SPY Car Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2182 To protect consumers from security and privacy threats to their motor vehicles, and for other purposes. IN THE SENATE OF THE UNITED STATES JULY 18, 2019 Mr. MARKEY (for himself and Mr. BLUMENTHAL) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To protect consumers from security and privacy threats to their motor vehicles, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Security and Privacy 4 in Your Car Act of 2019’’ or the ‘‘SPY Car Act of 2019’’. 5 SEC. 2. CYBERSECURITY STANDARDS FOR MOTOR VEHI- 6 CLES. 7 (a) IN GENERAL.—Chapter 301 of title 49, United 8 States Code, is amended by inserting after section 30128 9 the following: 10 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 2 •S 2182 IS ‘‘§ 30129. Cybersecurity standards 1 ‘‘(a) DEFINITIONS.—In this section: 2 ‘‘(1) CRITICAL SOFTWARE SYSTEMS.—The term 3 ‘critical software systems’ means software systems 4 that can affect— 5 ‘‘(A) the control by the driver of the vehi- 6 cle movement; or 7 ‘‘(B) the safety features of the vehicle. 8 ‘‘(2) DRIVING DATA.—The term ‘driving data’ 9 includes any electronic information collected about— 10 ‘‘(A) the status of a vehicle, including the 11 location and speed of the vehicle; and 12 ‘‘(B) any owner, lessee, driver, or pas- 13 senger of a vehicle. 14 ‘‘(3) ENTRY POINT.—The term ‘entry point’ in- 15 cludes a means by which— 16 ‘‘(A) driving data may be accessed, directly 17 or indirectly; or 18 ‘‘(B) a control signal may be sent or re- 19 ceived either wirelessly or through wired con- 20 nections. 21 ‘‘(4) HACKING.—The term ‘hacking’ means the 22 unauthorized access to electronic controls, critical 23 software systems, or driving data, either wirelessly 24 or through wired connections. 25 ‘‘(b) CYBERSECURITY STANDARDS.— 26 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 3 •S 2182 IS ‘‘(1) REQUIREMENT.—All motor vehicles manu- 1 factured for sale in the United States on or after the 2 date that is 2 years after the date on which regula- 3 tions are promulgated pursuant to section 2(c)(2) of 4 the SPY Car Act of 2019 shall comply with the cy- 5 bersecurity standards under paragraphs (2) through 6 (4). 7 ‘‘(2) PROTECTION AGAINST HACKING.— 8 ‘‘(A) IN GENERAL.—All entry points to the 9 electronic systems of each motor vehicle manu- 10 factured for sale in the United States shall be 11 equipped with reasonable measures to protect 12 against hacking attacks. 13 ‘‘(B) ISOLATION MEASURES.—The meas- 14 ures referred to in subparagraph (A) shall in- 15 corporate isolation measures to separate critical 16 software systems from noncritical software sys- 17 tems. 18 ‘‘(C) EVALUATION.—The measures re- 19 ferred to in subparagraph (A) shall be evalu- 20 ated for security vulnerabilities following best 21 security practices, including appropriate appli- 22 cations of techniques such as penetration test- 23 ing. 24 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 4 •S 2182 IS ‘‘(D) ADJUSTMENT.—The measures re- 1 ferred to in subparagraph (A) shall be adjusted 2 and updated based on the results of the evalua- 3 tion under subparagraph (C). 4 ‘‘(3) SECURITY OF COLLECTED INFORMA- 5 TION.—All driving data collected by the electronic 6 systems that are built into motor vehicles shall be 7 reasonably secured to prevent unauthorized access— 8 ‘‘(A) while the data is stored onboard the 9 vehicle; 10 ‘‘(B) while the data is in transit from the 11 vehicle to another location; and 12 ‘‘(C) in any subsequent offboard storage or 13 use of the data. 14 ‘‘(4) DETECTION, REPORTING, AND RESPOND- 15 ING TO HACKING.—Any motor vehicle manufactured 16 for sale in the United States that presents an entry 17 point shall be equipped with capabilities to imme- 18 diately detect, report, and stop attempts to intercept 19 driving data or control the vehicle.’’. 20 (b) CIVIL PENALTIES.—Section 30165(a)(1) of title 21 49, United States Code, is amended by inserting ‘‘30129,’’ 22 after ‘‘30127,’’. 23 (c) RULEMAKING.— 24 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 5 •S 2182 IS (1) IN GENERAL.—Not later than 18 months 1 after the date of enactment of this Act, the Adminis- 2 trator of the National Highway Traffic Safety Ad- 3 ministration (referred to in this subsection as the 4 ‘‘Administrator’’), after consultation with the Fed- 5 eral Trade Commission, shall issue a notice of pro- 6 posed rulemaking to carry out section 30129 of title 7 49, United States Code. 8 (2) FINAL REGULATIONS.