[Senate Report 113-255] [From the U.S. Government Publishing Office] 113th Congress Report SENATE 2d Session 113-255 _______________________________________________________________________ Calendar No. 563 DRIVER PRIVACY ACT __________ R E P O R T of the COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION on S. 1925September 15, 2014.--Ordered to be printed SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION one hundred thirteenth congress second session JOHN D. ROCKEFELLER IV, West Virginia, Chairman BARBARA BOXER, California JOHN THUNE, South Dakota BILL NELSON, Florida ROGER F. WICKER, Mississippi MARIA CANTWELL, Washington ROY BLUNT, Missouri MARK PRYOR, Arkansas MARCO RUBIO, Florida CLAIRE McCASKILL, Missouri KELLY AYOTTE, New Hampshire AMY KLOBUCHAR, Minnesota DEAN HELLER, Nevada MARK BEGICH, Alaska DANIEL COATS, Indiana RICHARD BLUMENTHAL, Connecticut TIM SCOTT, South Carolina BRIAN SCHATZ, Hawaii TED CRUZ, Texas ED MARKEY, Massachusetts DEB FISCHER, Nebraska CORY BOOKER, New Jersey RON JOHNSON, Wisconsin JOHN WALSH, Montana Ellen Doneski, Staff Director John Williams, General Counsel David Schwietert, Republican Staff Director Nick Rossi, Republican Deputy Staff Director Rebecca Seidel, Republican General Counsel Calendar No. 563 113th Congress Report SENATE 2d Session 113-255 ====================================================================== DRIVER PRIVACY ACT _______ September 15, 2014.--Ordered to be printed _______ Mr. Rockefeller, from the Committee on Commerce, Science, and Transportation, submitted the following R E P O R T [To accompany S. 1925] The Committee on Commerce, Science, and Transportation, to which was referred the bill (S. 1925) to limit the retrieval of data from vehicle event data recorders, having considered the same, reports favorably thereon with an amendment (in the nature of a substitute) and recommends that the bill (as amended) do pass. Purpose of the Bill The purpose of S. 1925, the Driver Privacy Act, is to establish limitations on data retrieval from vehicle event data recorders (EDRs). Under current law, there are no Federal standards for ownership or privacy of this data. The bill would establish that the owner or lessee of the vehicle owns the data contained within the EDR, and would create specific circumstances under which the data can be accessed by entities other than the owner or lessee. Background and Needs EDRs capture information about a vehicle just before and at the time of a crash. While the EDR records continuously as a vehicle travels, the data is only stored if a major event occurs, such as a crash or airbag deployment. The data in these recorders is used for crash reconstruction and is also used by the National Highway Traffic Safety Administration (NHTSA) to conduct investigations into potential vehicle defects. While NHTSA currently enforces no rule requiring installation of EDRs on new light vehicles, the agency estimates that vehicle manufacturers voluntarily install these devices on approximately 96 percent of these new vehicles. Summary of Provisions The Driver Privacy Act would establish the owner or lessee of a vehicle as the owner of data collected and stored on the vehicle's EDR. The bill would limit access to that data by anyone other than the owner or lessee of the vehicle, and it would enumerate the specific circumstances under which the data could be accessed. In addition, the bill would call on NHTSA to conduct a study for submission to Congress on the appropriate amount of time that EDRs should capture data before and after a crash and, within two years after the study's completion, issue regulations establishing the appropriate time period. Legislative History Senator Hoeven introduced S. 1925 on January 14, 2014, with Senator Klobuchar and 16 other cosponsors. On April 9, 2014, in an open Executive Session, the Committee considered the bill with an amendment in the nature of a substitute and reported S. 1925 favorably by voice vote. The amendment clarified the description of the data to which the bill refers, made clear that the requirements of section 2 would apply to ``motor vehicles'' not just ``passenger motor vehicles,'' removed a limitation on data retrieval that would have prevented such retrieval without data having been recorded, provided for two years for NHTSA's rulemaking, and made other minor changes. Estimated Costs In accordance with paragraph 11(a) of rule XXVI of the Standing Rules of the Senate and section 403 of the Congressional Budget Act of 1974, the Committee provides the following cost estimate, prepared by the Congressional Budget Office: S. 1925--Driver Privacy Act Based on information from the