12 month investigation, the Transport Infrastructure Council agreed to the following actions to take place by 2018:

  • Develop national guidelines governing conditions for trials of autonomous vehicles. This is complete.
  • Develop national enforcement guidelines that clarify regulatory concepts of control and proper control for different levels of driving automation. This is complete.
  • Review current exemption powers to ensure legislation can support on-road trials. Where necessary, various jurisdictions have made or are making changes to facilitate trials. This is ongoing.
  • Design and develop a safety assurance regime for automated road vehicles. A mandatory self-certification approach has been agreed but requires legislative change. This is ongoing.
  • Develop legislative reform options to clarify the application of current driver and driving laws to autonomous vehicles, and to establish legal obligations for automated driving system entities. In May 2018, transport ministers considered reform options to facilitate vehicles being driven at higher levels of automation. The Transport Infrastructure Council has directed the National Transport Commission to work on a harmonized national law. It is likely, though, that the self-certification approach for safety assurance will be bolstered by the imposition of a primary safety duty on automated driving system entities. That will also require legislative change. The National Transport Commission will adopt what its Chief Executive describes as a “fast follower” approach. This is ongoing.
  • Review injury insurance schemes. This will occur later in 2018.
  • Develop options to manage government access to autonomous vehicle data that balances road safety and network efficiency outcomes and efficient enforcement of traffic laws with sufficient privacy protections for autonomous vehicle users. This will be delivered in 2019.

Examples of recent or pending legislative change include:

  • The Road Vehicle Standards Bill 2018 (Cth) was introduced into the Australian federal parliament on February 7, 2018. The core objects of this bill are to provide for the regulation of road vehicles and road vehicle components, to set national road vehicle standards and to give effect to Australia’s international obligations to harmonize road vehicle standards. As of September 4, 2018, this bill had not yet passed.
  • In 2016, South Australia passed the Motor Vehicles (Trials of Automotive Technologies) Amendment Act 2016 (SA). It amended the Motor Vehicles Act 1959 (SA). The amendments provide a framework to facilitate on-road trials, testing and development of driverless vehicles and other advanced automotive technology on South Australian roads.
  • In 2017, New South Wales passed the Transport Legislation Amendment (Automated Vehicle Trials and Innovation) Act 2017 (NSW). That Act made amendments to the Road Transport Act. The amendments established a legislative framework to provide for the safe testing of autonomous vehicle technology in New South Wales.
  • In 2018, Victoria passed the Road Safety Amendment (Automated Vehicles) Act 2018 which amended the Road Safety Act 1986. The main purpose of the amendments is to authorise testing and development (trials) of autonomous vehicles on Victorian roads; and to implement the government’s commitment to support trials of autonomous vehicles at any level of automation, as agreed at the meeting of the Transport Infrastructure Council in November 2016.

As a result of the above changes or as a result of the flexibility within current legislation, trials are planned, current or already completed in all of Australia’s states and territories except for Tasmania. Participants have included universities, local and foreign corporations, communications companies and governments.

Current focus areas

More detail regarding some of the recent focus areas appears below.

Enforcement guidelines

In November 2017, the Transport Infrastructure Council approved national Enforcement Guidelines (Enforcement Guidelines). The Enforcement Guidelines address how the requirement of “proper control” in Australian Road Rule 297 should apply to vehicles with automated functions. The Enforcement Guidelines confirm that the human driver is responsible for complying with road traffic laws, including when a vehicle has up to conditional automation (i.e., Level 3 automation) engaged at a point in time.3

The accompanying policy paper to the Enforcement Guidelines, Assuring the Safety of Automated Vehicles, made the following key points regarding the issue of control:

  • the human driver remains in control of vehicles operating at partial automation – they must supervise the driving environment and perform some of the driving;
  • there is no international consensus regarding control of a vehicle operating at Level 3; and
  • once recognised in legislation, the automated driving system entity is likely to be deemed to be in control of and responsible for vehicles operating at high or full automation, because the automated driving system performs the entire driving task.

As long as cars have had drivers and steering wheels, police have generally interpreted “proper control” to mean that the driver was in the driver’s seat and had (at least) one hand on the steering wheel. With the rise of autonomous vehicles, new indicators of proper control will include alertness and readiness to take over the driving task. How is that assessed? Does this mean the driver still needs to have a hand on the steering wheel? Will there even be a steering wheel?

The indicators of proper control in the Enforcement Guidelines depend on the level of automation, ranging from still needing one hand on the wheel for Level 1 automation, to this requirement not applying when driving vehicles with Levels 2 or 3 automation.

In all levels of automation up to Level 3, the driver must be alert enough to resume the entire driving task if requested or there is a system failure (e.g., eyes open, checking external environment). In Level 3 automation, the driver must not engage in activities that prevent them from responding to take over demands, are not in line with the intended use of the automated driving function, or are prohibited by law.4

The Enforcement Guidelines are not intended to cover Level 4 and Level 5 automation. Legislative reform will be necessary to allow an automated driving system to perform driving tasks at those levels of automation. It will then be necessary to clarify the entity responsible for that system. The entity responsible for the system could be its manufacturer, its operator or its owner for example.

Proposed changes to driving laws to recognise automated driving system entity as a driver

In October 2017, the National Transport Commission issued a discussion paper titled Changing Driving Laws to Support Automated Vehicles (Discussion Paper). In May 2018, it also published a corresponding policy paper (Policy Paper)5 after getting feedback on the Discussion Paper. The National Transport Commission considers the options to clarify how current driving laws apply to autonomous vehicles and to establish legal obligations for automated driving system entities.6 The National Transport Commission recognizes the need to balance removal of current legislative barriers while maintaining the key intent of the driving laws to ensure safe operation of vehicles on Australian roads.7

As an automated driving system is a system, not a legal person, it is not covered by current definitions of “driver” in Australian legislation.8 It therefore cannot currently be held responsible for its actions/inactions or for any non-compliance with transport laws. To ensure safety, it is necessary to be able to assign legal responsibility for the actions of the system and the operation of a vehicle.9 In principle, a system should only be responsible for those things over which it can have control, e.g., the dynamic driving task within its operational design domain.10 Current legislation places obligations on human drivers in addition to the dynamic driving task, such as requirements to carry particular documentation and to pay parking fees/tolls.11

As noted in the Discussion Paper, a key question for reform is that if a system is legally permitted to perform the dynamic driving task, who should have responsibility for the duties that legislation currently assigns to a driver? The National Transport Commission proposes the following:

  • If an automated driving system is performing a dynamic driving task it should be considered in control of the vehicle;
  • An entity responsible for the system should be made legally responsible for the actions of the system relating to a dynamic driving task, including complying with traffic laws;
  • The automated driving system entity should not generally be responsible for driver duties that it cannot and should not control.12

Being in control of a vehicle means being responsible for the actions of the vehicle, including for breaches of traffic laws or involvement in a crash.13 A person in the vehicle should not be responsible for contraventions of the law while the system is engaged to undertake a driving task it is designed to perform. To hold the human responsible in this case may restrict the introduction of autonomous vehicles in Australia.14

The National Transport Commission’s preferred approach is to recognize the automated driving system as being in control of the vehicle at conditional, high and full levels of automation, when the automation is engaged. In the case of vehicles with conditional automation, new “readiness to drive” obligations will need to be imposed on the fall back drivers, to ensure they are alert and ready to take control if necessary.15

At the time of its Discussion Paper, the National Transport Commission’s initial assessment was that expanding the definition of driver in relevant legislation to include an automated driving system when it is engaged, and make the automated driving system entity responsible for the actions of that system, would be more efficient than other options.

However, in the Policy Paper the National Transport Commission has adopted the position that a separate national law should be developed to clarify the application of current driver and driving laws to autonomous vehicles rather than only making changes to the Australian Road Rules and other Acts.16

Safety issues – fatigue, drugs and alcohol

In most states and territories, it is an offence to “drive” or “attempt to put in motion” a vehicle while under the influence of alcohol or any other drug.17

The definition of “drive/driving” has been considered in a range of cases including Tink v Francis18 in which it was said:

The question whether a person in given circumstances is driving the car will often turn on the extent and degree to which the person was relying on the use of the driver’s controls…The ordinary meaning to be attached to the word ‘drives’ when applied to a motor car should, I think, embrace the notion of some control of the propulsive force which, if operating, will cause the car to move.

