,,ii #aaeth ,,congress #ast ,session ,s4 #fhj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ba1 #bjag,mr4 ,markey 7for himself and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect consumers from security and privacy threats to their motor vehicles1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,security and ,privacy in ,your ,car ,act of #bjag or the ,,spy ,car ,act of #bjag4 #b4 ,cybersecurity standards for motor vehicles 7a7 ,in general ,chapter #cja of title #di1 ,united ,states ,code1 is amended-- 7#a7 in section #cjajb7;a7-- 7,a7 by redesignating paragraphs 7#e7 through 7#ac7 as paragraphs 7#aa7 through 7#ai71 respectively2 7,b7 by redesignating paragraphs 7#b7 through 7#d7 as paragraphs 7#e7 through 7#g71 respectively2 7,c7 by redesignating paragraph 7#a7 as paragraph 7#c72 7,d7 by inserting before paragraph 7#c71 as redesignated1 the following3 7#a7 ,administrator means the ,administrator of the ,national ,highway ,traffic ,safety ,administration2 7#b7 ,commission means the ,federal ,trade ,commission2 2 7,e7 by inserting after paragraph 7#c71 as redesignated1 the following3 7#d7 critical software systems means software systems that can affect the driver's control of the vehicle movement2 2 and 7,f7 by inserting after paragraph 7#g71 as redesignated1 the following3 7#h7 driving data includes any electronic information collected about-- 7,a7 a vehicle's status1 including1 but not limited to1 its location or speed2 and 7,b7 any owner1 lessee1 driver1 or passenger of a vehicle2 7#i7 entry points includes means by which-- 7,a7 driving data may be accessed1 directly or indirectly2 or 7,b7 control signals may be sent or received either wirelessly or through wired connections2 7#aj7 hacking means the unauthorized access to electronic controls or driving data1 either wirelessly or through wired connections2 2 and 7#b7 by inserting after section #cjabh the following3 #cjabi4 ,cybersecurity standards 7a7 ,cybersecurity standards 7#a7 ,requirement ,all motor vehicles manufactured for sale in the ,united ,states on or after the date that is two years after the date on which final regulations are prescribed pursuant to section #b7;b77#b7 of the ,,spy ,car ,act of #bjag shall comply with the cybersecurity standards set forth in paragraphs 7#b7 through 7#d74 7#b7 ,protection against hacking 7,a7 ,in general ,all entry points to the electronic systems of each motor vehicle manufactured for sale in the ,united ,states shall be equipped with reasonable measures to protect against hacking attacks4 7,b7 ,isolation measures ,the measures referred to in subparagraph 7,a7 shall incorporate isolation measures to separate critical software systems from noncritical software systems4 7,c7 ,evaluation ,the measures referred to in subparagraphs 7,a7 and 7,b7 shall be evaluated for security vulnerabilities following best security practices1 including appropriate applications of techniques such as penetration testing4 7,d7 ,adjustment ,the measures referred to in subparagraphs 7,a7 and 7,b7 shall be adjusted and updated based on the results of the evaluation described in subparagraph 7,c74 7#c7 ,security of collected information ,all driving data collected by the electronic systems that are built into motor vehicles shall be reasonably secured to prevent unauthorized access-- 7,a7 while such data are stored onboard the vehicle2 7,b7 while such data are in transit from the vehicle to another location2 and 7,c7 in any subsequent offboard storage or use4 7#d7 ,detection1 reporting1 and responding to hacking ,any motor vehicle that presents an entry point shall be equipped with capabilities to immediately detect1 report1 and stop attempts to intercept driving data or control the vehicle4 7b7 ,penalties ,a person that violates this section is liable to the ,united ,states ,government for a civil penalty of not more than #e1jjj for each violation in accordance with section #cjafe4 4 7b7 ,rulemaking 7#a7 ,in general ,not later than #ah months after the date of the enactment of this ,act1 the ,administrator of the ,national ,highway ,traffic ,safety ,administration1 after consultation with the ,federal ,trade ,commission1 shall issue a ,notice of ,proposed ,rulemaking to carry out section #cjabi of title #di1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,final regulations ,not later than three years after the date of the enactment of this ,act1 the ,administrator1 after consultation with the ,commission1 shall issue final regulations to carry out section #cjabi of title #di1 ,united ,states ,code1 as added by subsection 7a74 7#c7 ,updates ,not later than three years after final regulations are issued pursuant to paragraph 7#b7 and not less frequently than once every three years thereafter1 the ,administrator1 after consultation with the ,commission1 shall-- 7,a7 review the regulations issued pursuant to paragraph 7#b72 and 7,b7 update such regulations1 as necessary4 7c7 ,clerical amendment ,the table of sections for chapter #cja of title #di1 ,united ,states ,code1 is amended by striking the item relating to section #cjabh and inserting the following3 #cjabh4 ,vehicle rollover prevention and crash mitigation4#cjabi4 ,cybersecurity standards4 4 7d7 ,conforming amendment ,section #cjafe7;a77#a7 of title #di1 ,united ,states ,code1 is amended by inserting #cjabi1 after #cjabg14 #c4 ,cyber dashboard 7a7 ,in general ,section #cbcjb of title #di1 ,united ,states ,code1 is amended by adding at the end the following3 7e7 ,cyber dashboard 7#a7 ,in general ,all motor vehicles manufactured for sale in the ,united ,states on or after the date that is #b years after the date on which final regulations are prescribed pursuant to section #c7;b77#b7 of the ,,spy ,car ,act of #bjag shall display a cyber dashboard1 as a component of the label required to be affixed to each motor vehicle under section #cbijh7;b74 7#b7 ,features ,the cyber dashboard required under paragraph 7#a7 shall inform consumers1 through an easy-to-understand1 standardized graphic1 about the extent to which the motor vehicle protects the cybersecurity and privacy of motor vehicle owners1 lessees1 drivers1 and passengers beyond the minimum requirements set forth in section #cjabi of this title and in section #bg of the ,federal ,trade ,commission ,act4 4 7b7 ,rulemaking 7#a7 ,in general ,not later than #ah months after the date of the enactment of this ,act1 the ,administrator1 after consultation with the ,commission1 shall prescribe regulations for the cybersecurity and privacy information required to be displayed under section #cbcjb7;c7 of title #di1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,final regulations ,not later than #c years after the date of the enactment of this ,act1 the ,administrator1 after consultation with the ,commission1 shall issue final regulations to carry out section #cbcjb of title #di1 ,united ,states ,code1 as added by subsection 7a74 7#c7 ,updates ,not less frequently than once every #c years1 the ,administrator1 after consultation with the ,commission1 shall-- 7,a7 review the regulations issued pursuant to paragraph 7#b72 and 7,b7 update such regulations1 as necessary4 #d4 ,privacy standards for motor vehicles 7a7 ,in general ,the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 is amended by inserting after section #bf 7#ae ,u4,s4,c4 #eg;c-#b7 the following3 #bg4 ,privacy standards for motor vehicles 7a7 ,in general ,all motor vehicles manufactured for sale in the ,united ,states on or after the date that is two years after the date on which final regulations are prescribed pursuant to subsection 7e7 shall comply with the requirements under subsections 7b7 through 7d74 7b7 ,transparency ,each motor vehicle shall provide clear and conspicuous notice1 in clear and plain language1 to the owners or lessees of such vehicle of the collection1 transmission1 retention1 and use of driving data collected from such motor vehicle4 7c7 ,consumer control 7#a7 ,in general ,subject to paragraphs 7#b7 and 7#c71 owners or lessees of motor vehicles shall be given the option of terminating the collection and retention of driving data4 7#b7 ,access to navigation tools ,if a motor vehicle owner or lessee decides to terminate the collection and retention of driving data under paragraph 7#a71 the owner or lessee shall not lose access to navigation tools or other features or capabilities1 to the extent technically possible4 7#c7 ,exception ,paragraph 7#a7 shall not apply to driving data stored as part of the electronic data recorder system or other safety systems on-board the motor vehicle that are required for post-incident investigations1 emissions history checks1 crash avoidance or mitigation1 or other regulatory compliance programs4 7d7 ,limitation on use of personal driving information 7#a7 ,in general ,a manufacturer 7including an original equipment manufacturer7 may not use any information collected by a motor vehicle for advertising or marketing purposes without affirmative express consent by the owner or lessee4 7#b7 ,requests ,consent requests under paragraph 7#a7-- 7,a7 shall be clear and conspicuous2 7,b7 shall be made in clear and plain language2 and 7,c7 may not be a condition for the use of any nonmarketing feature1 capability1 or functionality of the motor vehicle4 7e7 ,enforcement ,a violation of this section shall be treated as an unfair or deceptive act or practice in violation of a rule prescribed under section #ah7;a77#a77;,b74 4 7b7 ,rulemaking 7#a7 ,in general ,not later than #ah months after the date of the enactment of this ,act1 the ,federal ,trade ,commission1 after consultation with the ,administrator of the ,national ,highway ,traffic ,safety ,administration1 shall prescribe regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 to carry out section #bg of the ,federal ,trade ,commission ,act1 as added by subsection 7a74 7#b7 ,final regulations ,not later than three years after the date of the enactment of this ,act1 the ,commission1 after consultation with the ,administrator1 shall issue final regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 to carry out section #bg of the ,federal ,trade ,commission ,act1 as added by subsection 7a74 7#c7 ,updates ,not less frequently than once every three years1 the ,commission1 after consultation with the ,administrator1 shall-- 7,a7 review the regulations prescribed pursuant to paragraph 7#b72 and 7,b7 update such regulations1 as necessary4