Consumer rights

(a) Privacy policy (1) In general A covered entity shall provide a privacy policy meeting the requirements described in paragraph (2) to each consumer whose consumer car-related data the covered entity collects, processes, or transfers. (2) Privacy policy requirements A privacy policy described in paragraph (1) shall contain— (A) a detailed and accurate representation of the policies of the covered entity regarding the collection, processing, and transferring of consumer car-related data; and (B) a prominent description of how a consumer can exercise the rights described in this Act. (b) Disclosures Upon request from a consumer, a covered entity shall provide such consumer— (1) confirmation regarding whether a covered entity is collecting or processing the consumer car-related data of the consumer; (2) access to such data; and (3) if a consumer has provided affirmative express consent to allow a covered entity to share or sell such data pursuant to section 4(a)(2), a list of any third party, other than an individual to which the covered entity has transferred such data.