II 

114TH CONGRESS 

1ST SESSION S. 1806 

To protect consumers from security and privacy threats to their motor 

vehicles, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 21, 2015 

Mr. MARKEY (for himself and Mr. BLUMENTHAL) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To protect consumers from security and privacy threats to 

their motor vehicles, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Security and Privacy 

5 in Your Car Act of 2015’’ or the ‘‘SPY Car Act of 2015’’. 

6 SEC. 2. CYBERSECURITY STANDARDS FOR MOTOR VEHI7 CLES. 

8 (a) IN GENERAL.—Chapter 301 of title 49, United 

9 States Code, is amended— 

10 (1) in section 30102(a)— 


emcdonald on DSK67QTVN1PROD with BILLS
2 

•S 1806 IS

1 (A) by redesignating paragraphs (4) 

2 through (11) as paragraphs (10) through (17), 

3 respectively; 

4 (B) by redesignating paragraphs (1) 

5 through (3) as paragraphs (4) through (6), re6 spectively; 

7 (C) by inserting before paragraph (3), as 

8 redesignated, the following: 

9 ‘‘(1) ‘Administrator’ means the Administrator 

10 of the National Highway Traffic Safety Administra11 tion; 

12 ‘‘(2) ‘Commission’ means the Federal Trade 

13 Commission; 

14 ‘‘(3) ‘critical software systems’ means software 

15 systems that can affect the driver’s control of the ve16 hicle movement;’’; and 

17 (D) by inserting after paragraph (6), as 

18 redesignated, the following: 

19 ‘‘(7) ‘driving data’ include, but are not limited 

20 to, any electronic information collected about— 

21 ‘‘(A) a vehicle’s status, including, but not 

22 limited to, its location or speed; and 

23 ‘‘(B) any owner, lessee, driver, or pas24 senger of a vehicle; 


emcdonald on DSK67QTVN1PROD with BILLS
3 

•S 1806 IS

1 ‘‘(8) ‘entry points’ include, but are not limited 

2 to, means by which— 

3 ‘‘(A) driving data may be accessed, directly 

4 or indirectly; or 

5 ‘‘(B) control signals may be sent or re6 ceived either wirelessly or through wired con7 nections; 

8 ‘‘(9) ‘hacking’ means the unauthorized access to 

9 electronic controls or driving data, either wirelessly 

10 or through wired connections;’’; and 

11 (2) by adding at the end the following: 

12 ‘‘§ 30129. Cybersecurity standards 

13 ‘‘(a) CYBERSECURITY STANDARDS.— 

14 ‘‘(1) REQUIREMENT.—All motor vehicles manu15 factured for sale in the United States on or after the 

16 date that is 2 years after the date on which final 

17 regulations are prescribed pursuant to section 

18 2(b)(2) of the SPY Car Act of 2015 shall comply 

19 with the cybersecurity standards set forth in para20 graphs (2) through (4). 

21 ‘‘(2) PROTECTION AGAINST HACKING.— 

22 ‘‘(A) IN GENERAL.—All entry points to the 

23 electronic systems of each motor vehicle manu24 factured for sale in the United States shall be 


emcdonald on DSK67QTVN1PROD with BILLS
4 

•S 1806 IS

1 equipped with reasonable measures to protect 

2 against hacking attacks. 

3 ‘‘(B) ISOLATION MEASURES.—The meas4 ures referred to in subparagraph (A) shall in5 corporate isolation measures to separate critical 

6 software systems from noncritical software sys7 tems. 

8 ‘‘(C) EVALUATION.—The measures re9 ferred to in subparagraphs (A) and (B) shall be 

10 evaluated for security vulnerabilities following 

11 best security practices, including appropriate 

12 applications of techniques such as penetration 

13 testing. 

14 ‘‘(D) ADJUSTMENT.—The measures re15 ferred to in subparagraphs (A) and (B) shall be 

16 adjusted and updated based on the results of 

17 the evaluation described in subparagraph (C). 

18 ‘‘(3) SECURITY OF COLLECTED INFORMA19 TION.—All driving data collected by the electronic 

20 systems that are built into motor vehicles shall be 

21 reasonably secured to prevent unauthorized access— 

22 ‘‘(A) while such data are stored onboard 

23 the vehicle; 

24 ‘‘(B) while such data are in transit from 

25 the vehicle to another location; and 


emcdonald on DSK67QTVN1PROD with BILLS
5 

•S 1806 IS

1 ‘‘(C) in any subsequent offboard storage or 

2 use. 