The National Transport Commission considers that legislative amendments could be made to exempt people from drink or drug driving offences who start a vehicle with high or full automation because human involvement in the driving task is not required. Nevertheless, a person who starts an autonomous vehicle and who may take over the driving at some point should not be exempt from drink or drug driving offences.19

Regarding issues of fatigue and fatigue management, provisions under the Heavy Vehicle National Law would not be relevant for an automated driving system. However, they would be relevant in the case of a “fall back driver” in a vehicle with conditional automation.20

Further, if existing penalties in relation to the above issues become applicable to automated driving system entities following legislative change, corporate multipliers may need to be applied to increase the existing penalties. This change is because existing road traffic penalties are currently aimed at influencing human behavior.

The Discussion Paper also flagged a new primary safety duty, applicable to automated driving system entities, to ensure autonomous vehicle safety.21 The primary safety duty could be based on existing models with a similar duty, including work health and safety legislation, the Rail Safety National Law or the Heavy Vehicle National Law.22 The National Transport Commission has recently identified a primary safety duty as a necessary addition to any safety assurance regime involving mandatory self-certification of autonomous vehicles assessed against set criteria. This makes the imposition of such a duty more likely.

Privacy and cybersecurity

There are of course broader regulatory issues than vehicle and road safety. In this regard, the Joint Standing Committee on Road Safety has recommended that the national regulatory framework include the development of protocols to facilitate data sharing and address privacy issues.23 Included in the National Transport Commission’s current pipeline of work is a project to scope the circumstances in which government agencies should be able to access and use data that has been obtained through the use of autonomous vehicles. The National Transport Commission is due to submit reform options with respect to this in May 2019. Privacy and cybersecurity is examined further in the Privacy, cybersecurity and technology issues section below.


As will be apparent from the above overview, it is probably too early to have highly or fully automated cars on the road in Australia, because it is still unclear where legal responsibility lies for many different facets of operating a vehicle.

As the states and territories progressively update their laws to accommodate automated and semi-autonomous vehicle operation, this experience will permit us to start to see the technology put into use on our roads very shortly.

Product liability

Currently, the vast majority of motor vehicle accidents are due to driver error. But, even assuming that autonomous vehicles do ultimately eliminate driver error as a cause of casualty, motor vehicle collisions and other incidents causing trauma will likely still occur. Deaths have already occurred while vehicles have been operated in autonomous mode, and as a result of that operation, and more are sure to follow.

At least for the medium-term, the presence on the roads of a mixed fleet of fully, semi- and non- autonomous vehicles would seem likely to create significant scope for incidents to continue to occur. The inevitable result of ongoing technical development of automated driving systems is that early versions of these vehicles will be less safe than later versions.

Traditionally, the overwhelming share of the personal cost of trauma associated with motor vehicles in Australia has been allocated through the insurance pool created by the various state-based compulsory third-party schemes. The common law damages components of these schemes are based upon the concept of driver negligence and fault. As human driver error ceases to be a cause of collisions and other trauma incidents, the most likely remaining cause of motor vehicle “accidents” will be some factor associated with the functioning of the autonomous vehicle itself; although during the intermediate phases of Levels 2, 3 and 4 autonomous vehicles (see Regulatory section above), the requirement for interaction between the vehicle control system and the human “driver” is, itself, likely to be a causal factor in many cases.

Product liability law in Australia is well developed and well understood. It can be expected to respond effectively to the development and introduction of autonomous vehicles. Nevertheless, there will certainly be issues to be addressed in the development and the application of the relevant legal principles to ensure, amongst other things, the appropriate allocation of risk and cost between manufacturers and users of autonomous vehicles. Importantly, this must not occur in a manner that would unduly impede the roll out of this technology, thus denying or delaying achievement of the societal and economic benefits that it is expected to deliver.

Background – Australian product liability law

In Australia, there are three discrete bases upon which claims for damages can be made against suppliers of allegedly defective goods: contract, tort (negligence) and the statutory remedies to be found in the Australian Consumer Law.


A purchaser will have a cause of action for breach of contract if they suffer loss caused by the product not meeting standards which had been contractually promised by the seller. Such promises may be expressly made, or arise by implication. In particular, legislation such as the Sale of Goods Act 1923 (NSW) imply terms into contracts for the sale of goods to the effect that the goods are reasonably fit for the purpose for which they are supplied and are of merchantable quality.

The availability of contractual remedies is heavily constrained by the requirements for privity and consideration between the plaintiff and the defendant. Consequently, if the plaintiff did not personally pay for the motor vehicle or, as is usually the case, there were intermediaries between the manufacturer of the vehicle and the ultimate consumer, a contractual claim against the manufacturer cannot be made.

In some circumstances a claim may lie against the retailer of an autonomous vehicle, particularly where unfulfilled claims relating to the capabilities or reliability of the vehicle’s driving system are made during the sales process.


Manufacturers of motor vehicles owe a duty of care to users of those vehicles and to others who may be affected by their use. If a manufacturer fails to take reasonable care in the design and production of the vehicle and a person suffers foreseeable loss or damage as a result, liability for that loss or damage will generally follow. The duty extends to the provision of any instructions or warnings that may be required to minimize the risk of injury. Retailers also owe duties to end-users, although only to the extent of preventing dangers which are, or which ought to be, known to them.

For an Australian plaintiff seeking to recover damages in negligence on the basis that a vehicle’s automated driving system caused their injuries or other loss, a significant practical problem will be that, with the demise of the Australian motor vehicle manufacturing industry, the defendant(s) will necessarily be domiciled in another country.

For the plaintiff, it will be even more difficult to establish, first, the existence of a causative fault or deficiency in the automated driving system; second, which designer or which manufacturer of which component of the automated driving system was responsible for that fault or deficiency; and, third, that on the balance of probabilities, that fault or deficiency arose out of a want of reasonable care on the part of that designer or manufacturer, having regard to the state of general technical and scientific knowledge at the time of manufacture of the vehicle.

The Australian Consumer Law

The Australian Consumer Law (ACL) contains a number of provisions which are directed to enable consumers to obtain redress in respect of defective goods, including motor vehicles. These provisions create remedies directly against manufacturers (and, if the manufacturer is wholly foreign, against the relevant importer who becomes the “deemed” manufacturer), thus avoiding many of the difficulties which would be encountered in actions based on contract and/or negligence.

Principally, these provisions:

  • establish a series of “consumer guarantees” by suppliers and manufacturers of goods. These include that the goods are of “acceptable quality” (including that they are “free from defects”) and that they are fit for any disclosed or represented purpose; and
  • impose strict liability upon manufacturers for injury and other loss suffered because of a “safety defect” in the goods.

In addition, the ACL prohibits the making of false or misleading representations in relation to goods, including as to their standard, quality or performance characteristics. Claims can be made to recover loss or damage that is suffered by reason of any such representation.

Whilst any of these provisions may be brought to bear in any product liability claim that may arise from an allegedly deficient autonomous vehicle, the strict liability regime for defective goods is by far the most appropriate. It replaces the need to establish a lack of reasonable care on the part of the manufacturer with a requirement to show only that the goods had a safety defect. In turn, this is satisfied if, in all the relevant circumstances, “their safety is not such as persons generally are entitled to expect.” These circumstances can include:

  • the manner in which, and the purposes for which, the goods were marketed;
  • any instructions for, or warnings with respect to, doing, or refraining from doing, anything with or in relation to the goods;
  • what might reasonably be expected to be done with or in relation to the goods; and
  • the time when the goods were supplied.

Some defenses to a claim will be available even if the evidence establishes that an autonomous vehicle did have a safety defect (for the purposes of the ACL) and that this defect was the cause of injury or death. In particular, it will be a defense where:

  • the defect did not exist at the time of the vehicle’s supply;
  • the vehicle has a safety defect only because of its compliance with a mandatory standard (i.e., an Australian Design Rule under the Motor Vehicle Standards Act 1989 (C’th));
  • the state of scientific or technical knowledge at the time when the vehicle was supplied by the manufacturer was not such as to enable the safety defect to be discovered; or
  • the defect was in a component of the vehicle but was attributable only to:
    • the design of the vehicle itself; or
    • instructions or warnings given by the manufacturer of the vehicle.

