User data and vehicle-generated data privacy and security

(a) Prohibition on manufacturers With respect to a covered vehicle, a manufacturer of such vehicle may not— (1) access covered data, unless— (A) the owner of such covered vehicle or, in the event of the death or incapacity of such owner, the next of kin of such owner affirmatively consents to such manufacturer accessing such data and such consent— (i) is freely given; (ii) is informed, specific, and unambiguous; (iii) is in writing; and (iv) may be easily withdrawn; or (B) such data is accessed solely to improve covered vehicle performance or safety; (2) sell, lease, or otherwise share covered data, unless— (A) required to do so— (i) pursuant to a lawfully executed warrant; (ii) pursuant to a court order that provides the covered vehicle owner notice of the order and at least 48 hours to object and request a hearing; or (iii) to facilitate an emergency response; or (B) the owner of such covered vehicle, or, in the event of the death or incapacity of such owner, the next of kin of such owner, affirmatively consents to such manufacturer to do so and such consent— (i) is freely given; (ii) is informed, specific, and unambiguous; (iii) is in writing; and (iv) may be easily withdrawn; or (3) sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable information of a United States citizen or lawful permanent resident to the following: (A) The Democratic People’s Republic of Korea. (B) The People’s Republic of China. (C) The Russian Federation. (D) The Islamic Republic of Iran. (E) The Bolivarian Republic of Venezuela. (b) Report Not later than 180 days after the date of the enactment of this Act, the Commission shall, in consultation with the Attorney General, the Secretary of Homeland Security, the Secretary of Transportation, and the Federal Communications Commission, submit to Congress a report that describes with respect to covered data— (1) the types of such data that a manufacturer of a covered vehicle accesses; (2) the individuals and entities, other than a manufacturer of a covered vehicle, that access such data; (3) the Federal or State Government entities that access such data and how such entities use such data; (4) the individuals and entities to whom such data may be sold or otherwise shared; (5) the foreign governments to whom such data may be sold or otherwise shared and how such data is used by such foreign governments; (6) the cybersecurity capabilities and risks associated with covered vehicles; (7) occurrences of such data being compromised, including the prevalence of such occurrences and any entities with ties to foreign governments associated with such occurrences; and (8) a description of the feasibility of a technology-neutral, standards-based, secure interface to allow an owner of a covered vehicle access to such data designed without preference or prejudice towards any technology or service used to access and control such data by such owner, and not contingent on ownership or licensing of proprietary technologies by such owner or a manufacturer of a covered vehicle.