Restricting the collection and processing of consumer car-related data

A covered entity may only collect or process consumer car-related data if such collection or processing is reasonably necessary to— (1) provide or maintain a specific product or service requested by the consumer, including any routine administrative, operational, or account-servicing activity, such as billing, shipping, delivery, storage, or accounting; (2) provide a communication (not including an advertisement) to the consumer that a reasonable consumer would anticipate within the context of the relationship between the covered entity and the consumer; (3) comply with Federal, State, or local law; (4) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a Federal, State, municipal, or other governmental authority; (5) investigate, establish, defend, or prepare for a legal claim that has been filed against the covered entity; (6) perform under a contract to which the consumer is a party, including fulfilling the terms of a written warranty; (7) take immediate action to protect an interest that is essential for the life or physical safety of the consumer or another individual, including by effectuating a product recall; (8) identify theft, fraud, harassment, a malicious or deceptive activity, or any illegal activity targeted at or involving the covered entity; (9) investigate, report, or prosecute an individual responsible for any action described in paragraph (8); (10) preserve the integrity or security of systems of the covered entity; (11) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all relevant laws and regulations governing such research, and is approved, monitored, and governed by an institutional review board or similar independent oversight entity that determines that— (A) the expected benefits of the research outweigh the privacy risks; and (B) the covered entity has implemented reasonable safeguards to mitigate privacy risks associated with such research, including any risks associated with the identification of a consumer; (12) assist another covered entity with any of the obligations under this Act; (13) ensure the security and integrity of consumer car-related data; (14) make such data de-identified data; or (15) if such data has been processed to make such data de-identified data— (A) conduct internal research to develop, improve, or repair a product, service, or technology of the covered entity, including through diagnostics, debugging, and repairs; (B) identify and repair technical errors that impair existing or intended functionality of a product, service, or technology of the covered entity; or (C) perform solely internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the covered entity.