Aside from these provisions, which impose potential liability on manufacturers of autonomous vehicles, the ACL also contains a regime for recalls of defective products, involving both reporting and other obligations when recalls are undertaken voluntarily, and the institution of mandatory recalls in some circumstances.

Issue for autonomous vehicles

When does an automated driving system have a “safety defect”?

As discussed above, under the ACL goods are defective, and the manufacturer potentially liable, if their safety “is not such as persons generally are entitled to expect.” How, then, to determine whether or not an autonomous vehicle is as safe as the public is entitled to expect?

The first question is, of course, what is a legitimate expectation of safety with respect to autonomous vehicles? This question must be answered in the context both of the continuum of the development of the technology, and the progression of driving system design through Levels 3 and 4, ultimately to Level 5, of automation.

For example, for a Level 3 vehicle, what are all the circumstances in which the automated driving system should prompt the ‘“driver” to assume control? How the vehicle actually responds will depend upon the parameters that its designers determine and program, assuming no malfunction. But do these parameters accord with what the public might be entitled to expect?

As the technology used becomes incrementally more sophisticated, the public’s expectations of the safety of their operation will inevitably move with it, potentially quite quickly (think mobile phones!). The result may be that there is effectively a rolling safety benchmark for autonomous vehicles, thus placing intense pressure on designers and manufacturers. Is an automated driving system that responds in a particular way, resulting in a collision, necessarily defective because another system, designed and sold by a different manufacturer at about the same time, may have avoided a collision in the same circumstances?

For vehicles at Levels 4 and 5, in particular, is the safety performance expected of them to be measured against an expert human driver, an average driver, or a novice? Is it a legitimate expectation that an autonomous vehicle will slavishly comply with road rules, even when a human driver may calculate that the safer course is, for example, temporarily to move outside their lane?

In many – perhaps most – cases, determining whether an autonomous vehicle is not as safe as is to be expected will present no particular difficulty; depending on the level of automation, they can be expected not to leave the highway, to detect and respond appropriately to other vehicles on the road, to overtake only when it is safe to do so, and so on. Greater, perhaps insurmountable, difficulty will arise when an automated driving system is required to make decisions as between alternative responses, each of which will result in a collision of some kind. Is a preference to protect the safety of the vehicle’s occupants above the safety of a passing cyclist or pedestrian in accord with the public’s safety expectations for autonomous vehicles?

These considerations all indicate that new legislation will be required to respond to the unique issues that will arise from the emerging use by consumers of products, such as autonomous vehicles, which are responsible for making the safety decisions on which those consumers are, increasingly, mere passive dependants.

Assumption of control (by the human “driver”)

To varying degrees, the automated driving systems in Levels 3 and 4 autonomous vehicles all involve a handover of control of the vehicle to and from a person who occupies the “driver’s” seat. This process is most likely to be required in situations of potential hazard, and probably when that hazard is at least imminent. Its efficacy is therefore critical to the safety of the occupants of the vehicle, and probably others too.

At Level 3, the driver is required to assume control when prompted to do so. As discussed above, determination of the range of circumstances in which the automated driving system should properly deliver this prompt is likely to be required in cases where it was not delivered, and a collision ensued. But other issues are also likely to emerge in claims against manufacturers of these vehicles:

  • Is it reasonable for the human driver to rely exclusively on the automated driving system to determine when they should assume control, or should they instead be ready to intervene at any time?
  • Might an inexperienced driver reasonably determine, in a pressure situation, that despite being prompted to take control, the safer course is to allow the automated driving system to do its best to manage the situation?
  • Was the mode and the extent of any instructions given to purchasers of these vehicles regarding the potential need to assume control adequate? Should this involve hands-on training, or are dashboard and owner’s manual warnings enough? How are these instructions made available to other drivers of the vehicle, including second-hand purchasers?
  • To what extent should effective provision of warnings and instructions operate to exonerate vehicle manufacturers when they know from past experience that consumers will tend to take insufficient heed of such warnings and instructions?

These questions underline the liability risks inherent in Level 3 vehicles, where drivers will be most likely to be susceptible to misapprehend the true extent of the vehicle’s capacity for autonomy. Particularly given that, under the ACL, regard can be had to any instructions and warnings that are provided with an automated driving system when a court is required to determine the extent of the safety of an autonomous vehicle, as the law currently stands, manufacturers will bear a heavy onus to establish the sufficiency of their communications regarding the control transfer process.

Automated driving system software

The heart (or brain) of any automated driving system will be found in the software that it runs. Any safety defect in that software will expose both the manufacturer of the vehicle and, if different, the software provider to liability to anyone who is injured as a result (software is deemed to be “goods” under the ACL). But, similarly to the issues concerning transfer of control discussed above, autonomous vehicle manufacturers may also be exposed to the risk that vehicle owners do not act, or do not act promptly, in response to instructions to load updates to the software, as inevitably will be required from time to time. This risk may be improved if “over the air” software updates can be implemented.

Apart from the vehicles’ own software, there is the potential for liability for providers of road mapping and traffic information. Moreover, depending on the mode of delivery of this software to the consumer, a defect in it may expose the vehicle manufacturer to the same liability, for which it would be obliged to seek contribution from the software provider.

What is a legitimate expectation of safety with respect to autonomous vehicles?

Voluntary assumption of liability

At least one manufacturer has taken the step of publicly accepting liability for accidents which involve its vehicles, while calling on others to do the same. In its submission to the House of Representatives Standing Committee on Industry, Innovation, Science and Resources’ inquiry into issues relating to autonomous vehicles, Volvo Car Australia said:

"Volvo’s public position on liability is very clear. Volvo will accept full liability for damages or injuries whenever one of its cars is in full autonomous mode. Volvo is confident that the redundant and back-up systems contained in our Autopilot and Pilot Assist technologies will bring a Volvo car to a safe stop…

Volvo believes the Australian government should mandate that all manufacturers who sell fully driverless cars in Australia must accept liability for cars involved in accidents that were in full autonomous mode at the time of the accident."24

This position somewhat turns on its head the defence of voluntary assumption of risk that has historically been taken by defendants to some claims. However, its legal effect will be unclear unless it is given contractual force with each sale in the form of a warranty given to all initial and subsequent purchasers. Even then, it is not easy to see how it could benefit anyone other than the owner of the vehicle.

In any event, unless every other manufacturer adopts an identical position to that of Volvo, it will not by itself represent a satisfactory scheme of product liability for autonomous vehicles.

The way forward – mandatory self-certification and a “primary safety duty”?

Since early 2016, the National Transport Commission has been tasked by the Transport and Infrastructure Council (which comprises the federal and state governments’ transport ministers) with developing proposals for reform to accommodate and support the introduction of autonomous vehicles. In November 2017, the National Transport Commission published a policy paper, “Assuring the safety of autonomous vehicles”, in which it recommended the development of a system of mandatory self-certification by manufacturers/importers as to compliance of their autonomous vehicles with high level safety criteria set by government. That recommendation was swiftly accepted by the Council.

If and when it is implemented (currently proposed by 2020), this mandatory self-certification system will require automated driving system entities, such as manufacturers, to submit a statement of compliance that demonstrates how the safety risks associated with the operational design domain of the vehicle have been managed. Only when that statement has been approved can the relevant automated driving system or function be introduced into the market. The statement of compliance will not otherwise be tested or validated.

In conjunction with this recommendation, the National Transport Commission has also raised the potential imposition of a “primary safety duty” to support mandatory self-certification. It explained that:

"A primary safety duty is a statutory duty of care that imposes a legal obligation on the party or parties it applies to. A primary safety duty to ensure automated vehicle safety could apply at first supply of the vehicle to market, or be an ongoing duty throughout the life cycle of the vehicle."

The likelihood of this duty being imposed and the nature of its possible formulation has become clearer with the publication by the National Transport Commission of its regulatory impact statement concerning safety assurance for automated driving systems. The document highlights how a primary safety duty would fill the gap created by self-certification addressing only issues at first supply.