—Not later than 3 9 years after the date of enactment of this Act, the 10 Administrator, after consultation with the Federal 11 Trade Commission, shall promulgate final regula- 12 tions to carry out section 30129 of title 49, United 13 States Code. 14 (3) UPDATES.—Not later than 3 years after 15 final regulations are promulgated pursuant to para- 16 graph (2) and not less frequently than once every 3 17 years thereafter, the Administrator, after consulta- 18 tion with the Federal Trade Commission, shall— 19 (A) review the final regulations promul- 20 gated pursuant to paragraph (2); and 21 (B) update the final regulations, as nec- 22 essary. 23 (d) CLERICAL AMENDMENT.—The table of sections 24 for chapter 301 of title 49, United States Code, is amend- 25 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 6 •S 2182 IS ed by inserting after the item relating to section 30128 1 the following: 2 ‘‘30129. Cybersecurity standards.’’. SEC. 3. CYBER DASHBOARD. 3 (a) IN GENERAL.—Section 32302 of title 49, United 4 States Code, is amended by adding at the end the fol- 5 lowing: 6 ‘‘(e) CYBER DASHBOARD.— 7 ‘‘(1) IN GENERAL.—All motor vehicles manu- 8 factured for sale in the United States on or after the 9 date that is 2 years after the date on which final 10 regulations are promulgated pursuant to section 11 3(b)(2) of the SPY Car Act of 2019 shall display a 12 ‘cyber dashboard’ as a component of the label re- 13 quired to be affixed to each motor vehicle under sec- 14 tion 3 of the Automobile Information Disclosure Act 15 (15 U.S.C. 1232). 16 ‘‘(2) FEATURES.—The cyber dashboard re- 17 quired under paragraph (1) shall inform consumers, 18 through an easy to understand, standardized graph- 19 ic, about the extent to which the motor vehicle pro- 20 tects the cybersecurity and privacy of motor vehicle 21 owners, lessees, drivers, and passengers beyond the 22 minimum requirements under section 30129 of this 23 title and in section 27 of the Federal Trade Com- 24 mission Act.’’. 25 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 7 •S 2182 IS (b) RULEMAKING.— 1 (1) IN GENERAL.—Not later than 18 months 2 after the date of enactment of this Act, the Adminis- 3 trator of the National Highway Traffic Safety Ad- 4 ministration (referred to in this subsection as the 5 ‘‘Administrator’’), after consultation with the Fed- 6 eral Trade Commission, shall issue a notice of pro- 7 posed rulemaking for the cybersecurity and privacy 8 information required to be displayed under section 9 32302(e) of title 49, United States Code. 10 (2) FINAL REGULATIONS.—Not later than 3 11 years after the date of enactment of this Act, the 12 Administrator, after consultation with the Federal 13 Trade Commission, shall promulgate final regula- 14 tions to carry out section 32302(e) of title 49, 15 United States Code. 16 (3) UPDATES.—Not less frequently than once 17 every 3 years, the Administrator, after consultation 18 with the Federal Trade Commission, shall— 19 (A) review the final regulations promul- 20 gated pursuant to paragraph (2); and 21 (B) update the final regulations, as nec- 22 essary. 23 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 8 •S 2182 IS SEC. 4. PRIVACY STANDARDS FOR MOTOR VEHICLES. 1 (a) IN GENERAL.—The Federal Trade Commission 2 Act (15 U.S.C. 41 et seq.) is amended by inserting after 3 section 26 (15 U.S.C. 57c–2) the following: 4 ‘‘SEC. 27. PRIVACY STANDARDS FOR MOTOR VEHICLES. 5 ‘‘(a) DEFINITIONS.—In this section: 6 ‘‘(1) COVERED MOTOR VEHICLE.—The term 7 ‘covered motor vehicle’ means a motor vehicle that— 8 ‘‘(A) is manufactured for sale in the 9 United States on or after the date that is 2 10 years after the date on which final regulations 11 are promulgated under section 4(b) of the SPY 12 Car Act of 2019; and 13 ‘‘(B) collects driving data. 14 ‘‘(2) DRIVING DATA.—The term ‘driving data’ 15 has the meaning given the term in section 30129(a) 16 of title 49, United States Code. 17 ‘‘(b) REQUIREMENT.—Each covered motor vehicle 18 shall comply with the requirements described in sub- 19 sections (c) through (e). 20 ‘‘(c) TRANSPARENCY.—Each manufacturer of a cov- 21 ered motor vehicle shall provide to each owner and lessee 22 of the covered motor vehicle a clear and conspicuous no- 23 tice, in clear and plain language, of any collection, trans- 24 mission, retention, or use of driving data collected from 25 the covered motor vehicle. 26 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 9 •S 2182 IS ‘‘(d) CONSUMER CONTROL.— 1 ‘‘(1) IN GENERAL.