II 

115TH CONGRESS 

1ST SESSION S. 680 

To protect consumers from security and privacy threats to their motor 

vehicles, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 21, 2017 

Mr. MARKEY (for himself and Mr. BLUMENTHAL) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To protect consumers from security and privacy threats to 

their motor vehicles, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Security and Privacy 

5 in Your Car Act of 2017’’ or the ‘‘SPY Car Act of 2017’’. 

6 SEC. 2. CYBERSECURITY STANDARDS FOR MOTOR VEHI7 CLES. 

8 (a) IN GENERAL.—Chapter 301 of title 49, United 

9 States Code, is amended— 

10 (1) in section 30102(a)— 


lotter on DSK5VPTVN1PROD with BILLS
2 

•S 680 IS

1 (A) by redesignating paragraphs (5) 

2 through (13) as paragraphs (11) through (19), 

3 respectively; 

4 (B) by redesignating paragraphs (2) 

5 through (4) as paragraphs (5) through (7), re6 spectively; 

7 (C) by redesignating paragraph (1) as 

8 paragraph (3); 

9 (D) by inserting before paragraph (3), as 

10 redesignated, the following: 

11 ‘‘(1) ‘Administrator’ means the Administrator 

12 of the National Highway Traffic Safety Administra13 tion; 

14 ‘‘(2) ‘Commission’ means the Federal Trade 

15 Commission;’’; 

16 (E) by inserting after paragraph (3), as re17 designated, the following: 

18 ‘‘(4) ‘critical software systems’ means software 

19 systems that can affect the driver’s control of the ve20 hicle movement;’’; and 

21 (F) by inserting after paragraph (7), as re22 designated, the following: 

23 ‘‘(8) ‘driving data’ includes any electronic infor24 mation collected about— 


lotter on DSK5VPTVN1PROD with BILLS
3 

•S 680 IS

1 ‘‘(A) a vehicle’s status, including, but not 

2 limited to, its location or speed; and 

3 ‘‘(B) any owner, lessee, driver, or pas4 senger of a vehicle; 

5 ‘‘(9) ‘entry points’ includes means by which— 

6 ‘‘(A) driving data may be accessed, directly 

7 or indirectly; or 

8 ‘‘(B) control signals may be sent or re9 ceived either wirelessly or through wired con10 nections; 

11 ‘‘(10) ‘hacking’ means the unauthorized access 

12 to electronic controls or driving data, either wire13 lessly or through wired connections;’’; and 

14 (2) by inserting after section 30128 the fol15 lowing: 

16 ‘‘§ 30129. Cybersecurity standards 

17 ‘‘(a) CYBERSECURITY STANDARDS.— 

18 ‘‘(1) REQUIREMENT.—All motor vehicles manu19 factured for sale in the United States on or after the 

20 date that is two years after the date on which final 

21 regulations are prescribed pursuant to section 

22 2(b)(2) of the SPY Car Act of 2017 shall comply 

23 with the cybersecurity standards set forth in para24 graphs (2) through (4). 

25 ‘‘(2) PROTECTION AGAINST HACKING.— 


lotter on DSK5VPTVN1PROD with BILLS
4 

•S 680 IS

1 ‘‘(A) IN GENERAL.—All entry points to the 

2 electronic systems of each motor vehicle manu3 factured for sale in the United States shall be 

4 equipped with reasonable measures to protect 

5 against hacking attacks. 

6 ‘‘(B) ISOLATION MEASURES.—The meas7 ures referred to in subparagraph (A) shall in8 corporate isolation measures to separate critical 

9 software systems from noncritical software sys10 tems. 

11 ‘‘(C) EVALUATION.—The measures re12 ferred to in subparagraphs (A) and (B) shall be 

13 evaluated for security vulnerabilities following 

14 best security practices, including appropriate 

15 applications of techniques such as penetration 

16 testing. 

17 ‘‘(D) ADJUSTMENT.—The measures re18 ferred to in subparagraphs (A) and (B) shall be 

19 adjusted and updated based on the results of 

20 the evaluation described in subparagraph (C). 

21 ‘‘(3) SECURITY OF COLLECTED INFORMA22 TION.—All driving data collected by the electronic 

23 systems that are built into motor vehicles shall be 

24 reasonably secured to prevent unauthorized access— 


lotter on DSK5VPTVN1PROD with BILLS
5 

•S 680 IS

1 ‘‘(A) while such data are stored onboard 

2 the vehicle; 

3 ‘‘(B) while such data are in transit from 

4 the vehicle to another location; and 

5 ‘‘(C) in any subsequent offboard storage or 

6 use. 

