Section 1 Short title
This Act may be cited as the “Safe Vehicle Access for Survivors Act”.
Safe Vehicle Access for Survivors Act
A BILL
To establish a process for survivors to request the termination or disabling of connected vehicle services that abusers misuse, and for other purposes.
Sec. 2 Definitions
In this Act:
Abuser— The term “abuser” means an individual identified by a survivor, pursuant to section 4, who has committed or allegedly committed a covered act against a survivor making a connected vehicle services request.
Account holder— The term “account holder” means an individual who is—
a party to a contract with a covered provider that involves a connected vehicle service; or
a subscriber, customer, or registered user of a connected vehicle service.
Connected vehicle service— The term “connected vehicle service” means any capability provided by or on behalf of a motor vehicle manufacturer or affiliate that enables a person to remotely obtain data from or send commands to a covered vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device or computer.
Connected vehicle service request— The term “connected vehicle service request” means a request by a survivor to terminate or disable an abuser’s access to a connected vehicle service.
Covered act—
In general— The term “covered act” means conduct that constitutes—
a crime described in section 40002(a) of the Violence Against Women Act of 1994 (34 U.S.C. 12291(a)), including domestic violence, dating violence, sexual assault, stalking, and sex trafficking;
an act or practice described in paragraph (11) or (12) of section 103 of the Trafficking Victims Protection Act of 2000 (22 U.S.C. 7102) (relating to severe forms of trafficking in persons and sex trafficking, respectively); or
an act under State law, Tribal law, or the Uniform Code of Military Justice that is similar to an offense described in clause (i) or (ii).
Conviction not required— Nothing in paragraph (1) shall be construed to require a criminal conviction or any other determination of a court in order for conduct to constitute a covered act.
Covered connected vehicle service account— The term “covered connected vehicle services account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
Covered provider— The term “covered provider” means a motor vehicle manufacturer, affiliate, or an entity acting on behalf of the motor vehicle manufacturer that provides a connected vehicle service.
Covered vehicle— The term “covered vehicle” means a motor vehicle that is the subject of a connected vehicle request and identified by a survivor pursuant to section 4.
Emergency situation— The term “emergency situation” means a situation that if allowed to continue poses an imminent threat of serious bodily harm or death to an individual.
In-vehicle interface— The term “in-vehicle interface” means a feature or mechanism installed in a vehicle that allows a person within the vehicle to terminate or disconnect connected vehicle services.
Survivor— The term “survivor” means an individual who is not less than 18 years old and against whom a covered act has been committed or allegedly committed.
Affiliate— The term “affiliate” means any company that controls, is controlled by, or is under common control with another company.
Sec. 3 Protection of survivors
In general— Notwithstanding an abuser being an account holder, not later than 2 business days after receiving a connected vehicle service request from a survivor pursuant to section 4, a covered provider shall take 1 or more of the following actions—
terminate or disable a covered connected vehicle service account associated with an abuser identified in the connected vehicle service request pursuant to section 4;
terminate or disable a covered connected vehicle service account associated with the covered vehicle, including by resetting or deleting any data or wireless connection with respect to the covered vehicle, and provide instructions to the survivor on how to re-establish a connected vehicle service account that does not include access by the abuser;
terminate or disable covered connected vehicle services for the covered vehicle, including by resetting or deleting any data or wireless connection with respect to the covered vehicle, and provide instructions to the survivor on how to re-establish connected vehicle services; or
if the vehicle has an in-vehicle interface, provide information to the survivor about the availability of the in-vehicle interface and how to terminate or disable connected vehicle services using the in-vehicle interface.
Access to account data— If a covered provider takes action under subsection (a) in response to a connected vehicle service request, the covered provider shall deny a request from the abuser to obtain any data connected to the connected vehicle service maintained by the covered provider that was generated after the abuser’s access to the connected vehicle services was terminated or disabled following a connected vehicle service request.
Limitations on penalties, fees, and other requirements— A covered provider may not make any action undertaken pursuant to subsection (a) contingent on any requirement other than the requirements under section 4, including—
payment of a fee, penalty, or other charge;
maintaining or extending the term of a connected vehicle service account;
approval of the change by the account holder, if the account holder is not the survivor; or
an increase in the rate charged for the connected vehicle service.
Notice to survivor—
In general— If a covered provider intends to provide any formal notice to the abuser regarding any action undertaken pursuant to subsection (a), the covered provider shall notify the survivor of the date on which the covered provider intends to give such notice to the abuser.
Timing— A covered provider shall take reasonable steps to provide any formal notice to an abuser pursuant to paragraph (1)—
no less than 3 days after the survivor has been notified; and
only after the abuser’s access to the connected vehicle service has been terminated or disabled.
Manner of contact— When completing a connected vehicle service request, a covered provider shall allow the survivor to elect the manner in which the covered provider may—
contact the survivor in response to the request, if necessary; or
notify the survivor of the inability of the covered provider to complete the connected vehicle service request.
Technical infeasibility—
In general— The requirement to effectuate the requested action in subsection (a) shall not apply to a covered provider if the covered provider cannot operationally or technically effectuate the request.