3 ‘‘(4) DETECTION, REPORTING, AND RESPOND4 ING TO HACKING.—Any motor vehicle that presents 

5 an entry point shall be equipped with capabilities to 

6 immediately detect, report, and stop attempts to 

7 intercept driving data or control the vehicle. 

8 ‘‘(b) PENALTIES.—A person that violates this section 

9 is liable to the United States Government for a civil pen10 alty of not more than $5,000 for each violation in accord11 ance with section 30165.’’. 

12 (b) RULEMAKING.— 

13 (1) IN GENERAL.—Not later than 18 months 

14 after the date of the enactment of this Act, the Ad15 ministrator, after consultation with the Commission, 

16 shall issue a Notice of Proposed Rulemaking to 

17 carry out section 30129 of title 49, United States 

18 Code, as added by subsection (a). 

19 (2) FINAL REGULATIONS.—Not later than 3 

20 years after the date of the enactment of this Act, the 

21 Administrator, after consultation with the Commis22 sion, shall issue final regulations to carry out section 

23 30129 of title 49, United States Code, as added by 

24 subsection (a). 


emcdonald on DSK67QTVN1PROD with BILLS
6 

•S 1806 IS

1 (3) UPDATES.—Not later than 3 years after 

2 final regulations are issued pursuant to paragraph 

3 (2) and not less frequently than once every 3 years 

4 thereafter, the Administrator, after consultation with 

5 the Commission, shall— 

6 (A) review the regulations issued pursuant 

7 to paragraph (2); and 

8 (B) update such regulations, as necessary. 

9 (c) CLERICAL AMENDMENT.—The table of sections 

10 for chapter 301 of title 49, United States Code, is amend11 ed by striking the item relating to section 30128 and in12 serting the following: 

‘‘30128. Vehicle rollover prevention and crash mitigation. 

‘‘30129. Cybersecurity standards.’’. 

13 (d) CONFORMING AMENDMENT.—Section 

14 30165(a)(1) of title 49, United States Code, is amended 

15 by inserting ‘‘30129,’’ after ‘‘30127,’’. 

16 SEC. 3. CYBER DASHBOARD. 

17 (a) IN GENERAL.—Section 32302 of title 49, United 

18 States Code, is amended by inserting after subsection (b) 

19 the following: 

20 ‘‘(c) CYBER DASHBOARD.— 

21 ‘‘(1) IN GENERAL.—All motor vehicles manu22 factured for sale in the United States on or after the 

23 date that is 2 years after the date on which final 

24 regulations are prescribed pursuant to section 


emcdonald on DSK67QTVN1PROD with BILLS
7 

•S 1806 IS

1 3(b)(2) of the SPY Car Act of 2015 shall display a 

2 ‘cyber dashboard’, as a component of the label re3 quired to be affixed to each motor vehicle under sec4 tion 32908(b). 

5 ‘‘(2) FEATURES.—The cyber dashboard re6 quired under paragraph (1) shall inform consumers, 

7 through an easy-to-understand, standardized graph8 ic, about the extent to which the motor vehicle pro9 tects the cybersecurity and privacy of motor vehicle 

10 owners, lessees, drivers, and passengers beyond the 

11 minimum requirements set forth in section 30129 of 

12 this title and in section 27 of the Federal Trade 

13 Commission Act.’’. 

14 (b) RULEMAKING.— 

15 (1) IN GENERAL.—Not later than 18 months 

16 after the date of the enactment of this Act, the Ad17 ministrator, after consultation with the Commission, 

18 shall prescribe regulations for the cybersecurity and 

19 privacy information required to be displayed under 

20 section 32302(c) of title 49, United States Code, as 

21 added by subsection (a). 

22 (2) FINAL REGULATIONS.—Not later than 3 

23 years after the date of the enactment of this Act, the 

24 Administrator, after consultation with the Commis25 sion, shall issue final regulations to carry out section 


emcdonald on DSK67QTVN1PROD with BILLS
8 

•S 1806 IS

1 32302 of title 49, United States Code, as added by 

2 subsection (a). 

3 (3) UPDATES.—Not less frequently than once 

4 every 3 years, the Administrator, after consultation 

5 with the Commission, shall— 

6 (A) review the regulations issued pursuant 

7 to paragraph (2); and 

8 (B) update such regulations, as necessary. 