The regulatory impact statement outlines a primary safety duty based on the model work health and safety laws in Australia and suggests that a similar concept could be applied to autonomous vehicles. This duty would require automated driving system entities to take reasonably practicable steps to ensure the safety of an automated driving system.

If adopted, this primary safety duty would have to replace both the tort of negligence and the ACL safety defect cause of action as far as autonomous vehicles are concerned. Whilst it might therefore be made more bespoke to those vehicles than the current laws could ever be, manufacturers are still likely to have to grapple with how concepts like “‘safe” and “as far as reasonably practicable” should properly be understood in this context.

The regulatory impact statement also identifies the criteria that are likely to be required to be addressed in any statement of self-certification. These are:25

  1. safe system design and validation processes;
  2. operational design domain;
  3. human-machine interface;
  4. compliance with relevant road traffic laws;
  5. interaction with enforcement and other emergency services;
  6. minimal risk condition;
  7. on-road behavioral competency;
  8. installation of system upgrades;
  9. testing for the Australian road environment;
  10. cybersecurity; and
  11. education and training.

Other matters which may be required to be addressed are:

  • data recording and sharing
  • corporate presence in Australia
  • minimum financial requirements.

Those latter three requirements will be important for enforcement and civil liability recovery.


Currently, the civil law consequences of motor vehicle accidents are premised upon each accident being the fault of one or more persons or of a defect in a vehicle or, rarely, in some aspect of highway infrastructure. By contrast, the eventual advent of fully autonomous vehicles will effectively eliminate human driver fault. But it will not follow that the fewer accidents that occur should result in greater liability for the vehicle manufacturer. An automated driving system may be “state of the art” and not malfunction, but nevertheless be simply incapable of dealing with a situation which its designers and programmers had not anticipated. To that extent at least, the allocation of the residual risk of loss from the use of autonomous vehicles could not be undertaken under existing Australian product liability principles.

Privacy, cybersecurity and technology issues

In Australia, as elsewhere in the world, autonomous vehicles have raised some unique privacy, cybersecurity and technological challenges and concerns.

Australia’s legal framework will need to further develop to address concerns as the world moves closer to the reality of cars commuting people to places while utilizing no, or limited, human involvement.

In the state of New South Wales, the Joint Standing Committee on Road Safety has identified that a potential operational barrier to the successful introduction of autonomous vehicle technology is consumer uncertainty about such matters, including who can potentially access the data collected from autonomous vehicles.

In this section we examine Australia’s approach to data and privacy issues, cybersecurity, surveillance and communications technology.

Data and privacy

The Australian federal parliament has identified data privacy and use as a key public concern associated with autonomous vehicles.26 This result is unsurprising given that the technologies and telematics that will potentially underpin the operation and use of autonomous vehicles (such as GPS navigation and Cooperative Intelligent Transport Systems (C-ITS)) will rely on, utilise and generate a significant amount of data. C-ITS, for example, uses real-time data to enable vehicles to communicate wirelessly with roadside infrastructure, transport systems, personal devices and other vehicles. Data is being collected between vehicles and their surroundings as part of this communication process.

Data collected or generated may include vehicle location information, travel history, vehicle information (including vehicle speed and break status), driver’s performance and accident history.

It is easy to see how such data may prove valuable to a range of entities such as law enforcement agencies, insurance companies, marketers and car manufacturers.

With data collection comes associated questions about data access and use. From a legal perspective, autonomous vehicles raise the following key questions:

  • who owns the data collected;
  • who can access or use data collected via an autonomous vehicle and under what circumstances; and
  • could data derived from an autonomous vehicle and its technology systems constitute personal information?

Data ownership and access

In this section we address access to data. Ownership issues will be covered in more detail below where we consider intellectual property issues.

At present, under Australian law, people do not generally have a legal right to access their data, including data derived from products and services that they use, unless there is a legislative right under relevant freedom of information legislation or the data constitutes personal information.

Where government agencies have collected data derived from an autonomous vehicle, an individual may request access to that information under relevant freedom of information or government access legislation, such as the Government Information (Public Access) Act 2009(NSW). Access may be refused in certain limited circumstances, on public interest grounds.

Where personal information has been collected, entities governed by federal, state or territory privacy legislation must generally provide individuals with access to their personal information, subject to certain exceptions (for example, if the entity reasonably believes that giving access would pose a serious threat to the life, health or safety of an individual or to public health or public safety).27

Personal information is regulated at a federal level by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), which are contained in Schedule 1 to the Privacy Act. Subject to some exemptions, the Privacy Act generally applies to federal agencies and private sector entities with an annual turnover of more than AU$3 million. In addition to the Privacy Act, a separate suite of legislation governs personal information at a state and territory level. Broadly stated, the privacy principles under state and territory privacy legislation adopt an approach to the protection and use of personal information that is generally consistent with the APPs.

Data access outside the framework of Australia’s privacy and freedom of information legislation will be an interesting area to watch in light of the federal government’s proposal to legislate in 2018 for a “Consumer Data Right” to permit consumers open access to their data. Under this proposed legislation, the consumer would have a greater ability to access certain data concerning them.

At present, the legislation has been flagged to apply to banks, utilities and telecommunication companies. A sector-by-sector approach is being proposed, however, and there is the prospect that the Consumer Data Right may be extended to other sectors, including the automotive and broader transport sectors.28 In this regard, it is noted that the Australian Competition and Consumer Commission, a peak national regulator, recently discussed that a Consumer Data Right be extended into the new car retailing industry, to the effect that consumers would have the right to access digitally held data, including telematics data, about themselves.29

Is it “personal information”?

Under section 6 of the Privacy Act, data collected through autonomous vehicle use will only amount to personal information where it is about an identified individual or an individual who is reasonably identifiable.

As the Administrative Appeal Tribunal’s decision in Telstra Corporation Limited v Privacy Commissioner [2015] AATA 991 and the associated Federal Court appeal30 demonstrates, what may constitute “personal information” for the purposes of the Privacy Act can be a grey area. The case was about whether certain metadata constituted personal information. It highlighted that the focus is whether the information is “about an individual.” This question is not always easy to answer and requires a contextual evaluation based on the facts of each matter. Importantly, while one piece of information may not be about an individual, it may become so when it is combined with other information.

If data derived from autonomous vehicles can convey information about an individual (for example, their travel history) and that information can be linked back to the individual driver concerned (for example, through the driver’s vehicle registration records), it is likely to amount to personal information. This conclusion was reached by Galexia in the Privacy Impact Assessment it undertook for Austroads on C-ITS data messages in the context of autonomous vehicles.31

Under the Privacy Act, unless an exception applies (for example, law enforcement purposes), where an entity collects, uses or discloses personal information the entity will generally need to obtain the consent of the individual to the relevant collection, use and disclosure, regardless of whether the entity considers that they “own” the information or not. Consent may prove difficult to obtain in the context of a vehicle because of the number of “drivers” or users of the vehicle, which may fluctuate and change over time. It will therefore not be a simple matter of obtaining the consent of the owner. Another mechanism may need to be considered, including potentially giving notice of the relevant collection, use and disclosure and requiring the driver to consent each time the vehicle is turned on. This consent mechanism may prove difficult.

Once an entity is authorized to collect personal information, the next step will be for the entity to take reasonable steps to protect that personal information from misuse, interference and loss, as well as unauthorized access, modification or disclosure. The “reasonable steps” that an entity should take to ensure the security of personal information will depend on the circumstances, including the amount and sensitivity of the information.32 “Reasonable steps” in the context of autonomous vehicles should include, as a minimum, implementing sufficient systems and strategies around information and communication technology security. Regular testing of the robustness of an entity’s security systems will also be an important component of that entity’s “reasonable steps.”

The government is conscious of the need to ensure that its regulatory response in the area aligns with other markets and is not an impediment to global trade.

In Australia, safeguarding personal information in accordance with the Privacy Act has now become especially important in light of the new mandatory data breach notification regime that came into effect on February 22, 2018. From this date, certain entities covered by the Privacy Act are now legally required to notify “eligible data breaches” to the Australian Privacy Commissioner and affected individuals. It was previously the case that notification of data breaches was a voluntary matter.


