| 47 | | - | SECTION 1. The legislature finds that automakers have begun collecting personal data from drivers' vehicles and are now selling collected information to affiliate companies, insurance partners, data brokers, and other third parties without owner knowledge or consent. The legislature also finds that, according to a report from the New York Times, automakers such as General Motors, Honda, Toyota, and Kia recently began including features in their vehicle-connected mobile applications that trade users' driving behaviors. The existence of data collecting and sharing partnerships between automakers, data brokers, and insurance companies often remains completely unknown to drivers whose data is being collected and sold. Some drivers with vehicles made by General Motors have stated that they were still being tracked even when the tracking feature on their vehicle was turned off. As a result, drivers' insurance rates have increased due to driver data being sold to data brokers and insurance companies. Accordingly, the purpose of this Act is to prohibit automakers from collecting, sharing, or selling driver data to a third party without the express consent of the driver. SECTION 2. Chapter 481B, Hawaii Revised Statutes, is amended by adding a new section to part I to be appropriately designated and to read as follows: "§481B- Sale of driver data without consent; prohibited. (a) No person, in any manner or by any means, shall collect, share, sell, or offer for sale any driver data that is recorded or collected through any means by a motor vehicle without the explicit consent of the individual who is the owner or lessee of the motor vehicle. (b) Disclosure notifications for data collection shall be provided to the individual who is the owner or lessee of the motor vehicle in clear and conspicuous language. (c) Consent shall be required for each disclosure as related to specific motor vehicle services; provided that if consent for data collection is denied by the individual who is the owner or lessee of the motor vehicle for any specific service, the denial shall not be used to refuse the specific service for the individual who is the owner or lessee of the motor vehicle when additional data collection or data sharing is reasonably unnecessary. (d) This section shall only apply to new motor vehicles sold or software updates for existing motor vehicles. (e) For the purposes of this section: "Clear and conspicuous" means obtaining a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous authorization for an act or practice after having been informed, in response to a specific request from a person; provided that: (1) The request is provided to the consumer in a clear and conspicuous stand-alone disclosure; (2) The request includes a description of the processing purpose for which the consumer's consent is sought and; (A) Clearly distinguishes between an act or practice that is necessary to fulfill a request of the consumer and an act or practice that is for another purpose; (B) Clearly states the specific categories of personal data that the controller intends to collect, process, or transfer under each act or practice; and (C) Is written in easy-to-understand language and includes a prominent heading that would enable a reasonable consumer to identify and understand each act or practice; (3) The request clearly explains the consumer's rights related to consent; (4) The request is made in a manner reasonably accessible to and usable by consumers with disabilities; (5) The request is made available to the consumer in each language where the controller provides a product or service for which authorization is sought; (6) The option to refuse to give consent is at least as prominent as the option to give consent and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and (7) Affirmative consent to an act or practice is not inferred from the inaction of the consumer or the consumer's continued use of a service or product provided by the controller. "Clear and conspicuous" does not include: (1) Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information; (2) Hovering over, muting, pausing, or closing a given piece of content; (3) Agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or (4) Agreement obtained through the use of dark patterns. "Consent" means the prior express opt-in authorization for a specific use that may be revoked by the individual at any time. "Driver data" means any information related to a person operating a motor vehicle that is collected from a user's interactions with a motor vehicle, which may include: (1) Personal or personally identifiable information and other sensitive details about a user's actions and movements; (2) Patterns of driving behavior, such as speeding, frequent stops, and aggressive braking; (3) Geolocation data, such as vehicle tracking information, routes taken, and location history; and (4) Information about a vehicle's operation and usage patterns, such as frequent driving times, routes, or destinations. "Owner" has the same meaning as defined in section 291C-1. "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a user's driver data to another business or a third party for monetary or other valuable consideration. "Sale" does not include the releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a user's driver data for the purpose of responding to an emergency." SECTION 3. This Act does not affect rights and duties that matured, penalties that were incurred, and proceedings that were begun before its effective date. SECTION 4. This Act shall not be applied so as to impair any contract existing as of the effective date of this Act in a manner violative of either the Hawaii State Constitution or article I, section 10, of the United States Constitution. SECTION 5. New statutory material is underscored. SECTION 6. This Act shall take effect on July 1, 2050. |
|---|
| 47 | + | SECTION 1. The legislature finds that automakers have begun collecting personal data from drivers' vehicles and are now selling collected information to affiliate companies, insurance partners, data brokers, and other third parties without owner knowledge or consent. The legislature also finds that, according to a report from the New York Times, automakers such as General Motors, Honda, Toyota, and Kia recently began including features in their vehicle-connected mobile applications that trade users' driving behaviors. The existence of data collecting and sharing partnerships between automakers, data brokers, and insurance companies often remains completely unknown to drivers whose data are being collected and sold. Some drivers with vehicles made by General Motors have stated that they were still being tracked even when the tracking feature on their vehicle was turned off. As a result, drivers' insurance rates have increased due to driver data being sold to data brokers and insurance companies. Accordingly, the purpose of this Act is to prohibit automakers from collecting, sharing, or selling driver data to a third party without the express consent of the driver. SECTION 2. Chapter 481B, Hawaii Revised Statutes, is amended by adding a new section to part I to be appropriately designated and to read as follows: "§481B- Sale of driver data without consent; prohibited. (a) No person, in any manner or by any means, shall collect, share, sell, or offer for sale any driver data that is recorded or collected through any means by a motor vehicle without the explicit consent of the individual who is the owner or lessee of the motor vehicle. (b) For the purposes of this section: "Consent" means the prior express opt-in authorization for a specific use that may be revoked by the individual at any time. "Driver data" means any information related to a person operating a motor vehicle that is collected from a user's interactions with a motor vehicle, which may include: (1) Personal or personally identifiable information and other sensitive details about a user's actions and movements; (2) Patterns of driving behavior, such as speeding, frequent stops, and aggressive braking; (3) Geolocation data, such as vehicle tracking information, routes taken, and location history; and (4) Information about a vehicle's operation and usage patterns, such as frequent driving times, routes, or destinations. "Owner" has the same meaning as defined in section 291C-1. "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a user's driver data to another business or a third party for monetary or other valuable consideration. "Sale" does not include the releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a user's driver data for the purpose of responding to an emergency." SECTION 3. New statutory material is underscored. SECTION 4. This Act shall take effect upon its approval. INTRODUCED BY: _____________________________ |
|---|