The Driver Privacy Act (§§ 24301 – 24303), part of the Fixing America’s Surface Transportation (“FAST”) Act (signed into law on December 4, 2015) establishes rights to data stored by event data recorders in vehicles (typically black box data). The Act states that “[a]ny data retained by an event data recorder … is the property of the owner … or lessee ….” Access to such data is prohibited under the Act except certain circumstances.
The Driver Privacy Act provides that data, stored or transmitted by such vehicle event recorder devices, cannot be accessed by anyone other than the owner or lessee of the vehicle except (1) under court order; (2) consent by the owner or lessee; (3) the data is retrieved pursuant to certain National Transportation Safety Board or Department of Transportation authorized investigations and any personal identifiable information (PII) is not disclosed; (4) the data is needed to facilitate emergency medical response to a crash; or (5) the data is anonymized and used for traffic safety research purposes.
The Driver Privacy Act provides that the owner or lessee of the vehicle may agree to the transmission of the event data if the person signs a subscription agreement to that effect and “describes how data will be retrieved and used.”
The Act follows:
PART I—DRIVER PRIVACY ACT OF 2015
SEC. 24301. SHORT TITLE.
This part may be cited as the ‘‘Driver Privacy Act of 2015’’.
SEC. 24302. LIMITATIONS ON DATA RETRIEVAL FROM VEHICLE EVENT DATA RECORDERS.
(a) OWNERSHIP OF DATA.—Any data retained by an event data recorder (as defined in section 563.5 of title 49, Code of Federal Regulations), regardless of when the motor vehicle in which it is installed was manufactured, is the property of the owner, or, in the case of a leased vehicle, the lessee of the motor vehicle in which the event data recorder is installed.
(b) PRIVACY.—Data recorded or transmitted by an event data recorder described in subsection (a) may not be accessed by a person other than an owner or a lessee of the motor vehicle in which the event data recorder is installed unless—
(1) a court or other judicial or administrative authority having jurisdiction— (A) authorizes the retrieval of the data; and (B) to the extent that there is retrieved data, the data is subject to the standards for admission into evidence required by that court or other administrative authority;
(2) an owner or a lessee of the motor vehicle provides written, electronic, or recorded audio consent to the retrieval of the data for any purpose, including the purpose of diagnosing, servicing, or repairing the motor vehicle, or by agreeing to a subscription that describes how data will be retrieved and used;
(3) the data is retrieved pursuant to an investigation or inspection authorized under section 1131(a) or 30166 of title 49, United States Code, and the personally identifiable information
of an owner or a lessee of the vehicle and the vehicle identification number is not disclosed in connection with the retrieved data, except that the vehicle identification number may be disclosed to the certifying manufacturer;
(4) the data is retrieved for the purpose of determining the need for, or facilitating, emergency medical response in response to a motor vehicle crash; or
(5) the data is retrieved for traffic safety research, and the personally identifiable information of an owner or a lessee of the vehicle and the vehicle identification number is not disclosed in connection with the retrieved data.
SEC. 24303. VEHICLE EVENT DATA RECORDER STUDY.
(a) IN GENERAL.—Not later than 1 year after the date of enactment of this Act, the Administrator of the National Highway Traffic Safety Administration shall submit to Congress a report that contains the results of a study conducted by the Administrator to determine the amount of time event data recorders installed in passenger motor vehicles should capture and record for retrieval vehicle-related data in conjunction with an event in order to provide sufficient information to investigate the cause of motor vehicle crashes.
(b) RULEMAKING.—Not later than 2 years after submitting the report required under subsection (a), the Administrator of the National Highway Traffic Safety Administration shall promulgate regulations to establish the appropriate period during which event data recorders installed in passenger motor vehicles may capture and record for retrieval vehicle-related data to the time necessary to provide accident investigators with vehicle-related information pertinent to crashes involving such motor vehicles.
