,,ii #aaith ,,congress #b;d ,session ,s4 #efgc ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #cj1 #bjbf,mr4 ,merkley 7for himself1 ,mr4 ,lujn1 and ,ms4 ,warren7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to restrict car manufacturers and other companies from selling consumer car-related data1 to increase transparency regarding data practices1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,car ,privacy ,rights ,act of #bjbf4 #b4 ,definitions ,in this ,act3 7#a7 ,affirmative express consent ,the term affirmative express consent means an affirmative act by a consumer that-- 7,a7 clearly communicates the authorization of the consumer for an act or practice2 7,b7 is provided in response to a notice that meets the requirements of section #d7;a77#a77;,a72 and 7,c7 is not-- 7i7 acceptance of general or broad terms of service or a similar document2 7ii7 accomplished by hovering over1 muting1 pausing1 or closing a given piece of content2 7iii7 acceptance of an agreement obtained through the use of false1 fraudulent1 or materially misleading means2 or 7iv7 in response to a notice that only provides the choice to accept or agree to the act or practice4 7#b7 ,application ,the term application means a software program that runs on the operating system of a device4 7#c7 ,collect ,the term collect means1 with respect to consumer car-related data1 to buy1 rent1 gather1 obtain1 receive1 access1 or otherwise acquire such data by any means4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,consumer ,the term consumer means an individual who is a citizen or resident of1 or located in1 the ,united ,states4 7#f7 ,consumer car ,the term consumer car means a motor vehicle1 as defined in section #cjajb of title #di1 ,united ,states ,code1 that is owned1 leased1 or operated by a consumer1 but excluding any motor vehicle owned1 leased1 or operated in a commercial or employment context4 7#g7 ,consumer car-related data ,the term consumer car-related data means any information1 including derived data and unique identifiers1 that-- 7,a7 is linked or reasonably linkable1 alone or in combination with other information1 to an individual or a device2 and 7,b7 is-- 7i7 collected or derived from and describes the current or historic operation1 condition1 status1 or precise geolocation of a consumer car or its occupants2 7ii7 electronic data generated or processed onboard a consumer car1 such as data generated by sensors1 receivers1 computer processing units1 or other vehicle components1 including diagnostic1 repair1 and maintenance data2 or 7iii7 stored1 or capable of being stored1 in a consumer car generated by the user of such consumer car4 7#h7 ,covered entity ,the term covered entity means any person that collects1 processes1 or transfers the consumer car-related data of an individual1 including a car manufacturer1 insurance company1 or a company that collects such data through an application4 7#i7 ,de-identified data ,the term de-identified data means consumer car-related data that-- 7,a7 has been processed so as to not be linked or reasonably linkable1 alone or in combination with other information1 to an individual or a device2 and 7,b7 is in possession of a covered entity1 and such covered entity-- 7i7 takes reasonable physical1 administrative1 and technical measures to ensure that such data cannot be associated with an individual or be used to re-identify an individual or a device reasonably linkable to an individual2 7ii7 has publicly committed to not process any data described in subparagraph 7,a7 that is in its possession so as to make such data linked or reasonably linkable1 alone or in combination with other information1 to an individual or a device2 and 7iii7 contractually obligates any recipient of such data to satisfy the requirements described in clauses 7i7 and 7ii74 7#aj7 ,device ,the term device means any electronic equipment capable of collecting1 processing1 retaining1 or transferring consumer car-related data1 including any such device equipped on a consumer car4 7#aa7 ,precise ,geolocation ,the term precise geolocation means information that reveals the past or present physical location of an individual1 consumer car1 or device with sufficient precision to identify-- 7,a7 street-level location information of such individual1 consumer car1 or device2 or 7,b7 the location of such individual1 consumer car1 or device within a range of #a1hej feet or less4 7#ab7 ,process ,the term process1 with respect to consumer car-related data1 means any operation or set of operations performed1 whether by manual or automated means1 on such data1 including the use1 storage1 disclosure1 analysis1 deletion1 or modification of such data4 #c4 ,restricting the collection and processing of consumer car-related data ,a covered entity may only collect or process consumer car-related data if such collection or processing is reasonably necessary to-- 7#a7 provide or maintain a specific product or service requested by the consumer1 including any routine administrative1 operational1 or account-servicing activity1 such as billing1 shipping1 delivery1 storage1 or accounting2 7#b7 provide a communication 7not including an advertisement7 to the consumer that a reasonable consumer would anticipate within the context of the relationship between the covered entity and the consumer2 7#c7 comply with ,federal1 ,state1 or local law2 7#d7 comply with a civil1 criminal1 or regulatory inquiry1 investigation1 subpoena1 or summons by a ,federal1 ,state1 municipal1 or other