Section 1 Short title
This Act may be cited as the “Data Rights for Information and Vehicle Electronics in Real-time Act” or the “DRIVER Act”.
Data Rights for Information and Vehicle Electronics in Real-time Act
A BILL
To require manufacturers of motor vehicles to provide motor vehicle owners with access to and use of motor vehicle data of motor vehicles, and for other purposes.
Sec. 2 Motor vehicle owner access to motor vehicle data
A manufacturer of a motor vehicle shall provide to a motor vehicle owner secure access to, and joint control of, any motor vehicle data of the motor vehicle of such motor vehicle owner as follows:
At no cost beyond the purchase price of such motor vehicle.
In real time.
Without any restriction or limitation with respect to the manner in which such motor vehicle owner, for any lawful purpose—
uses such motor vehicle data; or
authorizes access to or use of such motor vehicle data by a third party, other than a person owned or controlled by a foreign adversary (as defined in section 791.2 of title 15, Code of Federal Regulations).
Without a requirement that such motor vehicle owner pay a fee or purchase a license to decrypt such motor vehicle data or use a device provided by such manufacturer to access and use such motor vehicle data.
Through a motor vehicle interface port (such as an on-board diagnostics port) of such motor vehicle and through wireless transmission of such motor vehicle data (to the extent such motor vehicle is equipped with technology to wirelessly transmit such motor vehicle data).
In a manner that facilitates the deletion of any user data stored in such motor vehicle.
In compliance with any voluntary automotive industry cybersecurity standards requirements (such as ISO/SAE 24134).
Sec. 3 Additional motor vehicle owner data access controls
Vehicle owners’ data access control with respect to motor vehicle manufacturers— A manufacturer of a motor vehicle may not, with respect to a motor vehicle manufactured by such manufacturer, sell any covered data unless the manufacturer provides to the motor vehicle owner of such motor vehicle a clear and conspicuous opportunity to opt out of any such sale.
Fleet vehicle drivers’ data access control with respect to motor vehicle fleet owners—
In general— A motor vehicle fleet owner may not, with respect to a motor vehicle that such motor vehicle fleet owner leases or in which such motor vehicle fleet owner has an ownership or contracted beneficial interest, sell any covered data, unless the motor vehicle fleet owner provides to the driver or operator of such motor vehicle a clear and conspicuous opportunity to opt out of any such sale.
Limitation— The requirement to provide an opportunity to opt out described in paragraph (1) does not apply if the relevant data is generated by a commercial or governmental fleet vehicle driven by a driver in the course of the employment of the driver, except if such driver behavior data is to be sold for the purpose of profiling in furtherance of decisions that knowingly cause negative legal or similarly significant harmful effects concerning the conduct of a person outside the course of the employment of the person.
National security— A manufacturer of a motor vehicle or a motor vehicle fleet owner may not knowingly sell motor vehicle data to any of the following:
The Democratic People’s Republic of Korea.
The People’s Republic of China.
The Russian Federation.
The Islamic Republic of Iran.
The Bolivarian Republic of Venezuela.
Exceptions— For purposes of this section, a sale does not include any of the following activities:
Transferring covered data to emergency responders.
Responding to an owner-initiated communication originating from within a motor vehicle or an app, where covered data may be transferred only to provide the response.
Responding to a vehicle-initiated communication related to the safe operation of a motor vehicle, where covered data may be transferred only to provide the response.
Responding to a driver or user-initiated communication originating from within a motor vehicle or an app, where covered data may be transferred only to provide the response.
Conducting research or efforts to improve, repair, enhance the safety of, or develop products, services, or technology.
Investigating or defending claims and losses.
Conducting investigations of potential product quality, fraud, theft, or safety issues.
Determining or effectuating vehicle field actions, including customer satisfaction campaigns, technical service bulletins, compliance recalls, and safety recalls.
Detecting or responding to cybersecurity incidents.
Administering and fulfilling motor vehicle warranties.
Performing diagnostics and prognostics of a motor vehicle or a component of a motor vehicle.
