THE BILL ITSELF
HB 1557
Motor Vehicle Data Privacy and Autonomy
1
A bill to be entitled
2
An act relating to motor vehicle data privacy and
3
autonomy; providing a short title; creating s.
4
320.647, F.S.; providing definitions; prohibiting a
5
manufacturer from certain actions relating to operator
6
data; providing exceptions; prohibiting a manufacturer
7
from certain actions relating to personal identifying
8
information; requiring a manufacturer to provide a
9
motor vehicle owner with access to and control of
10
operator data; requiring a manufacturer to create a
11
certain interface; providing reporting requirements;
12
requiring the Department of Highway Safety and Motor
13
Vehicles, in consultation with specified entities, to
14
establish at least one standard for the interface by a
15
specified date; requiring the department to review and
16
revise the standard or standards by a specified date
17
and at specified intervals; providing construction;
18
providing that a violation of certain provisions is an
19
unfair and deceptive trade practice; requiring the
20
department to adopt rules; providing an effective
21
date.
23
Be It Enacted by the Legislature of the State of Florida:
25
Section 1. This act may be cited as the "Motor Vehicle
26
Data Privacy and Autonomy Act."
27
Section 2. Section 320.647, Florida Statutes, is created
28
to read:
29
320.647 Motor vehicle data privacy and autonomy.—
30
(1) As used in this section, the term:
31
(a) "Foreign country of concern" has the same meaning as
32
in s. 692.201.
33
(b) "Foreign principal" has the same meaning as in s.
34
692.201.
35
(c) "Motor vehicle" means any vehicle as defined in s.
36
320.60 which is registered in this state.
37
(d) "Operator data" means:
38
1. Data generated or processed onboard a motor vehicle,
39
including data generated by sensors, receivers, computer
40
processing units, or other vehicle components.
41
2. Data stored in a motor vehicle which is generated by
42
the operator of the vehicle.
43
(e) "Operator preference" means any choice with respect to
44
a configurable setting of a motor vehicle made by or for the
45
benefit of the operator of the vehicle.
46
(f) "Personal identifying information" means information
47
that:
48
1. Directly identifies a person, such as the name,
49
address, social security number or other identifying number or
50
code, telephone number, or e-mail address of the person;
51
2. Indirectly identifies a person, such as the gender,
52
race, or date of birth of the person; or
53
3. Reveals the physical location or Internet activity of a
54
person.
55
(g) "Proprietary confidential business information" has
56
the same meaning as in s. 288.075(1).
57
(h) "Secure" means designed to prevent malicious or
58
unauthorized use of or access to operator data.
59
(i) "Technologically neutral" means designed without
60
preference or prejudice toward any technology or service used to
61
access and control operator data by a motor vehicle owner,
62
regardless of ownership or licensing of proprietary technologies
63
by the owner or a manufacturer.
64
(2) A manufacturer may not:
65
(a) Access operator data, unless:
66
1. The motor vehicle owner affirmatively consents to the
67
manufacturer accessing the data and the consent:
68
a. Is freely given;
69
b. Is informed, specific, and unambiguous;
70
c. Is in writing; and
71
d. May be easily withdrawn; or
72
2. The data is accessed solely to improve motor vehicle
73
performance or safety;
74
(b) Sell, lease, or otherwise share operator data, unless:
75
1. Required to do so:
76
a. Pursuant to a lawful warrant;
77
b. Pursuant to a court order that provides the motor
78
vehicle owner notice of the order and at least 48 hours to
79
object to the order and request a hearing; or
80
c. To facilitate an emergency response; or
81
2. Expressly permitted to do so by the owner or, in the
82
event of the death or incapacity of the owner, the next of kin
83
of the owner; or
84
(c) Sell, license, rent, transfer, release, disclose,
85
provide access to, or otherwise make available personal
86
identifying information to a foreign country of concern or
87
foreign principal.
88
(3)(a) A manufacturer shall provide a motor vehicle owner
89
with access to and control of operator data:
90
1. At no additional cost.
91
2. Without any restriction or limitation by means of a
92
technologically neutral and secure interface.
93
(b) To facilitate the access to and control of operator
94
data pursuant to paragraph (a), the manufacturer shall create a
95
technologically neutral and secure open application programming
96
interface that:
97
1. Facilitates deletion of all operator data stored in a
98
motor vehicle generated by the operator of the vehicle.
99
2. Enables the setting of any operator preference.
100
(4) By January 1, 2027, and annually thereafter, the
101
department, in consultation with the Attorney General, the
102
Secretary of Transportation, the United States Secretary of
103
Homeland Security, and the Federal Communications Commission,
104
shall submit to the President of the Senate and the Speaker of
105
the House of Representatives a report that describes:
106
(a) The types of operator data accessed by a manufacturer.
107
(b) The persons or entities, other than a manufacturer,
108
that access operator data.
109
(c) The agencies that access operator data and how the
110
agencies use the data.
111
(d) The persons or entities to which operator data may be
112
sold or otherwise shared.
113
(e) The foreign countries of concern or foreign principals
114
to which operator data may be sold or otherwise shared and how
115
the foreign countries of concern or foreign principals use the
116
data.
117
(f) The cybersecurity capabilities and risks associated
118
with motor vehicles.
119
(g) How often operator data was breached, how the breaches
120
occurred, the persons or entities involved in the breach, and
121
whether any of the persons or entities involved in the breach
122
have ties to foreign countries of concern or foreign principals.
123
(5)(a) By January 1, 2027, the department shall submit to
124
the Commerce Committee of the House of Representatives and the
125
Commerce and Tourism Committee of the Senate a report on the
126
current practices employed for operator data generation,
127
storage, transmission, and cybersecurity.
128
(b) By January 1, 2028, the department shall, in
129
coordination with the director of the National Institute of
130
Standards and Technology, relevant industry stakeholders,
131
including manufacturers and motor vehicle owners, and other
132
agencies, establish at least one standard for the interface
133
required in subsection (3).
134
(c) By January 1, 2033, and at least once every 5 years
135
thereafter, the department shall review and revise such standard
136
or standards as appropriate.
137
(6) Except as provided in subsection (3), this section
138
does not require a manufacturer to divulge proprietary
139
confidential business information.
140
(7) A violation of this section is an unfair and deceptive
141
trade practice under part II of chapter 501.
142
(8) The department shall adopt rules to administer this
143
section.
144
Section 3. This act shall take effect July 1, 2026.