governmental authority2 7#e7 investigate1 establish1 defend1 or prepare for a legal claim that has been filed against the covered entity2 7#f7 perform under a contract to which the consumer is a party1 including fulfilling the terms of a written warranty2 7#g7 take immediate action to protect an interest that is essential for the life or physical safety of the consumer or another individual1 including by effectuating a product recall2 7#h7 identify theft1 fraud1 harassment1 a malicious or deceptive activity1 or any illegal activity targeted at or involving the covered entity2 7#i7 investigate1 report1 or prosecute an individual responsible for any action described in paragraph 7#h72 7#aj7 preserve the integrity or security of systems of the covered entity2 7#aa7 engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all relevant laws and regulations governing such research1 and is approved1 monitored1 and governed by an institutional review board or similar independent oversight entity that determines that-- 7,a7 the expected benefits of the research outweigh the privacy risks2 and 7,b7 the covered entity has implemented reasonable safeguards to mitigate privacy risks associated with such research1 including any risks associated with the identification of a consumer2 7#ab7 assist another covered entity with any of the obligations under this ,act2 7#ac7 ensure the security and integrity of consumer car-related data2 7#ad7 make such data de-identified data2 or 7#ae7 if such data has been processed to make such data de-identified data-- 7,a7 conduct internal research to develop1 improve1 or repair a product1 service1 or technology of the covered entity1 including through diagnostics1 debugging1 and repairs2 7,b7 identify and repair technical errors that impair existing or intended functionality of a product1 service1 or technology of the covered entity2 or 7,c7 perform solely internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the covered entity4 #d4 ,restricting the sharing or selling of certain data 7a7 ,in general ,subject to the succeeding subsections of this section1 it shall be unlawful for a covered entity to share or sell any consumer car-related data unless-- 7#a7 the covered entity provides the consumer-- 7,a7 a notice that-- 7i7 states that the covered entity intends to share or sell such data2 7ii7 is provided in a clear and conspicuous standalone disclosure that describes each instance the covered entity plans to share or sell such data2 7iii7 for each specific category of such data1 states if the covered entity is sharing or selling such data in order to provide a service requested by the consumer2 7iv7 is written in easy-to-understand language2 7v7 is provided in a manner that would be reasonably anticipated by the consumer given the relationship between the consumer and the covered entity2 and 7vi7 is accessible to individuals with disabilities2 and 7,b7 an opportunity to explicitly grant affirmative express consent to allow the covered entity to share or sell such data2 and 7#b7 the consumer explicitly grants such affirmative express consent4 7b7 ,revocation of consent ,if a consumer grants affirmative express consent to allow a covered entity to share or sell consumer car-related data pursuant to subsection 7a77#b71 the covered entity shall allow such consumer to easily revoke such consent directly through the website or application of the covered entity4 7c7 ,retaliation prohibited 7#a7 ,in general ,a covered entity may not deny a consumer access to a good or service or discriminate or retaliate against a consumer for withholding affirmative express consent under subsection 7a77#b7 or revoking consent under subsection 7b74 7#b7 ,retaliation ,with respect to a consumer withholding affirmative express consent under subsection 7a77#b7 or revoking consent under subsection 7b71 a covered entity shall be considered in violation of paragraph 7#a7 if such covered entity charges a different price or rate for a good or service or provides a different level of quality of a good or service to such consumer compared to the price1 rate1 or quality the covered entity typically charges or provides to other consumers unless it is reasonably necessary for the covered entity to sale or share the consumer's consumer car-related data in order to provide the good or service or the value of such data is reasonably related to the difference in price or quality of the good or service4 7d7 ,exception ,subsection 7a7 shall not apply to any consumer car-related data a covered entity shares with the ,national ,highway ,traffic ,safety ,administration4 7e7 ,precise geolocation data ,it shall be unlawful for a covered entity to share or sell any data relating to a precise geolocation4 #e4 ,consumer rights 7a7 ,privacy policy 7#a7 ,in general ,a covered entity shall provide a privacy policy meeting the requirements described in paragraph 7#b7 to each consumer whose consumer car-related data the covered entity collects1 processes1 or transfers4 7#b7 ,privacy policy requirements ,a privacy policy described in paragraph 7#a7 shall contain-- 7,a7 a detailed and accurate representation of the policies of the covered entity regarding the collection1 processing1 and transferring of consumer car-related data2 and 7,b7 a prominent description of how a consumer can exercise the rights described in this ,act4 7b7 ,disclosures ,upon request from a consumer1 a covered entity shall provide such consumer-- 7#a7 confirmation regarding whether a covered entity is collecting