9 SEC. 4. PRIVACY STANDARDS FOR MOTOR VEHICLES. 

10 (a) IN GENERAL.—The Federal Trade Commission 

11 Act (15 U.S.C. 41 et seq.) is amended by inserting after 

12 section 26 (15 U.S.C. 57c–2) the following: 

13 ‘‘SEC. 27. PRIVACY STANDARDS FOR MOTOR VEHICLES. 

14 ‘‘(a) IN GENERAL.—All motor vehicles manufactured 

15 for sale in the United States on or after the date that 

16 is 2 years after the date on which final regulations are 

17 prescribed pursuant to subsection (e) shall comply with 

18 the features required under subsections (b) through (d). 

19 ‘‘(b) TRANSPARENCY.—Each motor vehicle shall pro20 vide clear and conspicuous notice, in clear and plain lan21 guage, to the owners or lessees of such vehicle of the col22 lection, transmission, retention, and use of driving data 

23 collected from such motor vehicle. 

24 ‘‘(c) CONSUMER CONTROL.— 


emcdonald on DSK67QTVN1PROD with BILLS
9 

•S 1806 IS

1 ‘‘(1) IN GENERAL.—Subject to paragraphs (2) 

2 and (3), owners or lessees of motor vehicles shall be 

3 given the option of terminating the collection and re4 tention of driving data. 

5 ‘‘(2) ACCESS TO NAVIGATION TOOLS.—If a 

6 motor vehicle owner or lessee decides to terminate 

7 the collection and retention of driving data under 

8 paragraph (1), the owner or lessee shall not lose ac9 cess to navigation tools or other features or capabili10 ties, to the extent technically possible. 

11 ‘‘(3) EXCEPTION.—Paragraph (1) shall not 

12 apply to driving data stored as part of the electronic 

13 data recorder system or other safety systems on14 board the motor vehicle that are required for post15 incident investigations, emissions history checks, 

16 crash avoidance or mitigation, or other regulatory 

17 compliance programs. 

18 ‘‘(d) LIMITATION ON USE OF PERSONAL DRIVING IN19 FORMATION.— 

20 ‘‘(1) IN GENERAL.—A manufacturer (including 

21 an original equipment manufacturer) may not use 

22 any information collected by a motor vehicle for ad23 vertising or marketing purposes without affirmative 

24 express consent by the owner or lessee. 


emcdonald on DSK67QTVN1PROD with BILLS
10 

•S 1806 IS

1 ‘‘(2) REQUESTS.—Consent requests under para2 graph (1)— 

3 ‘‘(A) shall be clear and conspicuous; 

4 ‘‘(B) shall be made in clear and plain lan5 guage; and 

6 ‘‘(C) may not be a condition for the use of 

7 any nonmarketing feature, capability, or 

8 functionality of the motor vehicle. 

9 ‘‘(e) ENFORCEMENT.—A violation of this section 

10 shall be treated as an unfair and deceptive act or practice 

11 in violation of a rule prescribed under section 

12 18(a)(1)(B).’’. 

13 (b) RULEMAKING.— 

14 (1) IN GENERAL.—Not later than 18 months 

15 after the date of the enactment of this Act, the 

16 Commission, after consultation with the Adminis17 trator of the National Highway Traffic Safety Ad18 ministration (referred to in this subsection as the 

19 ‘‘Administrator’’), shall prescribe regulations, in ac20 cordance with section 553 of title 5, United States 

21 Code, to carry out section 27 of the Federal Trade 

22 Commission Act, as added by subsection (a). 

23 (2) FINAL REGULATIONS.—Not later than 3 

24 years after the date of the enactment of this Act, the 

25 Commission, after consultation with the AdminisVerDate Sep 11 2014 02:17 Jul 22, 2015 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1806.IS S1806

emcdonald on DSK67QTVN1PROD with BILLS
11 

•S 1806 IS

1 trator, shall issue final regulations, in accordance 

2 with section 553 of title 5, United States Code, to 

3 carry out section 27 of the Federal Trade Commis4 sion Act, as added by subsection (a). 

5 (3) UPDATES.—Not less frequently than once 

6 every 3 years, the Commission, after consultation 

7 with the Administrator, shall— 

8 (A) review the regulations prescribed pur9 suant to paragraph (2); and 

10 (B) update such regulations, as necessary. 

Æ 


emcdonald on DSK67QTVN1PROD with BILLS