You can have it both ways: the internal cameras can be used to compute attentiveness entirely within the car's local computer, any imagery could be immediately

You can have it both ways: the internal cameras can be used to compute attentiveness entirely within the car's local computer, any imagery could be immediately discarded after processing (or better, processed in a way where the imagery and algorithms are hardware-isolated from any computing modules connected to a network or permanent storage). This is similar to how Apple computes a successful face ID or fingerprint scan