—Subject to paragraphs (2) 2 and (3), an owner or lessee of a covered motor vehi- 3 cle may opt out of the collection and retention of 4 driving data by the covered motor vehicle. 5 ‘‘(2) ACCESS TO NAVIGATION TOOLS.—If an 6 owner or lessee of a covered motor vehicle opts out 7 of the collection and retention of driving data under 8 paragraph (1), the owner or lessee shall not, to the 9 extent technically possible, lose access to any naviga- 10 tion tool or other feature or capability. 11 ‘‘(3) EXCEPTION.—Paragraph (1) shall not 12 apply to driving data stored as part of the electronic 13 data recorder system or other safety systems on 14 board the motor vehicle that are required for post- 15 incident investigations, emissions history checks, 16 crash avoidance or mitigation, or other regulatory 17 compliance programs. 18 ‘‘(e) LIMITATION ON USE OF PERSONAL DRIVING IN- 19 FORMATION.— 20 ‘‘(1) IN GENERAL.—No manufacturer, including 21 an original equipment manufacturer, may use any 22 information collected by a covered motor vehicle for 23 the purpose of advertising or marketing without the 24 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 10 •S 2182 IS affirmative, express consent of the owner or lessee of 1 the covered motor vehicle. 2 ‘‘(2) REQUESTS.—Any request for the consent 3 under paragraph (1) by a manufacturer— 4 ‘‘(A) shall be clear and conspicuous; 5 ‘‘(B) shall be made in clear and plain lan- 6 guage; and 7 ‘‘(C) may not be a condition for the use of 8 any nonmarketing feature, capability, or 9 functionality of the covered motor vehicle. 10 ‘‘(f) ENFORCEMENT.—A violation of this section shall 11 be treated as a violation of a rule defining an unfair or 12 deceptive act or practice prescribed under section 13 18(a)(1)(B).’’. 14 (b) RULEMAKING.— 15 (1) IN GENERAL.—Not later than 18 months 16 after the date of enactment of this Act, the Federal 17 Trade Commission, after consultation with the Ad- 18 ministrator of the National Highway Traffic Safety 19 Administration (referred to in this subsection as the 20 ‘‘Administrator’’), shall issue a notice of proposed 21 rulemaking, in accordance with section 553 of title 22 5, United States Code, to carry out section 27 of the 23 Federal Trade Commission Act. 24 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 11 •S 2182 IS (2) FINAL REGULATIONS.—Not later than 3 1 years after the date of enactment of this Act, the 2 Federal Trade Commission, after consultation with 3 the Administrator, shall promulgate final regula- 4 tions, in accordance with section 553 of title 5, 5 United States Code, to carry out section 27 of the 6 Federal Trade Commission Act. 7 (3) UPDATES.—Not less frequently than once 8 every 3 years, the Federal Trade Commission, after 9 consultation with the Administrator, shall— 10 (A) review the final regulations promul- 11 gated under paragraph (2); and 12 (B) update the final regulations as nec- 13 essary. 14 SEC. 5. CYBERSECURITY TOOLS AND CYBER COORDI- 15 NATOR. 16 (a) DEFINITIONS.—In this section: 17 (1) ADMINISTRATOR.—The term ‘‘Adminis- 18 trator’’ means the Administrator of the Federal 19 Highway Administration. 20 (2) CYBER INCIDENT.—The term ‘‘cyber inci- 21 dent’’ has the meaning given the term ‘‘significant 22 cyber incident’’ in Presidential Policy Directive–41 23 (July 26, 2016, relating to cyber incident coordina- 24 tion). 25 VerDate Sep 11 2014 23:30 Jul 23, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2182.IS S2182 kjohnson on DSK79L0C42 with BILLS 12 •S 2182 IS (3) TRANSPORTATION AUTHORITY.—The term 1 ‘‘transportation authority’’ means— 2 (A) a public authority (as defined in sec- 3 tion 101(a) of title 23, United States Code); 4 (B) an owner or operator of a highway (as 5 defined in section 101(a) of title 23, United 6 States Code); 7 (C) a manufacturer that manufactures a 8 product related to transportation; and 9 (D) a division office of the Federal High- 10 way Administration. 11 (b) CYBERSECURITY TOOL.— 12 (1) IN GENERAL.—Not later than 2 years after 13 the date of enactment of this Act, the Administrator 14 shall develop a tool to assist transportation authori- 15 ties in identifying, detecting, protecting against, re- 16 sponding to, and recovering from cyber incidents. 17 (2) REQUIREMENTS.—In developing the tool 18 under paragraph (1), the Administrator shall— 19 (A) use the cybersecurity framework estab- 20 lished by the National Institute of Standards 21 and Technology and required by Executive 22 Order 13636 of February 12, 2013 (78 Fed. 23 Reg. 11739; relating to improving critical inf [Text truncated for display. Full text available on Congress.gov.]