In the words of Australia’s Chief Scientist, an autonomous vehicle is “a computer on wheels”, and “in the wrong hands, access to [a] computer on wheels could be very concerning indeed.”33

As autonomous vehicles will include or require computer or other technologies to operate and may be connected to the internet and other vehicles, the cybersecurity risks associated with their use cannot be ignored. These risks exists because where technology systems are involved (especially connected technology systems), it is possible that those systems may be compromised or subject to a form of unauthorized access, such as hacking.

To the extent that personal information is breached, the Privacy Act is relevant to a cybersecurity incident associated with autonomous vehicles. In addition, Australia has a suite of criminal legislation that prohibits hacking, cyber-crime and the unauthorized impairment of data held in devices (see, for example, Section 308I of the Crimes Act 1900 (NSW)).

The federal government is investing in cybersecurity research and industry solutions. In relation to autonomous vehicles, the government is in the process of engaging with international bodies who are developing standards and guidance for autonomous vehicle cybersecurity, such as the World Forum for the Harmonisation of Vehicle Standards. The government is also engaging with states and territories at the domestic level to develop a security management plan for autonomous vehicles. The government is conscious of the need to ensure that its regulatory response in the area aligns with other markets and is not an impediment to global trade.34


One category of data that autonomous vehicles will likely collect is location and travel data, such as route information and time and date travelled. Such data can potentially pin-point where a person (driver) was at a particular point in time. Depending on the context of its use, the technology may amount to a surveillance device (for example, a tracking device) under surveillance device legislation, such as the Surveillance Devices Act 2007 (NSW) (SD Act).

Under the SD Act, a tracking device is any electronic device capable of being used to determine or monitor the geographical location of a person or an object. It is an offence under section 9 of the SD Act to knowingly install, use or maintain, without lawful purpose, a tracking device to determine the geographical location of a person without their permission. The offense provision extends to the geographic location of objects. It is also an offense under section 11 of the SD Act to publish or communicate information that has been obtained through a breach of the SD Act, including section 9.

The use of autonomous vehicles in a workplace context (for example, an employee’s use of a company car) will also require consideration of the legal requirements in that context from a workplace surveillance perspective. For example, under the Workplace Surveillance Act 2005 (NSW) surveillance must not be used in the workplace without sufficient notice being provided to employees.

As with the Privacy Act, in the absence of a legislative or other legal permission, there will need to be appropriate notice and consent processes and practices in place when using autonomous vehicles, and the data captured by them, to ensure legal consent to practices that may amount to surveillance.

Communications technology

As noted above, autonomous vehicles may utilise wireless communications technology to function, namely C-ITS. To the extent that “radiocommunication devices” are required to operate autonomous vehicles, operators will need to ensure compliance with Australia’s radio communications regulatory framework, including the Radiocommunications Act 1992 (Cth).

Amongst other matters, the Radiocommunications Act provides for the management of the radiofrequency spectrum. It is illegal under the Act to operate a radiocommunications device without a relevant licence.

To facilitate the use of autonomous vehicles, in January 2018, the Australian Communications and Media Authority announced that the Radiocommunications (Intelligent Transport Systems) Class Licence 2017 had been made. According to Austroads, the “Intelligent Transport System Class Licence will allow connected vehicles and mobile infrastructure to share data using the 5.9 GHz radio frequency band. Importantly the licence aligns with international developments, particularly in Europe.”35 The licence authorizes a person to operate an Intelligent Transport System station subject to the conditions set out in Parts 2 and 3 of the Intelligent Transport System Class Licence.

Regulatory developments in Australia relevant to privacy and cybersecurity

Australia’s existing legislative framework, including the Privacy Act, imposes a number of obligations relevant to the operation of automated vehicles. In addition, more tailored legislation is being considered at the federal and state and territory levels.

However, by way of example only, while not expressly stated in the federal Road Vehicle Standards Bill 2018 (Cth), it has been acknowledged that that bill provides an ability for national road vehicle standards to cover cybersecurity in automated vehicles. As explained earlier, this bill has not yet passed but is expected to shortly.

In NSW, the Transport Legislation Amendment (Automated Vehicle Trials and Innovation) Act 2017 inserted into the Road Transport Act 2013 (NSW) an offense for a person to hinder or obstruct the movement of a trial vehicle or interfere with a trial vehicle or any other equipment being used for the purposes of an approved trial. According to parliamentary debates on the Amendment Act, this provision is intended to extend to protection against cybersecurity threats and breaches of privacy. This means that the Act also provides that statutory rules regarding the trial of automated vehicles may cover the privacy of personal information collected and the treatment of confidential information.

Under Victoria’s Road Safety Amendment (Automated Vehicles) Act 2018 which amended the Road Safety Act 1986 (Vic), the relevant minister may issue guidelines about the enforcement, testing, assessment or safety assurance of autonomous vehicles, which could presumably cover some of the privacy and cybersecurity concerns discussed in this Chapter.

In addition, the National Transport Commission is working with the states and territories to develop protocols to facilitate data sharing and address privacy issues. In the National Transport Commission’s current pipeline of work is a project to scope the circumstances in which government agencies should be able to access and use data that has been obtained through the use of autonomous vehicles. The National Transport Commission is due to submit reform options on this matter in November 2018.


The existing regulatory and legislative framework in Australia provides some scope and utility to cover the use and operation of autonomous vehicles. This framework is expected to further evolve to adapt to the unique, technology-centric risks associated with the use of autonomous vehicles from privacy, cybersecurity, surveillance, communications and broader public policy perspectives.

Intellectual property

The automotive industry has played host to innovators and technological advancements for well over a century. Today’s motor vehicles bear very little resemblance to the vehicles of 1886, the year in which the patent was granted for a motorwagon, and with increasingly complex vehicle blueprints, the subsistence of intellectual property (IP) rights in a vehicle and the entitlement to those rights is often unclear.

Identifying IP and its rightful owner becomes even more of a challenge as the traditional role of automotive manufacturers starts to morph into technology service providers with the arrival of computerized autonomous vehicles.

Autonomous vehicles are best considered as a bundle of IP rights. Different components within the vehicle and its operating system may be protectable in different ways, with IP owned by different rights holders. This result reflects the reality of the joint development taking place between engineers, software developers, data architects and analysts, to name but a few. Collaboration creates challenges in IP protection as development is balanced against value preservation.

Accordingly, participants in the development of, and eventually the supply chain for, autonomous vehicles must consider a number of uncertainties relating to IP:

  • What IP subsists? Who owns those rights and how can they be protected?
  • How the IP is best commercialized and what are the risks of that commercialisation?
  • Is IP created by the use of autonomous vehicles? Are there rights in telematics and data streams? Are any such rights capable of legal recognition and protection within existing laws?

This section considers protection of IP in Australia through patents, copyrights, and designs. The section also considers emerging issues relating to open innovation, ownership of data, standards and protection of confidential information in trials.

Protecting IP in the technology


Australia’s unique geographical features and population density are well suited to the use of autonomous vehicles and trials are taking place, or planned to commence, across the country. It is reasonable to expect that Australian inventions will start to emerge in this field.

Patents protect inventions, whether a product itself, or a method or process. To be patentable, an invention has to be “novel” compared to existing technology and have an “inventive step” over existing technology, amongst other requirements. These are relatively high thresholds.

Before assessing these requirements, however, the subject matter of the claimed invention must itself be a “manner of manufacture” to be capable of being granted patent protection. Australian courts, as with their international counterparts, have struggled with the question of where to draw the line for the patentability of computerized processes. Artificial intelligence, essentially being computer implemented algorithms, is not straightforward to assess. Australian courts have confirmed that the following are not patentable subject matter:

  • mere ideas, without direction as to how to perform or carry out the idea;
  • methods of calculation, systems, schemes or plans, where the invention is just an expression of the calculation, system, scheme or plan, and not directed to producing an outcome or practical result; and
  • certain computer-implemented business methods.

The Full Federal Court of Australia hold:36

Putting a business method or scheme into a computer is not patentable unless there is an invention in the way in which the computer carries out the scheme or method.

The claimed invention in that case was not patentable because, amongst other things, the computer was not functioning in the nature of an advisor or artificial intelligence.

For autonomous vehicles, this requirement means that automating individual processes that are involved in the operation of a vehicle may not be sufficient to constitute a manner of manufacture or patentable subject matter.

