Legislation Raises Serious Vehicle Privacy, Security and Safety Issues for Consumers   

ISSUE

Advocates for “right to repair” legislation claim that independent automotive repair shops do not have access to the parts or data necessary to repair vehicles. However, this concern was rectified years ago, and today the information independent shops need to repair vehicles is readily available from every auto and truck manufacturer. The latest iteration of “right to repair” legislation (H.R. 906) has little to do with repairing a vehicle. Instead, the bill compels auto and heavy-duty truck manufacturers to provide any “aftermarket parts manufacturer” the information necessary “to produce or offer compatible aftermarket parts,” i.e., parts not made by the auto or truck manufacturer. This legislation would also give any third-party remote, bidirectional access to sensitive consumer data from vehicles, which raises significant consumer privacy, cybersecurity, and automotive safety concerns. This bill regulates only vehicles and does not apply to other products, such as farm equipment or mobile phones. Members of Congress should oppose H.R. 906 since it raises serious vehicle privacy, security and safety issues for consumers.  

BACKGROUND

Vehicles generate tremendous amounts of data, including private information such as biometrics, vehicle location, or driver behavior data. This data is currently regulated according to strict privacy principles to protect consumers’ privacy and safety. However, H.R. 906 would require vehicle manufacturers to provide any third-party remote, bidirectional access to vehicle-generated data “without restrictions or limitations.” This overbroad requirement, which covers all the vehicle’s data, is unrelated to the servicing of the vehicle and creates serious privacy and safety concerns. 

The National Highway Traffic Safety Administration has noted the “significant safety concerns” open access to vehicle telematics would raise, stating, “Open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking…A malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently.”

The Government Accountability Office (GAO) is currently conducting a comprehensive study on the competitiveness of the automotive repair market. GAO’s report, due early next year, should be reviewed by Congress first to inform any legislation dealing with automotive right to repair.

KEY POINTS