H.R. 2110 — Safe Vehicle Access for Survivors Act

This section establishes definitions for purposes of the Act, including "abuser" (i.e., individual identified by a survivor as having committed or allegedly committed a covered act); "connected vehicle service" (i.e., capability provided by a motor vehicle manufacturer or affiliate to remotely obtain data from or send commands to a covered vehicle); "covered act" (i.e., crimes under the Violence Against Women Act including domestic violence, dating violence, sexual assault, stalking, and sex trafficking; severe forms of trafficking in persons or sex trafficking under the Trafficking Victims Protection Act; or similar acts under state, tribal, or military law, with no conviction required); "covered provider" (i.e., motor vehicle manufacturer, affiliate, or agent providing connected vehicle services); "survivor" (i.e., individual age 18 or older against whom a covered act has been committed or allegedly committed); and others.

This section requires a covered provider, notwithstanding an abuser being an account holder, to take one or more of the following actions within 2 business days after receiving a connected vehicle service request from a survivor pursuant to section 4: (1) terminate or disable the abuser's covered connected vehicle service account; (2) terminate or disable the account associated with the covered vehicle (including by resetting or deleting data or wireless connections) and provide the survivor instructions to re-establish an account without abuser access; (3) terminate or disable covered connected vehicle services for the covered vehicle (including by resetting or deleting data or wireless connections) and provide the survivor instructions to re-establish services; or (4) if the vehicle has an in-vehicle interface, provide the survivor information on its availability and use to terminate or disable services. The section further (1) prohibits the provider from granting the abuser access to vehicle data generated after termination or disablement; (2) bars the provider from imposing fees, penalties, account extensions, abuser approval, or rate increases as conditions for these actions; (3) requires advance notice to the survivor (with survivor-elected contact method) of any formal notice to the abuser, provided at least 3 days after survivor notification and only after abuser access is terminated; and (4) exempts technically or operationally infeasible requests, requiring prompt survivor notification and remedy information.

This section establishes requirements for survivors submitting connected vehicle service requests to covered providers to terminate an abuser’s access to connected vehicle services on a covered vehicle. Survivors must provide (1) the vehicle identification number, (2) the abuser’s name, and (3) either proof of sole ownership or, if not solely owned, proof of exclusive legal possession (e.g., a court order) or, if owned in whole or part by the abuser, a dissolution decree, temporary order, or domestic violence restraining order granting possession to the survivor or restricting the abuser’s use. This section further requires covered providers to treat submitted information as confidential; securely dispose of it within 90 days; prohibit sharing with third parties without survivor consent, except as needed to effectuate the request; and refrain from requiring any additional information. (Providers may retain minimal records longer to verify fulfillment of request conditions, subject to data minimization.) These constitute minimum obligations that do not prohibit emergency terminations of access, and survivors must notify providers of material changes in vehicle ownership or possession.

This section requires covered providers to post on a publicly available, user-friendly website information on how survivors can safely submit connected vehicle service requests (i.e., requests to terminate an abuser's access to a vehicle's connected services), including (1) sending a confirmation email to the survivor upon request submission that includes a reference number and next steps; (2) notifying the survivor of the review outcome, such as access termination or requests for additional information; (3) upon approval, providing guidance on creating a survivor-controlled app account; and (4) offering an opt-out from email notices with alternative record-keeping options if the abuser accesses the survivor's email.

This section provides liability protection to a covered provider and its officers, directors, employees, vendors, or agents against any claims arising from actions taken or omissions made in compliance with the Act.

This section preempts state and local laws, regulations, rules, standards, requirements, or other provisions having the force of law that are covered by or related to this Act or rules promulgated under it.

This section directs the Federal Communications Commission (FCC), in consultation with the National Highway Traffic Safety Administration (NHTSA), to issue a notice of proposed rulemaking not later than 180 days after enactment of this Act to prescribe how covered providers must address connected vehicle service requests (i.e., requests for data or control from a vehicle) and covered acts (i.e., unauthorized access by abusers) in accordance with this Act, including (1) a reporting and notification process to swiftly revoke or disable an abuser's access to a survivor's data—accounting for heightened risks of retaliation, confidentiality needs, removal of stored sensitive data, and prevention of alternative access methods such as service requests—and (2) reasonable methods to notify account holders of safety and privacy options and data access controls. The FCC must conclude the rulemaking proceeding and prescribe final regulations not later than two years after enactment.