Once there is patentable subject matter, the invention is assessed for novelty and “inventive step.” These are assessed on a worldwide basis against the existing technology base. International patent applicants therefore need to coordinate their Australian patent filings with filings made in other countries, because novelty may be compromised by applications in other jurisdictions.

A frequent barrier to patentability is the requirement of an “inventive step.” Australia recognizes the innovation patent, which grants a monopoly for eight years compared to 20 years for a standard patent. A lesser threshold of “innovative step” applies for the 8-year innovation patent. The test requires the technology to be an incremental improvement to existing technology that contributes to the working of that technology, rather than a breakthrough development.

Note that the innovation patent has been the subject of criticism, including that it could stifle the “open innovation” approach that governments around Australia and other stakeholders are moving towards.

Technology that does meet the requirements for a patent might be protected as a trade secret if its confidentiality is protected and it is not available in the public domain. In Australia, trade secrets are protected as a form of confidential information at general law. Conceivably, a trade secret can be protected with no limit on its duration, as long as the confidentiality is maintained, unlike a patent which grants a monopoly for 20 years. The challenges of protecting confidential information are discussed later.


Like other modern devices, autonomous vehicles will contain components and systems that rely on computer programs, including in-built firmware, to operate.

In Australia, the Copyright Act 1968 (Cth) protects “original” works, including computer programs, as a form of “literary work.” Copyright is not a registered right in Australia, and ownership generally vests in the individual author(s) of each work. There are certain exceptions; for example, ownership of copyright in a work created by an employee vests in their employer. Owners of copyright in computer programs have the exclusive right to reproduce, publish and make another version of the protected computer program.

As has been observed in relation to many other technologies, from e-books to 3D printing, copyright legislation is often more rigid than it first appears. The categories for copyright protection are closed, so any technology needs to fit within the categories defined as “works” under the Australian Copyright Act. For some technologies, this exercise is difficult.

A “computer program” is specifically defined in the Copyright Act as a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result. This definition is an initial threshold that operating systems built into autonomous vehicles must overcome if copyright is to exist, particularly if the operating system includes data or other information that is not itself a statement or instruction.

A second threshold is originality. In a copyright sense, this concept couples authorship (by a person) with some skill or effort on the part of that person to directly bring the work into existence. Applying this concept to a computer program may be difficult, particularly if the firmware includes portions that are themselves computer generated.

Once subsistence of copyright is established, there are a number of other copyright issues to consider:

  • Reproducing a piece of firmware for one component or system to interoperate with another will be essential to the functioning of autonomous vehicles technology. Although there is an interoperability exception, it is quite narrow and a risk of infringement of copyright might remain.
  • Collaboration brings joint ownership risks. If the contributions of different parties cannot be separated, a work will be co-owned and each co-owner will need the consent of the other co-owners to be able to exploit the work. This risk can be addressed by appropriate agreements.
  • If open source software is to be integrated into autonomous vehicles technology, due diligence will be required to establish whether such software is licensed on “copyleft” terms. These licences require the licensee to distribute modified open source on the same terms as the open source licence. If the open source software has been freely licensed under a permissive, royalty-free licence, the modified open source software would also have to be licensed on these terms.

These issues affecting the protection of autonomous vehicles technology are already well recognized. For example, the NSW government’s Future Transport Strategy recommends a set of nationally consistent standards, protocols and regulations to enable interoperability and encourage connected and autonomous vehicle platforms.37


Automotive makers are already among the more prolific users of the Australian designs registration regime. There is potential for new design creation and registration as the transformation from traditional motor vehicles to autonomous vehicles is likely to involve new components being created.

A design registered under the Designs Act 2003 (Cth) protects the visual appearance, rather than the function, of a manufactured product. Unregistered designs are not protected in Australia.

A design registration protects the overall appearance of a product if it is “new and distinctive” compared to the “prior art base” of existing designs. This form of IP protection takes into account the product’s shape, configuration, pattern and ornamentation. Registered design rights give the owner a monopoly over the design for up to 10 years, subject to the design being examined and certified.

Australia does not permit design registrations for parts of products, nor do design owners have the right to prevent use of the same or a similar design on a product other than that for which the owner’s design has been registered. Similar to patents, the prior art base is assessed on a worldwide basis, so foreign design owners will need to ensure that they file their Australian design applications in coordination with their other international applications, even if the product is not due to be launched or introduced into Australia until a later date.

Out on the open road: emerging issues

In Australia, the Productivity Commission has recognized the adoption of open access business models may help to create more opportunities to exploit inventions.38 This recognition is important for autonomous vehicles technology because the process for developing an artificially intelligent autonomous vehicle requires input from multiple innovators with different fields of expertise.

Unless the rights between parties are carefully set, however, a collaborative development process will give rise to a bundle of intellectual property rights in which different owners may end up with rights in different parts of the whole.

The next part of this section considers the emerging issues for rights holders in three distinct but interconnected areas associated with the technology of autonomous vehicles: open innovation, confidential information and standards for the interoperability of vehicle systems.

Open innovation

The phrase “open innovation” encompasses the idea that technology research and development benefits from cooperation between innovators, resulting in new technology that is a product of the ideas and programs of multiple participants. From a practical perspective, open innovation allows companies to buy or license processes and inventions to other companies for their internal use. Similarly, companies can sell or license their internal processes and inventions which they no longer use for the benefit of other businesses.

Developing autonomous vehicles using principles of open innovation will be a rocky road. Since as early as 1999, people have attempted to design cars wholly made from open hardware and software, without success.

Combining existing technology to create something new gives rise to a number of difficulties. In particular, rights holders in relation to component parts run the risk of losing some of their intellectual property rights (for example by disclosing a patentable invention before applying for a patent, resulting in loss of novelty and confidentiality).

Open innovation is nevertheless often still attractive to many innovators because, by sharing results and learnings, individual entities may reduce their own costs of conducting research and development and improve their overall development productivity. Care needs to be taken in the drafting of agreements between involved parties to ensure rights are not lost or compromised and to ensure that there is clarity in relation to sharing the upside of any output.

Trade secrets and confidential information

Australian law does not recognise data or information itself as a type of property that can be owned or bought and sold. Rather, any rights subsist in the ability to protect confidentiality over the information by enforcing its secrecy, whether by contractual relationships or general obligations that arise in equity. In a 1943 Australian High Court case, which is still applicable today, about whether the acquisition of information about aircraft designs was taxable property, the High Court said:

Knowledge is valuable, but knowledge is neither real nor personal property. A man with a richly stored mind is not for that reason a man of property.39

Therefore, although often regarded in a proprietary sense, trade secrets and other forms of confidential information are not standalone intellectual property rights in Australia.

Nonetheless, confidential information and trade secrets were spun into the spotlight in the context of autonomous vehicles, as a result of the dispute in the U.S. between Waymo and Uber.

The multi-million dollar value of the settlement the parties reached illustrates the potential value of confidential information as an asset. Commercially valuable confidential information is an asset that every organisation in Australia possesses. Its value depends almost entirely on the actions, policies and procedures of the organisation to protect and manage its information, and this is no less true in the context of autonomous vehicles technology.

Failure to protect confidential information can have significant reputational, operational and financial adverse consequences. It may also concede a critical competitive advantage. The challenges of protecting confidential information in a collaboration are self-evident. By sharing information with third parties, some of whom may be competitors, the risk of an unauthorized and unintended disclosure of that information increases.

A risk associated with disclosure of confidential information arises in the context of autonomous vehicle trials and what must be shared to satisfy relevant authorities of the safety of a vehicle. The approach to required disclosure differs from state to state.

Aside from being a forum ripe for the development of “open innovation”, automation – including autonomous vehicles – could be a technology that drives reform of global IP laws.

For example, legislation in South Australia requires that the Minister for Transport must keep confidential any information which is commercially sensitive or for which a person has requested that such information remain confidential.40

Included in the amendments made to the Road Transport Act in 2017 to facilitate trials in NSW, a person must provide to the Minister for Transport any information that may be requested relating to the trial. The act also provides that the Minister for Transport may then provide any information to any other person or body if the minister considers it reasonable to do so for law enforcement or road safety purposes.

