Bill Text: CA AB3139 | 2023-2024 | Regular Session | Amended
Bill Title: Data privacy: vehicle manufacturers: remote vehicle technology.
Spectrum: Partisan Bill (Democrat 1-0)
Status: (Engrossed) 2024-06-07 - In committee: Set, first hearing. Hearing canceled at the request of author. [AB3139 Detail]
Download: California-2023-AB3139-Amended.html
|
Amended
IN
Assembly
April 24, 2024 |
|
Amended
IN
Assembly
April 18, 2024 |
|
Amended
IN
Assembly
March 21, 2024 |
CALIFORNIA LEGISLATURE—
2023–2024 REGULAR SESSION
Assembly Bill
No. 3139
| Introduced by Assembly Member Weber |
February 16, 2024 |
An act to add Chapter 36.5 (commencing with Section 22948.60) to Division 8 of the Business and Professions Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
AB 3139, as amended, Weber.
Data privacy: vehicle manufacturers: remote vehicle technology.
Existing law establishes various privacy requirements applicable to vehicle manufacturers, including limitations on the usage of images or video recordings from in-vehicle cameras in new motor vehicles equipped standard with one or more in-vehicle cameras. Existing law provides various protections to persons who are escaping from actual or threatened domestic violence, sexual assault, stalking, human trafficking, and other abuse, including providing for a means to keep the names and addresses of abuse survivors confidential in public records.
This bill would, among other things, require a vehicle manufacturer that offers a vehicle for sale, rent, or lease in the state that includes remote vehicle technology to do certain things, including ensure that the remote vehicle technology can be immediately manually disabled by a driver of the vehicle
while that driver is inside the vehicle by a method that, among other things, is prominently located and easy to use and does not require access to a remote, online application. The bill would require a vehicle manufacturer to offer secure remote means via the internet for a survivor to submit a vehicle separation notice that meets specified requirements. The bill would define “survivor” to mean an individual who has a covered act committed, or allegedly committed, against the individual. The bill would define “covered act” to mean, among other things, certain crimes relating to domestic violence, dating violence, sexual assault, stalking, and sex trafficking.
This bill would require a survivor to submit a vehicle separation notice through the secure remote means described above within 7 days of the date on which the survivor used the method of manually
disabling remote vehicle technology and would require the notice to include prescribed information, including a statement by the survivor signed under penalty of perjury that a perpetrator who has access to the remote vehicle technology in the vehicle has committed committed, or allegedly committed committed, a covered act against the survivor or an individual in the survivor’s care, or a copy of specified documents that support that the perpetrator has committed
committed, or allegedly committed committed, a covered act against the survivor or an individual in the survivor’s care, including a signed affidavit from, among other specified individuals acting within the scope of their employment, a licensed medical care provider.
By requiring a survivor to submit a statement signed under penalty of perjury or requiring specified individuals to sign an affidavit, the bill would expand the crime of perjury and impose a state-mandated local program.
This bill would make a vehicle manufacturer that violates the above-described provisions liable in a civil action brought by a survivor for, among other things, reasonable attorney’s fees and costs of the prevailing survivor, in addition to any other remedy provided by law. The bill would specify that any waiver of the requirements of the above-described provisions is against public policy, void, and unenforceable.
statutory damages in an amount not to exceed $50,000 or not to exceed $100,000 for a knowing violation.
This bill would define various terms for these purposes, purposes and would make related findings and declarations.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Digest Key
Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YESBill Text
The people of the State of California do enact as follows:
SECTION 1.
The Legislature finds and declares all of the following:(a) Domestic violence, dating violence, stalking, sexual assault, human trafficking, and related crimes are life-threatening issues and have lasting and harmful effects on individuals, families, and entire communities.
(b) Survivors of violence and abuse often lack meaningful support and options when establishing independence from an abuser, including barriers of financial insecurity and limited access to reliable communication tools to maintain essential connections with family, social safety networks, employers, and support services.
(c) Perpetrators of violence and abuse increasingly use technological and communication tools to exercise control over, monitor, and abuse their victims.
(d) Remote vehicle technology, including mobile phone wireless connectivity and location data capabilities that are manufactured into vehicles, are among the technological and communication tools perpetrators of violence and abuse can, and have, used.
(e) According to The New York Times, “Modern vehicles have been called ‘smartphones with wheels’ because they are internet-connected and have myriad methods of data collection, from cameras and seat weight sensors to records of how hard you brake and corner. Most drivers don’t realize how much information their cars are
collecting and who has access to it.”
(f) Under the federal Safe Connections Act of 2022, survivors of domestic abuse are empowered to protect themselves and their loved ones by requiring telecommunications providers, upon request, to separate their mobile phone accounts from the accounts of their abusers.
SEC. 2.
Chapter 36.5 (commencing with Section 22948.60) is added to Division 8 of the Business and Professions Code, to read:CHAPTER 36.5. Remote Vehicle Technology
22948.60.
(a) For the purposes of this chapter:(1) “Covered act” means conduct that is any of the
following:
(A) A crime described in subsection (a) of Section 40002 of the federal Violence Against Women Act (34 U.S.C. Sec. 12291), including domestic violence, dating violence, sexual assault, stalking, and sex trafficking.
(B) An act or practice described in paragraph (11) or (12) of Section 103 of the federal Trafficking Victims Protection Act of 2000 (22 U.S.C. Sec. 7102) relating to severe forms of trafficking in persons and sex trafficking, respectively.
(C) An act under state law, tribal law, or the Uniform Code of Military Justice (Chapter 47 (commencing with Section 801) of Title 10 of the United States Code) that is similar to an offense described in subparagraph (A) or (B).
(2) “Designated person” means a person who provides care to a survivor and meets both of the following criteria:
(A) The person has been authorized by the survivor to submit a request pursuant to subdivision (c) of Section 22948.61.
