Additional motor vehicle owner data access controls

(a) Vehicle owners’ data access control with respect to motor vehicle manufacturers A manufacturer of a motor vehicle may not, with respect to a motor vehicle manufactured by such manufacturer, sell any covered data unless the manufacturer provides to the motor vehicle owner of such motor vehicle a clear and conspicuous opportunity to opt out of any such sale. (b) Fleet vehicle drivers’ data access control with respect to motor vehicle fleet owners (1) In general A motor vehicle fleet owner may not, with respect to a motor vehicle that such motor vehicle fleet owner leases or in which such motor vehicle fleet owner has an ownership or contracted beneficial interest, sell any covered data, unless the motor vehicle fleet owner provides to the driver or operator of such motor vehicle a clear and conspicuous opportunity to opt out of any such sale. (2) Limitation The requirement to provide an opportunity to opt out described in paragraph (1) does not apply if the relevant data is generated by a commercial or governmental fleet vehicle driven by a driver in the course of the employment of the driver, except if such driver behavior data is to be sold for the purpose of profiling in furtherance of decisions that knowingly cause negative legal or similarly significant harmful effects concerning the conduct of a person outside the course of the employment of the person. (c) National security A manufacturer of a motor vehicle or a motor vehicle fleet owner may not knowingly sell motor vehicle data to any of the following: (1) The Democratic People’s Republic of Korea. (2) The People’s Republic of China. (3) The Russian Federation. (4) The Islamic Republic of Iran. (5) The Bolivarian Republic of Venezuela. (d) Exceptions For purposes of this section, a sale does not include any of the following activities: (1) Transferring covered data to emergency responders. (2) Responding to an owner-initiated communication originating from within a motor vehicle or an app, where covered data may be transferred only to provide the response. (3) Responding to a vehicle-initiated communication related to the safe operation of a motor vehicle, where covered data may be transferred only to provide the response. (4) Responding to a driver or user-initiated communication originating from within a motor vehicle or an app, where covered data may be transferred only to provide the response. (5) Conducting research or efforts to improve, repair, enhance the safety of, or develop products, services, or technology. (6) Investigating or defending claims and losses. (7) Conducting investigations of potential product quality, fraud, theft, or safety issues. (8) Determining or effectuating vehicle field actions, including customer satisfaction campaigns, technical service bulletins, compliance recalls, and safety recalls. (9) Detecting or responding to cybersecurity incidents. (10) Administering and fulfilling motor vehicle warranties. (11) Performing diagnostics and prognostics of a motor vehicle or a component of a motor vehicle. (12) Identifying and addressing issues that impair functionality. (13) Disclosing covered data to a processor that processes such covered data on behalf of a manufacturer of a motor vehicle or a motor vehicle fleet owner. (14) Disclosing or transferring covered data to an affiliate of a manufacturer of a motor vehicle or a motor vehicle fleet owner. (15) Disclosing information that a consumer— (A) intentionally makes available to the general public through a channel of mass media; and (B) does not restrict to a specific audience. (16) Disclosing or transferring covered data to a third party as an asset that is part of a proposed or an actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the assets of a controller. (17) Complying with a lawfully executed warrant. (18) Complying with a court order.