Those requirements should be read in the context that the Road Transport Act also contemplates that regulations will be made in respect of the confidentiality of information. Further, national guidelines for trials of autonomous vehicles,41 agreed between the responsible state and territory ministers, recognise the concern regarding disclosure of confidential information. The guidelines for trials of autonomous vehicles in Australia,42 suggest that a high-level description of the technology being trialed must be provided, not for the purposes of disclosing commercially sensitive information, but to allow the road transport agency to assess the safety risks of the trial. If information provided is confidential, the guidelines suggest that the road transport agency should respect this and the trialing organisation’s intellectual property.

Protecting confidential information will also become more difficult if autonomous vehicle trials are part of publicly funded research. In its “Intellectual Property Arrangements” report in December 2016, the Australian Productivity Commission recommended open access to publicly funded research. If this recommendation is implemented, which would be consistent with an “open innovation” era, testing and research into the use of autonomous vehicles that is the subject of publicly funded research would cease to be confidential information.

Ultimately, the challenge will be to strike a balance between protection, permitting future commercialisation and having enough information to assess safety.

Ownership of data and information

Ownership of information and data collected by autonomous vehicles

As noted above, being computerized, autonomous vehicles are likely to generate a significant volume of data and information. Who “owns” all this data that will be generated? Is it the owner of the vehicle; the occupants of the vehicle if they are not the owner; or the manufacturer, which causes the vehicle to store and collect the data?

Traditionally, the “ownership” of compilations of data has been seen as a form of intellectual property. The advent of “big data”, however, has brought some significant challenges to the way intellectual property law conceives of and deals with data. As explained below, on a legal analysis, “big data” is less of a purely intellectual property issue about “ownership”, and more of an issue about granting access to data and records about a person, as discussed in the previous Section.

Copyright protects compilations of data as a form of “literary work.” Under the Copyright Act, copyright does not exist in “authorless works” that are created without the input of a human author. This situation may arise where a computerized device is autonomously capturing images or data without human input. It also requires a basic level of skill and care in the selection and arrangement of data.

Therefore, without some degree of arrangement and selection of the data by a person, the collection of raw data is not likely to be the subject of copyright ownership. This outcome is different to some other common law jurisdictions, for example in the United Kingdom, where the “author” of a computer generated work is the person “who made arrangements for the creation of the work.”43

As noted above, Australian law does not recognise data, or mere information, itself as a type of property that can be owned, or bought and sold, but rather it is the confidentiality of that data that may be protected. Each case is to be assessed on its own circumstances, but if the person collecting the data guards its security and prevents it from reaching the public domain, it may have the necessary quality of “confidence” to qualify as confidential information. The collector is likely to be the vehicle manufacturer, for example, if the data is collected by on-board computers and securely transmitted back to the manufacturer for aggregating and analysis. This protection will depend on the steps taken to collect and protect the information and the degree to which the information is not already publicly available. In practice, the person who controls the confidentiality of the information will enjoy the commercial advantage.

In other fields such as financial services and communication services, consumers have begun to call for access to “their own” information. Data ownership may also become an issue for vehicle occupants or owners who find “their” information being collected by the manufacturer or vehicle operator.

Ownership of output generated by autonomous vehicles

There will be some working autonomous vehicles whose function is to survey or gather data, whether on-road or off-road.

The automation of such information gathering presents great commercial opportunities and potential value where, for example, it is safer and cheaper than other methods. There is presently a real risk that output such as images and data does not attract protection under Australian copyright law if there was no human input in its creation. This lack of human input may affect any ability to protect or to commercialize that data and information.

Another form of copyright recognized by the Copyright Act is a “cinematograph film”, a term which is quite antiquated when discussing data streaming of visual images. This form of copyright will subsist only after “the things necessary for the production of the first copy of the film has been undertaken.”44 This definition is inconsistent with a continuous live data stream and may mean that there cannot be copyright in content being streamed.

To the extent that copyright does exist in any content captured using an autonomous vehicle, consideration needs to be given to ownership of the copyright. It is common for third party service providers to operate drones and other vehicles on behalf of a principal. In such circumstances, unless the service agreement provides otherwise, the default legal position is that copyright is not owned by the organisation commissioning the service provider, but rather remains owned by the creator of the work. This legal default is commonly overlooked, and can lead to disputes about who owns, and therefore has the right to control or commercialize, the work.

The data and images collected by autonomous vehicles may be protected as confidential information if it is, in fact, confidential and not in the public domain. One factor that will aid this assessment is that information is more likely to be regarded as confidential if it is protected from general public access, including by encryption.


Automation and data brings new challenges under IP law, particularly concerning the ownership of content created by automated processes. Manufacturers and operators will need to consider carefully how to balance control and commercialization of such content against the genuine interests of individuals to access data held about them and their vehicles. The transition from traditional engineering to providing a technology service may mandate a refresh of intellectual property strategies and policies.

Aside from being a forum ripe for the development of “open innovation,” automation – including autonomous vehicles – could be a technology that drives reform of global IP laws much in the way that software and computers have done previously. For the time being, rights holders will need to navigate through existing forms of protection available to them. To maximize protection of their investments, rights holders need to be aware of the rights available to them and the challenges in applying those rights to autonomous vehicles technology.

Participants in the development of autonomous vehicles might be well advised to keep one eye on a costly and time consuming trend that has been observed in other fields of technology as they emerged – patent litigation battles, in which patent portfolios are eventually used as a sword against competitors as the market matures as happened for mobile phones and PC’s.

Finally, the matters covered in this section are just some of the IP issues raised by autonomous vehicles. Other issues not covered here include the importance of freedom to operate checks; the right to repair without obtaining IP licences from manufacturers; the prospect of compulsory licences to governments; and how Australian and international standards may affect IP owners in that their technology must conform to, and be interoperable with, standardized processes or technical requirements.


Insurance companies operating in Australia, in particular those with compulsory third party (CTP) products, should plan ahead for disruption.

While the developing consensus is that autonomous vehicles will be safer than cars driven by humans, safety risks will not disappear altogether.

Insurers should consider:

  • the shifting of risk from a driver to automated driving systems;
  • implications for current vehicle insurance products, pricing and liability regimes; and
  • opportunities and risks in a autonomous vehicle market.

The shifting of risk

Vehicles currently on the market are up to Level 2.

As outlined in the Regulatory section above, Level 2 automation is where the system may control speed, steering and breaking but the human driver must continue to monitor the environment and intervene.

As automation levels increase, the risk and liability for accidents and injuries will shift from the human driver to the automated driving system. Up to Level 4, the human driver will still require some level of insurance cover. At Level 5, where a human has no role, the risk insured will shift completely to the automated driving system and, consequently, the operator and/or manufacturer of that system. The risks posed by driver intoxication, fatigue, medical disability, or just plain inattention are removed completely. Traditional predictors of risk such as age, driving history and traffic violations will no longer be relevant.

As liability increasingly shifts to the automated driving system technology and its manufacturers, the framework will be set for entirely new liability models to develop. Academics in the U.S. have proposed a “market-share” liability model as the cheapest and simplest approach. Under that model each manufacturer would contribute to a common fund from which injured parties could be compensated without having to identify the responsible party. In the Australian market however, liability is more likely to be incorporated into Australia’s largely fault based liability regime. This topic is discussed in more detail in the Product Liability section above.

As automated driving system technology improves and Level 4 and 5 vehicles become the norm, insurers will need to remain on top of actuarial assessments to account for the shifting of risk and liability. Although there will be initial uncertainty, given the large amounts of objective data automated driving system will collect, an informed and accurate evaluation (and therefore price) should be available to insurers in the market relatively quickly.

Implications for CTP products

CTP insurance covers “vehicle owners and drivers who are legally liable for personal injury caused to any person in the event of a motor vehicle crash on a public road. It attaches to the vehicle regardless of who is driving it at the time of the accident. CTP insurance is compulsory for the registration of a motor vehicle in all states and territories in Australia.

If accidents and injuries are reduced as expected, the price and market for CTP cover will in turn shrink and present a significant commercial risk for insurers. The trickle-down effect on industries intimately connected to CTP-related property damage, accidents and injuries will also be drastic. These industries are large and well-established in Australia ranging from smash repairers, claims adjusters, medical-legal assessors and lawyers.

