Connected vehicle service requests

(a) In general When making a connected vehicle service request under this Act, the survivor shall provide— (1) the vehicle identification number of the covered vehicle; (2) the name of the abuser subject to the connected vehicle service request; and (3) either— (A) proof of sole ownership of the covered vehicle; or (B) in the case of a vehicle that is not solely owned by the survivor— (i) proof of exclusive legal possession of the vehicle, which may take the form of a court order awarding possession of the vehicle to the survivor; or (ii) in the case of a vehicle that is owned in whole or in part by the abuser, a dissolution decree, temporary order, or domestic violence restraining order naming the abuser if the decree or order grants possession of the covered vehicle to the survivor or restricts the abuser’s use of a connected vehicle service against the survivor. (b) Confidential and secure treatment of personal information (1) In general A covered provider and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a survivor under subsection (a) as confidential and securely dispose of the information not later than 90 days after receiving the information. (2) Prohibition on sharing A covered provider is prohibited from sharing information submitted by a survivor under subsection (a) with any third party without the affirmative consent of the survivor unless such sharing is required to effectuate a connected vehicle service request under subsection (a). (3) Information provided by survivor A covered provider shall not require a survivor to provide any information other than what is required in subdivision (a) to establish the ability to terminate an abuser’s access to connected vehicle services. (4) Rule of construction (A) In general Nothing in paragraph (1) shall be construed to prohibit a covered provider from maintaining, for longer than the period specified in that paragraph, a record that verifies that a survivor fulfilled the conditions of a connected vehicle service request under subsection (a). (B) Data minimization The data maintained under subparagraph (A) shall be limited to that which is reasonably necessary and proportionate to verify that a survivor fulfilled the conditions of a connected vehicle service request. (c) Minimum obligations The requirements in this Act shall not prohibit or prevent a covered provider from terminating or disabling an abuser’s access to connected vehicle services in emergency situations after receiving a connected vehicle service request. (d) Changes in ownership or possession The survivor shall take reasonable steps to notify the covered provider of any change in ownership or possession from what was provided under subsection (a) when the connected vehicle service request was made that materially impacts the need for action taken by the covered provider under subsection 3(a).