7 ‘‘(4) DETECTION, REPORTING, AND RESPOND8 ING TO HACKING.—Any motor vehicle that presents 

9 an entry point shall be equipped with capabilities to 

10 immediately detect, report, and stop attempts to 

11 intercept driving data or control the vehicle. 

12 ‘‘(b) PENALTIES.—A person that violates this section 

13 is liable to the United States Government for a civil pen14 alty of not more than $5,000 for each violation in accord15 ance with section 30165.’’. 

16 (b) RULEMAKING.— 

17 (1) IN GENERAL.—Not later than 18 months 

18 after the date of the enactment of this Act, the Ad19 ministrator of the National Highway Traffic Safety 

20 Administration, after consultation with the Federal 

21 Trade Commission, shall issue a Notice of Proposed 

22 Rulemaking to carry out section 30129 of title 49, 

23 United States Code, as added by subsection (a). 

24 (2) FINAL REGULATIONS.—Not later than three 

25 years after the date of the enactment of this Act, the 


lotter on DSK5VPTVN1PROD with BILLS
6 

•S 680 IS

1 Administrator, after consultation with the Commis2 sion, shall issue final regulations to carry out section 

3 30129 of title 49, United States Code, as added by 

4 subsection (a). 

5 (3) UPDATES.—Not later than three years after 

6 final regulations are issued pursuant to paragraph 

7 (2) and not less frequently than once every three 

8 years thereafter, the Administrator, after consulta9 tion with the Commission, shall— 

10 (A) review the regulations issued pursuant 

11 to paragraph (2); and 

12 (B) update such regulations, as necessary. 

13 (c) CLERICAL AMENDMENT.—The table of sections 

14 for chapter 301 of title 49, United States Code, is amend15 ed by striking the item relating to section 30128 and in16 serting the following: 

‘‘30128. Vehicle rollover prevention and crash mitigation. 

‘‘30129. Cybersecurity standards.’’. 

17 (d) CONFORMING AMENDMENT.—Section 

18 30165(a)(1) of title 49, United States Code, is amended 

19 by inserting ‘‘30129,’’ after ‘‘30127,’’. 

20 SEC. 3. CYBER DASHBOARD. 

21 (a) IN GENERAL.—Section 32302 of title 49, United 

22 States Code, is amended by adding at the end the fol23 lowing: 

24 ‘‘(e) CYBER DASHBOARD.— 


lotter on DSK5VPTVN1PROD with BILLS
7 

•S 680 IS

1 ‘‘(1) IN GENERAL.—All motor vehicles manu2 factured for sale in the United States on or after the 

3 date that is 2 years after the date on which final 

4 regulations are prescribed pursuant to section 

5 3(b)(2) of the SPY Car Act of 2017 shall display a 

6 ‘cyber dashboard’, as a component of the label re7 quired to be affixed to each motor vehicle under sec8 tion 32908(b). 

9 ‘‘(2) FEATURES.—The cyber dashboard re10 quired under paragraph (1) shall inform consumers, 

11 through an easy-to-understand, standardized graph12 ic, about the extent to which the motor vehicle pro13 tects the cybersecurity and privacy of motor vehicle 

14 owners, lessees, drivers, and passengers beyond the 

15 minimum requirements set forth in section 30129 of 

16 this title and in section 27 of the Federal Trade 

17 Commission Act.’’. 

18 (b) RULEMAKING.— 

19 (1) IN GENERAL.—Not later than 18 months 

20 after the date of the enactment of this Act, the Ad21 ministrator, after consultation with the Commission, 

22 shall prescribe regulations for the cybersecurity and 

23 privacy information required to be displayed under 

24 section 32302(c) of title 49, United States Code, as 

25 added by subsection (a). 


lotter on DSK5VPTVN1PROD with BILLS
8 

•S 680 IS

1 (2) FINAL REGULATIONS.—Not later than 3 

2 years after the date of the enactment of this Act, the 

3 Administrator, after consultation with the Commis4 sion, shall issue final regulations to carry out section 

5 32302 of title 49, United States Code, as added by 

6 subsection (a). 

7 (3) UPDATES.—Not less frequently than once 

8 every 3 years, the Administrator, after consultation 

9 with the Commission, shall— 

10 (A) review the regulations issued pursuant 

11 to paragraph (2); and 

12 (B) update such regulations, as necessary. 