CTP policy wordings currently address liability for the vehicle and its owner, not necessarily the human driver, and will therefore remain relevant as automated driving systems become more prominent. Insurers should however keep under review the definition of registered owners and insureds as the technology advances. The conventional notion of ownership is likely to be redefined as the advent of automated driving systems sees the introduction of increased “shared ownership” of vehicles.

With the switch in risk from driver to automated driving systems, difficult questions as to the interplay between CTP insurance and Australian product liability and consumer law are likely to emerge. For example, more generous damages available under product liability law (as opposed to CTP regimes) means the manufacturers’ exposure in the case of road accidents will be greater than a human driver, and product underwriters will need to revisit pricing structures.

Autonomous vehicles present opportunities for insurers as well.

Although most product liability policies currently exclude risks indemnified under CTP policies, the shifting of risk from driver/owner to automated driving system technology is likely to encourage insurers to reconsider that approach.

We are already seeing lobbying from interested parties in this regard. The Insurance Council of Western Australia argues that, as an automated driving system is clearly a question of manufacturers’ liability, product liability policies should continue to meet their risks in what is already a mature functioning market and not shift those liabilities to government-run or privately-run compulsory third party insurers. By contrast a submission has been made by the NSW Law Society to include a definition of “autonomous vehicles” in the Motor Accident Compensation Act to ensure automated driving systems remained covered under the current CTP insurance regimes.

More broadly, there has been a push by Austroads to develop a national uniform legislative framework, given the differing motor accident schemes across the states and territories. A national “no-fault” scheme, as opposed to the inconsistent approaches across states and territories, may be preferred to plug the gap between automated driving systems and human driver liabilities as complicated assessments of liability and apportionment become more common. Whatever approach is taken, national regulation seems to be the preferred approach.

From a pricing perspective, a study by KPMG predicted that CTP premiums may reduce by as much as 75 per cent for fully autonomous vehicles and the entire insurance industry could contract by as much as 60 per cent as accidents and damages payouts decrease.

At a practical level, premium discounts are currently common in CTP policies for a safe driving history. It might be expected that premium discounts for increasing levels of automation will be seen.

Despite the long-term prediction that compulsory third party will become just third party, and other product lines (i.e., cyber, products liability and private health) will expand to handle automated driving system related accidents, CTP insurance will continue to be relevant in the short term and will remain available, at least until the human element of operating a vehicle is removed completely.

Opportunities and risks for insurers in a driverless vehicle market

While there are risks to CTP product lines, autonomous vehicles present opportunities for insurers as well.

To counteract decreasing CTP premiums, insurers may consider offering different products. Add-on cyber insurance will be a likely contender as wireless entry points to vehicles for cyber criminals increase with automated driving system technology. The risk of a hacker gaining wireless control of a vehicle’s functions – or even of fleets of vehicles – is no longer remote with developing automated driving system technologies.

Bundling CTP, product liability, health and cyber risk insurance into an entirely new automated driving system / technology product has also been discussed by the industry.

Insurers’ usual management strategies for any emerging risks will of course apply. It will be necessary for insurers to continue to update and increase underwriting capabilities, prepare for incremental changes to costs structures and product/business line shifts and maintain an acute appreciation of the risk of non-traditional competitors.

Insurance issues in trials

Guidelines issued for the trialing of autonomous vehicles contemplate that trialing organisations must have appropriate insurance to protect against the risks associated with a trial. The intent is that a person injured would be no worse off than would be the case if a human driver was involved.

The insurances could include:

  • CTP
  • comprehensive vehicle insurance
  • public liability insurance
  • product liability insurance
  • self-insurance
  • work or occupational health and safety insurance

By way of example, for trial applicants, the South Australian government imposed a requirement for public liability insurance and any other insurance the Minister may require. In NSW, trial applicants are required to have a third party policy, public liability for at least AUD$20 million and any other policy required by the Minister.

Next steps

All aspects of the path to deployment of autonomous vehicles – including considerations related to data, road manager liability, manufacturer liability, other liability laws and CTP schemes – affect insurers.

One of the key areas of work for the National Transport Commission in 2018 is to support jurisdictions in reviewing injury insurance schemes to identify any eligibility barriers for occupants of an autonomous vehicle, or those involved in a crash with an autonomous vehicle.

This review is to ensure that injury insurance schemes support all levels of automation and that resulting reforms are nationally consistent wherever possible.

States and territories are to undertake their reviews and report back to National Transport Commission with a view to completing amendments to state and territory CTP and national injury schemes by the end of 2018.



  1. Transport and Infrastructure Council Communiqué, May 2018.
  3. Enforcement Guidelines, p.1.
  4. Enforcement Guidelines, p 5-6.
  5. Changing driving laws to support automated vehicles May 2018
  6. Policy Paper, p.2.
  7. Ibid, p.8.
  8. Ibid, p.16.
  9. Discussion Paper, p.49
  10. Ibid, p.53.
  11. Ibid, p.56
  12. See for example Discussion Paper, p.33, and Policy Paper, p.40.
  13. Discussion Paper, p.44.
  14. Ibid, p.44.
  15. Policy Paper, p.48.
  16. Policy Paper, p.16.
  17. See, for example, Road Transport Act 2013 (NSW) s112.
  18. Tink v Francis [1983] 2 VR 17.
  19. Policy Paper, p.4.
  20. Discussion Paper, p.69.
  21. Ibid, p.76.
  22. Ibid, p.76.
  23. Joint Standing Committee on Road Safety (Staysafe), “‘Driverless Vehicles and Road Safety in NSW” (Report 2/56 – September 2016).
  24. Tess Bennett, “Manufacturers must accept full liability for their driverless cars: Volvo”, Which-50 (March 6, 2017), available at (accessed June 13, 2018).
  25. Safety Assurance for Automated Driving Systems: Consultation Regulation Impact Statement,
  26. House of Representatives Standing Committee on Industry, Innovation, Science and Resources, ‘Social Issues Related to Land-based Automated Vehicles in Australia’ (August 2017) available at;fileType=application%2Fpdf (accessed June 2018).
  27. See, for example, Australian Privacy Principle 12 under Schedule 1 of the Privacy Act 1988 (Cth). 
  28. Australian Government, “Australians to Own their Own Banking, Energy, Phone and Internet Data” (November 26, 2017) available at (accessed June 2018).
  29. Competition and Consumer Commission, ‘New Car Retailing Industry: A Market Study by the ACCC’ (December 2017) available at (accessed June 2018).
  30. Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 (January 19, 2017).
  31. Galexia, “Privacy Impact Assessment for Cooperative Intelligent Transport System (C-ITS) Data Messages” (March 2017) available at (accessed June 2018).
  32. Office of the Australian Information Commissioner, “Chapter 11: APP 11 — Security of Personal Information”‘ available at (accessed June 2018). Alan Finkel, National Fintech Cyber Security Summit, “Cyber Security: Challenges and Opportunities” (May 2016) available at (accessed June 2018).
  33. Alan Finkel, National Fintech Cyber Security Summit, “Cyber Security: Challenges and Opportunities” (May 2016) available at (accessed June 2018).
  34. Department of Infrastructure and Regional Development, “Social Impacts of Automation in Transport: Submission to the House of Representatives Standing Committee on Industry, Innovation, Science and Resources” (February 2017), p.26.
  35. Austroads, “‘ITS Licence Enables Introduction of Next Generation of Connected Vehicles to Australia”‘ (January 11 2018) available at (accessed June 2018).
  36. Commissioner of Patents v RPL Central Pty Ltd [2015] FCAFC 177.
  37. Future Transport Strategy
  38. Productivity Commission Inquiry Report Overview and Recommendations, “Data Availability and Use”, March 31, 2017.
  39. Federal Commission of Taxation v United Aircraft Corporation (1943) 68 CLR 525 at 534, per Latham CJ.
  40. Motor Vehicle (Trials of Automotive Technologies) Amendment Act 2016 (SA), s 134L.
  41. Guidelines for trials of automated vehicles in Australia, National Transport Commission,
  42. ibid.
  43. Copyright, Designs and Patents Act 1988 (UK), section 9(3).
  44. Copyright Act 1968 (Cth), section 22(4).