Bill would limit how companies use and sell personal car data

People and organizations handling personal car data could collect or use it only when reasonably needed for a listed purpose. The rules would cover linkable information about personal cars and their occupants, including operating, diagnostic, maintenance, location, sensor, and user-generated data. Cars used commercially or for employment would be excluded. Allowed purposes include providing requested services, following legal requirements, protecting safety or security, addressing fraud, conducting independently reviewed public-interest research, and removing identifying links. Research would require independent oversight, expected benefits that outweigh privacy risks, and reasonable privacy safeguards. Limited internal research, repairs, and operations would be allowed after the data meets the bill’s standards for removing identifying links.

Companies would need a person’s clear and specific permission before sharing or selling most personal car data, and they could not share or sell precise location data. Precise location means street-level information or a location within 1,850 feet. The broader consent rule would cover each specific category and planned instance of sharing or sale. Permission could not come from broad service terms, misleading methods, passive actions, or a notice offering only an accept option. Companies would have to make permission easy to withdraw and generally could not deny service, lower quality, or change prices because someone refused or withdrew it. Price or quality differences would be allowed when sharing or selling the data is reasonably necessary for the service or the data’s value reasonably relates to the difference. The consent requirement would not cover data shared with the National Highway Traffic Safety Administration. The separate ban on sharing or selling precise location data states no exception.

Companies would have to explain their car-data practices and provide access to personal car data; consumers could sue over violations. These rights would apply to U.S. citizens and residents, as well as other people located in the United States, whose personal car data a covered person or organization handles. A privacy policy would have to accurately explain the company’s practices and how people can use their rights. Upon request, a company would have to confirm whether it collects or uses the person’s data and provide access to it. When the person consented to sharing or sale, the company would also list non-individual third parties that received the data. If a consumer wins a lawsuit, a court could award the greater of actual damages or at least $5,000 per violation, adjusted annually for inflation. It could also award punitive damages, other relief, legal fees, and court costs. The Federal Trade Commission would enforce the proposal, while state attorneys general and other authorized state officials could also bring cases under stated procedures.

People and organizations handling personal car data would have to report their data practices to the Federal Trade Commission. The reporting duty would cover every person or organization that collects, uses, or transfers personal car data under the proposal. Reports would identify the car data collected, why it was collected, its recipients, and an overview of those recipients’ data-sharing practices. The Federal Trade Commission would summarize the reports for Congress and publish the summary on its website. Initial company reports would be due within 120 days after enactment and annually afterward. The agency’s summary would be due within 180 days after each submission.

The Federal Trade Commission would issue guidance or regulations for carmakers on addressing domestic-violence issues involving location-capable apps. The guidance or regulations would address carmakers’ apps that can determine the precise location of a person, personal car, or device. The Federal Trade Commission would consult the Federal Communications Commission and the National Highway Traffic Safety Administration. The Federal Trade Commission would have to issue the guidance or regulations within 180 days after enactment.