13 SEC. 4. PRIVACY STANDARDS FOR MOTOR VEHICLES. 

14 (a) IN GENERAL.—The Federal Trade Commission 

15 Act (15 U.S.C. 41 et seq.) is amended by inserting after 

16 section 26 (15 U.S.C. 57c–2) the following: 

17 ‘‘SEC. 27. PRIVACY STANDARDS FOR MOTOR VEHICLES. 

18 ‘‘(a) IN GENERAL.—All motor vehicles manufactured 

19 for sale in the United States on or after the date that 

20 is two years after the date on which final regulations are 

21 prescribed pursuant to subsection (e) shall comply with 

22 the requirements under subsections (b) through (d). 

23 ‘‘(b) TRANSPARENCY.—Each motor vehicle shall pro24 vide clear and conspicuous notice, in clear and plain lan25 guage, to the owners or lessees of such vehicle of the colVerDate Sep 11 2014 23:36 Mar 23, 2017 Jkt 069200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S680.IS S680

lotter on DSK5VPTVN1PROD with BILLS
9 

•S 680 IS

1 lection, transmission, retention, and use of driving data 

2 collected from such motor vehicle. 

3 ‘‘(c) CONSUMER CONTROL.— 

4 ‘‘(1) IN GENERAL.—Subject to paragraphs (2) 

5 and (3), owners or lessees of motor vehicles shall be 

6 given the option of terminating the collection and re7 tention of driving data. 

8 ‘‘(2) ACCESS TO NAVIGATION TOOLS.—If a 

9 motor vehicle owner or lessee decides to terminate 

10 the collection and retention of driving data under 

11 paragraph (1), the owner or lessee shall not lose ac12 cess to navigation tools or other features or capabili13 ties, to the extent technically possible. 

14 ‘‘(3) EXCEPTION.—Paragraph (1) shall not 

15 apply to driving data stored as part of the electronic 

16 data recorder system or other safety systems on17 board the motor vehicle that are required for post18 incident investigations, emissions history checks, 

19 crash avoidance or mitigation, or other regulatory 

20 compliance programs. 

21 ‘‘(d) LIMITATION ON USE OF PERSONAL DRIVING IN22 FORMATION.— 

23 ‘‘(1) IN GENERAL.—A manufacturer (including 

24 an original equipment manufacturer) may not use 

25 any information collected by a motor vehicle for adVerDate Sep 11 2014 23:36 Mar 23, 2017 Jkt 069200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S680.IS S680

lotter on DSK5VPTVN1PROD with BILLS
10 

•S 680 IS

1 vertising or marketing purposes without affirmative 

2 express consent by the owner or lessee. 

3 ‘‘(2) REQUESTS.—Consent requests under para4 graph (1)— 

5 ‘‘(A) shall be clear and conspicuous; 

6 ‘‘(B) shall be made in clear and plain lan7 guage; and 

8 ‘‘(C) may not be a condition for the use of 

9 any nonmarketing feature, capability, or 

10 functionality of the motor vehicle. 

11 ‘‘(e) ENFORCEMENT.—A violation of this section 

12 shall be treated as an unfair or deceptive act or practice 

13 in violation of a rule prescribed under section 

14 18(a)(1)(B).’’. 

15 (b) RULEMAKING.— 

16 (1) IN GENERAL.—Not later than 18 months 

17 after the date of the enactment of this Act, the Fed18 eral Trade Commission, after consultation with the 

19 Administrator of the National Highway Traffic Safe20 ty Administration, shall prescribe regulations, in ac21 cordance with section 553 of title 5, United States 

22 Code, to carry out section 27 of the Federal Trade 

23 Commission Act, as added by subsection (a). 

24 (2) FINAL REGULATIONS.—Not later than three 

25 years after the date of the enactment of this Act, the 


lotter on DSK5VPTVN1PROD with BILLS
11 

•S 680 IS

1 Commission, after consultation with the Adminis2 trator, shall issue final regulations, in accordance 

3 with section 553 of title 5, United States Code, to 

4 carry out section 27 of the Federal Trade Commis5 sion Act, as added by subsection (a). 

6 (3) UPDATES.—Not less frequently than once 

7 every three years, the Commission, after consulta8 tion with the Administrator, shall— 

9 (A) review the regulations prescribed pur10 suant to paragraph (2); and 

11 (B) update such regulations, as necessary. 

Æ 


lotter on DSK5VPTVN1PROD with BILLS