The House’s SELF DRIVE Act Races Ahead on Privacy
In a rare moment of bipartisanship, the House Energy and Commerce Committee yesterday unanimously approved the SELF DRIVE Act H.R. 3388, sending it to the full House of Representatives for consideration. The bill facilitates introduction and testing of autonomous cars by clarifying federal and state roles, and by granting exemptions from motor vehicle standards that have impeded introduction of new automated vehicle technologies. This vote was an important step forward in enabling introduction of new technologies that have the potential to transform the future of mobility and maximize consumer safety.
The latest version of the bill includes a significant section on consumer privacy, which primarily requires that manufacturers create a written “privacy plan” for every automated vehicle. This privacy plan must explain a manufacturer’s collection, use, sharing, and storage of information about vehicle owners and occupants, and detail manufacturers’ approaches to core privacy principles like data minimization, de-identification, and information retention. Carmaker practices for information that is de-identified, anonymized, or encrypted do not need to be detailed in the privacy plan.
The House’s support for these provisions underscores the growing role that data will play in connected vehicles, and the importance of responsible data practices for this emerging field.
Automakers have proactively tackled this issue, with nearly all automakers developing and committing to the Automotive Privacy Principles in 2014. The Principles, which are enforceable by the Federal Trade Commission, require transparency, affirmative consent for sharing of sensitive data for marketing purposes, and limited sharing of covered information with law enforcement. Many of the provisions in the Hill bill are reflect similar commitments made in these Principles. Moreover, NHTSA’s Federal Automated Vehicles Policy recommends that entities produce a Safety Assessment Letter (SAL) before they introduce new technologies. The SAL, which becomes a legal requirement in the latest version of the House bill, already includes a provision that companies in the ecosystem outline their privacy practices, which ensure basic consumer privacy protection.
The bill also underscores the Federal Trade Commission’s role regarding connected vehicles. While the FTC has authority to bring enforcement actions against unfair or deceptive privacy and data practices across sectors including transportation, the bill highlights the agency’s ability to enforce violations of the privacy-related sections of the bill, and calls on the FTC to study manufacturer privacy plans and practices. The FTC is actively collaborating with NHTSA on this topic, co-hosting a workshop on privacy and security issues related to connected and automated vehicles in June, where the agencies committed to minimize duplication while ensuring consumer protection around privacy and cybersecurity in connected cars.
The bill also calls for creation of a Highly Automated Vehicle Advisory Council that will monitor and provide advice to NHTSA on several issues protection of consumer privacy and security. This Council will have the flexibility to monitor this space and recommend best practices going forward.
The House bill provides flexibility for manufacturers to determine best practices in a nascent industry, where data is only beginning to play a part. The exact data that will need to be generated, stored, and shared to facilitate self-driving cars is not yet known, even by industry experts, and a bill that requires a plan but provides flexibility on exact treatment of such data is a promising step.
The Committee’s work on the SELF DRIVE act has been a successful bipartisan effort and seems likely to advance with continued support after House recess. A Senate bill on self-driving cars is expected shortly, and FPF will stay tuned to see if privacy provisions are included.
Additional Resources
See FPF’s consumer guide to the connected car here
See FPF’s infographic mapping data flows in the connected car here
See FPF’s comments on the Federal Automated Vehicles Policy here
See FPF’s comments on the FTC/NHTSA Workshop here