or processing the consumer car-related data of the consumer2 7#b7 access to such data2 and 7#c7 if a consumer has provided affirmative express consent to allow a covered entity to share or sell such data pursuant to section #d7;a77#b71 a list of any third party1 other than an individual to which the covered entity has transferred such data4 #f4 ,reporting of consumer data privacy practices 7a7 ,in general ,not later than #abj days after the date of enactment of this ,act and annually thereafter1 each covered entity shall submit a report to the ,commission regarding their consumer data privacy practices1 including any consumer car-related data that is collected1 the purpose of such collection1 what entities are being shared or sold such data1 and an overview of the data sharing practices of any such entity4 7b7 ,,ftc report ,not later than #ahj days after the submission of each report under subsection 7a71 the ,commission shall submit to ,congress and publish on the website of the ,commission a report containing a summary of the information described in each such report4 #g4 ,guidance or rulemaking regarding car manufacturers addressing domestic violence issues related to their applications ,not later than #ahj days after the date of enactment of this ,act1 the ,commission1 in consultation with the ,federal ,communications ,commission and the ,national ,highway ,traffic ,safety ,administration1 shall issue guidance or promulgate regulations regarding how car manufacturers can address domestic violence issues related to any application of a car manufacturer that has the capability to determine the precise geolocation of an individual1 consumer car1 or device4 #h4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act or a regulation promulgated under this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this subsection shall be construed to limit the authority of the ,commission under any other provision of law4 7,d7 ,rulemaking ,the ,commission shall promulgate in accordance with section #eec of title #e1 ,united ,states ,code1 such rules as may be necessary to carry out this ,act4 7b7 ,enforcement by ,states 7#a7 ,in general ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is threatened or adversely affected by an act or practice in violation of this ,act or a regulation promulgated under this ,act1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in an appropriate district court of the ,united ,states or an appropriate ,state court to-- 7,a7 enjoin such act or practice2 7,b7 enforce compliance with this ,act or the regulations promulgated under this ,act2 7,c7 obtain civil penalties2 7,d7 obtain damages1 restitution1 or other compensation on behalf of the residents of the ,state2 7,e7 obtain reasonable attorney's fees and other litigation costs reasonably incurred2 or 7,f7 obtain such other relief as the court may consider to be appropriate4 7#b7 ,rights of the ,commission 7,a7 ,notice to the ,commission 7i7 ,in general ,except as provided in clause 7iii71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring a civil action under paragraph 7#a7 before initiating the civil action4 7ii7 ,contents ,the notification required by clause 7i7 with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by the ,commission ,the ,commission may-- 7i7 intervene in any civil action brought by the attorney general of a ,state under paragraph 7#a72 and 7ii7 upon intervening-- 7,i7 remove the civil action to the appropriate district court of the ,united ,states1 if the action was not originally brought in such court2 7,,ii7 be heard on all matters arising in the civil action2 and 7,,iii7 file petitions for appeal of a decision in the civil action4 7,c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#c7 ,action by the ,commission ,if the ,commission institutes a civil action with respect to a violation of this ,act or a regulation promulgated under this ,act1 the attorney general of a ,state may not1 during the pendency of such action1 bring a civil action under paragraph 7#a7 against any defendant named in the complaint of the ,commission for the violation with respect to which the ,commission instituted such action4 7#d7 ,actions by other ,state officials 7,a7 ,in general ,in addition to civil actions brought by attorneys general under paragraph 7#a71 any other officer of a ,state who is authorized by the ,state to do so may bring a civil action under such paragraph1 subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general4 7,b7 ,savings provision ,nothing in this subsection may be construed to prohibit an attorney general or authorized official of a ,state from initiating or continuing any proceeding in a court of the ,state for a violation of any civil or criminal law of the ,state4 7#e7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in any ,federal district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7c7 ,private right of action 7#a7 ,in general ,a consumer whose consumer car-related data has been processed1 collected1 shared1 or sold in violation of this ,act may bring a civil action in a court of competent jurisdiction against the covered entity alleged in such violation4 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7,a7 damages in an amount of not less than #e1jjj per violation1 as adjusted annually to reflect any increase in the ,consumer ,price ,index1 or actual damages1 whichever is greater2 7,b7 punitive damages2 7,c7 declaratory or equitable relief2 and 7,d7 reasonable attorney's fees and litigation costs4