Identifying and addressing issues that impair functionality.
Disclosing covered data to a processor that processes such covered data on behalf of a manufacturer of a motor vehicle or a motor vehicle fleet owner.
Disclosing or transferring covered data to an affiliate of a manufacturer of a motor vehicle or a motor vehicle fleet owner.
Disclosing information that a consumer—
intentionally makes available to the general public through a channel of mass media; and
does not restrict to a specific audience.
Disclosing or transferring covered data to a third party as an asset that is part of a proposed or an actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the assets of a controller.
Complying with a lawfully executed warrant.
Complying with a court order.
Sec. 4 Enforcement by Commission
Unfair or deceptive acts or practices— A violation of section 2 shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
Powers of Commission— The Commission shall enforce section 2 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and any person who violates such section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Sec. 5 Disclosure of confidential business information
Except as provided in section 2, nothing in this Act shall be construed to require a motor vehicle manufacturer to divulge confidential business information (as defined in section 512.3(c) of title 49, Code of Federal Regulations).
Sec. 6 Relationship to State law
No State, or political subdivision of a State, may maintain, enforce, prescribe, or continue in effect any law, rule, regulation, requirement, standard, or other provision having the force and effect of law that relates to section 2 of this Act.
Sec. 7 Definitions
In this Act:
Biometric identifier— The term biometric identifier means motor vehicle data generated by automatic measurements relating to biological characteristics of an individual that are any of the following:
Fingerprints.
Facial features.
Iris or retina patterns.
Gait.
Voice.
Body measurements.
Weight.
Commission— The term Commission means the Federal Trade Commission.
Covered data—
In general— The term covered data—
means personal data that relates to a biometric identifier, precise geolocation, or driver behavior with respect to a motor vehicle owner (or a driver or other user of a motor vehicle of such motor vehicle owner); and
includes personal data received by such motor vehicle from a personal device of such motor vehicle owner, driver, or other user of a motor vehicle.
Exclusion— The term covered data does not include deidentified, pseudonymous, aggregate, or publicly available information.
Driver behavior— The term driver behavior means motor vehicle data that is used for the purpose of profiling in furtherance of decisions that knowingly cause a negative legal or similarly significant harmful effect concerning the conduct of a motor vehicle owner outside the course of the employment of the motor vehicle owner.
Motor vehicle— The term motor vehicle—
has the meaning given such term in section 30102(a) of title 49, United States Code; and
includes a motor vehicle trailer.
Motor vehicle data— The term motor vehicle data means electronic data generated or processed onboard a motor vehicle, including data generated by sensors, receivers, computer processing units, and other components of the motor vehicle.
Motor vehicle fleet owner— The term motor vehicle fleet owner—
means a person—
with an ownership or contracted beneficial interest in 5 or more motor vehicles; or
who is the lessee of a motor vehicle under a lease agreement with a term of at least 180 days; and
includes a designee of a motor vehicle owner.
Motor vehicle owner— The term motor vehicle owner—
means an owner of a motor vehicle; and
includes—
a designee of such owner;
a person with an ownership or contracted beneficial interest in a motor vehicle; and
a lessee of a motor vehicle under a lease agreement with a term of at least 180 days.
Personal data— The term personal data—
means any motor vehicle data that is linked to an identified or identifiable natural person; and
does not include deidentified, pseudonymous, aggregate, or publicly available information.
Precise geolocation— The term precise geolocation means motor vehicle data that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet.
Sell; sells; sale— The terms sell, sells, and sale—
mean the exchange of data for monetary consideration; and
do not include when a driver or user of a motor vehicle requests a specific product or service from a manufacturer of a motor vehicle or a motor vehicle fleet owner that is necessary for such manufacturer or motor vehicle fleet owner to disclose such motor vehicle data to a third party to provide such service or product to such driver or user.
User data— The term user data—
means data transferred from a personal or external device to a motor vehicle by a motor vehicle owner or user of such motor vehicle; and
does not include motor vehicle data.