Notification— If a covered provider cannot operationally or technically effectuate the request as described in paragraph (1), the covered provider shall—
promptly notify the survivor who submitted the connected vehicle service request of that infeasibility; and
provide the survivor with information about whether the operational or technical infeasibility can be remedied and, if so, any steps the survivor can take to assist in remedying such infeasibility.
Sec. 4 Connected vehicle service requests
In general— When making a connected vehicle service request under this Act, the survivor shall provide—
the vehicle identification number of the covered vehicle;
the name of the abuser subject to the connected vehicle service request; and
either—
proof of sole ownership of the covered vehicle; or
in the case of a vehicle that is not solely owned by the survivor—
proof of exclusive legal possession of the vehicle, which may take the form of a court order awarding possession of the vehicle to the survivor; or
in the case of a vehicle that is owned in whole or in part by the abuser, a dissolution decree, temporary order, or domestic violence restraining order naming the abuser if the decree or order grants possession of the covered vehicle to the survivor or restricts the abuser’s use of a connected vehicle service against the survivor.
Confidential and secure treatment of personal information—
In general— A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a survivor under subsection (a) as confidential and securely dispose of the information not later than 90 days after receiving the information.
Prohibition on sharing— A covered provider is prohibited from sharing information submitted by a survivor under subsection (a) with any third party without the affirmative consent of the survivor unless such sharing is required to effectuate a connected vehicle service request under subsection (a).
Information provided by survivor— A covered provider shall not require a survivor to provide any information other than what is required in subdivision (a) to establish the ability to terminate an abuser’s access to connected vehicle services.
Rule of construction—
In general— Nothing in paragraph (1) shall be construed to prohibit a covered provider from maintaining, for longer than the period specified in that paragraph, a record that verifies that a survivor fulfilled the conditions of a connected vehicle service request under subsection (a).
Data minimization— The data maintained under subparagraph (A) shall be limited to that which is reasonably necessary and proportionate to verify that a survivor fulfilled the conditions of a connected vehicle service request.
Minimum obligations— The requirements in this Act shall not prohibit or prevent a covered provider from terminating or disabling an abuser’s access to connected vehicle services in emergency situations after receiving a connected vehicle service request.
Changes in ownership or possession— The survivor shall take reasonable steps to notify the covered provider of any change in ownership or possession from what was provided under subsection (a) when the connected vehicle service request was made that materially impacts the need for action taken by the covered provider under subsection 3(a).
Sec. 5 Consumer notices
In general— To enhance transparency and communication, a covered provider shall make information about how survivors can safely make connected vehicle service requests on a publicly available, user-friendly website maintained by a covered provider, including—
Confirmation email— Upon submission of a connected vehicle service request, the covered provider shall automatically send a confirmation email to the survivor, acknowledging the receipt of the connected vehicle service request. This email shall contain a reference number for the request and an outline of the subsequent steps in the process.
Action or resolution alert— Upon completion of review of the request, the survivor shall be informed of the action taken, including the termination of access to the connected vehicle service or if additional information is needed. This alert shall clearly state any relevant details or further actions required from the survivor.
Explanation and assistance— In the event of a connected vehicle service request’s approval, the covered provider shall provide the survivor with a clear explanation and guidance on how to create their own app account, if necessary, to ensure that the survivor can maintain control over the connected vehicle service once the person’s access to the service has been terminated.
Opt-out measures— In the event that an abuser still has access to a survivor’s email account, the covered provider shall provide the option to “opt-out” of receiving notices regarding the connected vehicle service request process, and to the best of their ability, provide alternative options for the survivor to maintain a record of the request process.
Sec. 6 Liability protection
A covered provider and any officer, director, employee, vendor, or agent thereof shall not be subject to liability for any claims deriving from an action taken or omission made with respect to compliance with this Act.
Sec. 7 Effective date
Sec. 8 Effect on other laws
No state or political subdivision of a State may adopt, maintain, enforce, prescribe, or continue in effect any law, regulation, rule, standard, requirement, or other provision having the force and effect of law of any State, or political subdivision of a State, covered by or related to the provisions of this Act, or a rule, regulation or requirement promulgated under this Act.
Sec. 9 Rulemaking
Rulemaking proceeding required— Not later than 180 days after the date of enactment of this Act, the Federal Communications Commission, in consultation with the National Highway Traffic Safety Administration, shall issue a notice of proposed rulemaking to prescribe how covered providers address connected vehicle service requests and covered acts in accordance with this Act, including, but not limited to—
implementation of a reporting and notification process that swiftly revokes or disables an abuser’s access to a survivor’s data and takes into account—
the heightened risk to a survivor for abuse and retaliation upon reporting,
the need for confidentiality in the reporting process,
the ability to remove sensitive data that has already been stored in the connected vehicle service, and
the ability of an abuser to utilize other methods, such as a service request, to access a survivors’ data.
methods, as the Federal Communications Commission deems reasonable, to notify account holders of connected vehicle services of—
the options available to enhance safety and privacy of their experience with the service, and
who can access their data and to what extent they can control that access.
Regulations— Not later than 2 years after the date of enactment of this Act, the Federal Communications Commission, in consultation with the National Highway Traffic Safety Administration, shall conclude the rulemaking proceeding initiated under subsection (a) and shall prescribe regulations to implement the provisions regarding how covered providers address connected vehicle service requests and covered acts in accordance with this Act.