National Highway Traffic Safety Administration (NHTSA), CBO estimates that implementing S. 1925 would cost about $1 million over the 2015-2019 period, assuming the availability of appropriated funds. Enacting S. 1925 would not affect direct spending or revenues; therefore, pay-as-you-go procedures do not apply. S. 1925 would establish that any data collected by event data recorders (EDRs) in motor vehicles are owned by the owner or lessee of the vehicle and would set broad conditions under which such data could be retrieved by others for purposes such as judicial proceedings, investigations, and traffic safety research. The bill also would require NHTSA to complete a study and a rulemaking about the data collected by EDRs. Based on information from NHTSA, CBO estimates that work would take about 18 months to complete and would require two or three staff members. S. 1925 contains no intergovernmental mandates as defined in the Unfunded Mandates Reform Act (UMRA) and would impose no costs on state, local, or tribal governments. By requiring NHTSA to issue regulations that establish the appropriate period for EDRs to capture and record information, the bill could impose a mandate on automobile manufacturers if those regulations require changes in the design of motor vehicles. Because the cost of that mandate would depend on future regulations, CBO cannot determine whether the aggregate cost of the mandates would exceed the annual threshold established in UMRA ($152 million in 2014, adjusted annually for inflation). The CBO staff contacts for this estimate are Sarah Puro (for federal costs) and Amy Petz (for the private-sector impact). The estimate was approved by Theresa Gullo, Deputy Assistant Director for Budget Analysis. Regulatory Impact In accordance with paragraph 11(b) of rule XXVI of the Standing Rules of the Senate, the Committee provides the following evaluation of the regulatory impact of the legislation, as reported: number of persons covered The legislation would apply to vehicle owners and lessees and to auto manufacturers that build vehicles with EDRs. The regulations would revise existing regulations and would not impact any additional entities. economic impact This legislation is not expected to have an adverse economic impact on the Nation. privacy S. 1925 would not have a negative impact on the personal privacy of individuals. paperwork The Committee does not anticipate a major increase in paperwork requirements for private individuals or businesses due to S. 1925. The bill would call on NHTSA to conduct a study and issue regulations regarding the appropriate amount of time for an EDR to record a crash. Congressionally Directed Spending In compliance with paragraph 4(b) of rule XLIV of the Standing Rules of the Senate, the Committee provides that no provisions contained in the bill, as reported, meet the definition of congressionally directed spending items under the rule. Section-by-Section Analysis Section 1. Short title. Section 1 would establish the title of the bill, the Driver Privacy Act. Section 2. Limitations on data retrieval from vehicle event data recorders. Section 2(a) would establish the owner of the vehicle - or, in the case of a leased vehicle, the lessor - as the owner of the data contained in an EDR. Section 2(b) would establish that data in an EDR could not be retrieved by anyone other than the owner or lessee unless one of five conditions is met: a court authorizes retrieval; the owner or lessee provides written or electronic consent; the data is retrieved pursuant to an investigation or inspection by NHTSA and no personally identifiable information is disclosed, except that the vehicle identification number may be disclosed to the certifying manufacturer; the data is retrieved for the purpose of determining the need for, or facilitating, an emergency medical response; or the data is retrieved for traffic safety research and no personally identifiable information or vehicle identification number is disclosed. Section 3. Vehicle event data recorder study. Section 3 would require NHTSA to conduct a study to determine the amount of time that EDRs should record vehicle- related data in conjunction with an event in order to provide sufficient information to investigate the cause of motor vehicle crashes. NHTSA would be required to submit that study to Congress and, within two years, issue regulations establishing the amount of time before and after a crash that EDRs must record vehicle-related data. Changes in Existing Law In compliance with paragraph 12 of rule XXVI of the Standing Rules of the Senate, the Committee states that the bill as reported would make no change to existing law.