Legislation Raises Serious Vehicle Privacy, Security and Safety Issues for Consumers   

ISSUE

Advocates for “right to repair” legislation claim that independent automotive repair shops do not have access to the parts or data necessary to repair vehicles. However, this concern was rectified by a 2014 Memorandum of Understanding, signed by “right to repair” proponents and auto manufacturers, and reaffirmed by a 2023 Industry Commitment. Today the information independent shops need to repair vehicles is readily available from every auto and truck manufacturer. H.R. 906 has little to do with repairing a vehicle; instead, the bill compels auto and heavy-duty truck manufacturers to provide any “aftermarket parts manufacturer” the information necessary “to produce or offer compatible aftermarket parts,” i.e., parts not made by the auto or truck manufacturer. This legislation would also give any third-party remote, bidirectional access to consumer data from vehicles, which raises significant privacy, cybersecurity, and automotive safety concerns. This bill regulates only vehicles and does not apply to other products, such as farm equipment or mobile phones. Members of Congress should oppose H.R. 906 since it raises serious vehicle privacy, security and safety issues for consumers.     

BACKGROUND

H.R. 906 would require vehicle manufacturers to provide any third-party remote, bidirectional access to vehicle-generated data “without restrictions or limitations.” This overbroad requirement, which covers all the vehicle’s data, unrelated to the servicing of the vehicle and creates serious privacy and safety concerns. Automakers and independent repairers already have a longstanding formal mechanism through the National Automotive Service Task Force to ensure service information, tool information and training data is made available from every truck and auto manufacturer. This information is also available through several private companies.

The National Highway Traffic Safety Administration has noted the “significant safety concerns” open access to vehicle telematics would raise, stating, “Open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking…A malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently.” NADA re-emphasized NHTSA’s vehicle safety concerns in a letter to the House Energy and Commerce Committee. 

In this vein, the Department of Commerce recently issued an advanced notice of proposed rulemaking to consider potential vehicle technology vulnerabilities and to address national security risks posed by connected vehicles, specifically Chinese- manufactured technology.    

KEY POINTS