(B) The person did not commit, or did not allegedly commit, a covered act against the survivor.
(2)
(3) “Perpetrator” means an individual who has committed
committed, or allegedly committed committed, a covered act against a survivor or an individual under the care of a survivor.
(3)
(4) “Remote vehicle technology” means any technology that allows a person who is outside of a vehicle to access the activity, track the location, or control any operation of the vehicle or its parts, that includes, but is not limited to, any of the following:
(A) A Global Positioning System (GPS).
(B) An app-based technology.
(C) Any other remote wireless connectivity technology.
(4)
(5) “Survivor” means an individual who meets either of the following criteria:
has had a covered act committed, or allegedly committed, against the individual.
(A)The individual has had a covered act committed or allegedly committed against them.
(B)The individual provides care to an individual who has had a covered act committed or allegedly committed against, and that caretaker did not commit or allegedly commit the covered act.
(5)
(6) “Vehicle manufacturer” means a vehicle manufacturer or remanufacturer, as defined in Section 672 of the Vehicle Code.
(b) Subdivision (a) does not require a criminal conviction or any other determination of a court in order for conduct to satisfy a definition.
22948.61.
(a) A vehicle manufacturer that offers a vehicle for sale, rent, or lease in the state that includes remote vehicle technology shall do all of the following:(1) Ensure that the remote vehicle technology can be immediately manually disabled by a driver of the vehicle while that driver is inside the vehicle by a method that meets all of the following criteria:
(A) The method of manually disabling the remote vehicle technology shall be is
prominently located and easy to use and shall does not require access to a remote, online application.
(B) Upon its use, the method of manually disabling the remote vehicle technology shall inform informs the user of the requirements of subdivision (b).
(C) The method of manually disabling the remote vehicle technology shall
does not require a password or any log-in information.
(D) Upon its use, the method of manually disabling the remote vehicle technology shall does not result in the remote vehicle technology, vehicle manufacturer, or a third-party service provider sending to the registered owner of the car an email, telephone call, or any other notification related to the remote vehicle technology being disabled.
(E) Upon its use, the method of manually disabling the remote vehicle technology shall cause
causes the remote vehicle technology to be disabled for a minimum of seven days and capable of being reenabled only by the vehicle manufacturer pursuant to paragraph (4).
(2) Offer secure remote means via the internet for a survivor to submit a vehicle separation notice that includes a prominent link on the vehicle manufacturer’s internet website that meets both of the following requirements:
(A) The link is titled, in bold and capital letters, “CALIFORNIA SURVIVOR DOMESTIC VIOLENCE ASSISTANCE.”
(B) The link provides a designated internet website portal that provides a survivor the ability to submit a vehicle separation notice and includes a form that enables
a survivor to submit the
information required by subdivision (b).
(3) Upon the request of a survivor, reset the remote vehicle technology with a new secure account and delete all data from the original account.
(4) Reenable the remote vehicle technology only if the registered owner of the car notifies the manufacturer that the remote vehicle technology was disabled in error, and a survivor has not contacted the vehicle manufacturer to provide the information required by subdivision (b) within seven days of the remote vehicle technology being disabled.
(b) A survivor shall submit a vehicle separation notice to a vehicle manufacturer through the means provided by the vehicle manufacturer pursuant to paragraph (2) of
subdivision (a) within 7 days of the date on which the survivor used the method of manually disabling remote vehicle technology required by subdivision (a), which shall include the vehicle identification number of the vehicle and either of the following:
(1) A statement by the survivor signed under penalty of perjury that a perpetrator who has access to the remote vehicle technology in the vehicle has committed committed, or allegedly committed committed, a covered act against the survivor or an individual in the
survivor’s care.
(2) A copy of either of the following documents that supports that the perpetrator has committed committed, or allegedly committed committed, a covered act against the survivor or an individual in the survivor’s care:
(A) A signed affidavit from any of the following individuals acting within the scope of that person’s employment:
(i) A licensed medical or mental
health care provider.
(ii) A licensed military medical or mental health care provider.
(iii) A licensed social worker.
(iv) A victim services provider.
(v) A licensed military victim services provider.
(B) A copy of any of the following documents:
(i) A police report.
(ii) A statement provided by the police, including military police, to a magistrate judge or other judge.
(iii) A charging document.
(iv) A protective or restraining order, including military protective orders.
(v) Any other relevant document that is an official record.
(c) (1) Only if, for technological reasons, a vehicle manufacturer is unable to comply with paragraph (1) of subdivision (a), the vehicle manufacturer shall create a conspicuous mechanism that is easy to use by which a survivor or a designated person can submit a request to disable a vehicle’s remote vehicle technology.
(2) A vehicle manufacturer shall disable remote vehicle technology within one business day
after receiving a request from a survivor that includes the information required by subdivision (b) and is submitted pursuant to the mechanism required by paragraph (1).
(d) This section does not authorize or require a vehicle manufacturer to verify ownership of a vehicle, the identity of a survivor, or the authenticity of information that is submitted by the survivor.
22948.62.
(a) In addition to any other remedy provided by law, a vehicle manufacturer that violates Section 22948.61 shall be liable in a civil action brought by a survivor for all of the following:(1) Reasonable attorney’s fees and costs of the prevailing survivor.
(2) A civil penalty Statutory damages in an amount not to exceed fifty thousand
dollars ($50,000) per violation, or a civil penalty statutory damages in an amount not to exceed one hundred thousand dollars ($100,000) per violation for knowing violations.
(3) Actual damages or three times the amount at which the actual damages are assessed for knowing or reckless violations.
(b) Any waiver of the requirements of this chapter shall be against public policy, void, and unenforceable.
