[Congressional Record Volume 160, Number 8 (Tuesday, January 14, 2014)]
[Senate]
[Pages S327-S329]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. HOEVEN (for himself, Ms. Klobuchar, Mr. Blunt, Mr. 
        Manchin, Mr. Kirk, Mr. Isakson, Mr. Johanns, Mr. Chambliss, Mr. 
        Hatch, Mr. King, Mr. Bennet, Ms. Hirono, Mr. Begich, Mr. Wyden, 
        Mr. Coons, Mr. Portman, Mr. Franken, and Mr. Thune):
  S. 1925. A bill to limit the retrieval of data from vehicle event 
data recorders; to the Committee on Commerce, Science, and 
Transportation.
  Mr. HOEVEN. Mr. President, I thank the Senator from Minnesota for 
joining me this afternoon. Today we are introducing the Driver Privacy 
Act. I am very pleased to sponsor that legislation with the good 
Senator from Minnesota. We have a great group that has joined us as we 
introduce this bill today. This is all about protecting people's 
privacy in regard to their automobile.
  Every automobile that will be made going forward, over 90 percent, 
and something like 96 percent of the automobiles made now have a black 
box. This is actually silver, but we call it a black box because it is 
an event data recorder. It records information about your automobile. 
Ninety-six percent, I think, of automobiles made now have them, but the 
U.S. Department Of Transportation is requiring this year that every 
vehicle have an event data recorder in it.
  The Senator from Minnesota and I believe that should be the owner's 
information and that information should not be released without the 
owner's consent. We already have a good group who have joined us in the 
endeavor, including an equal number of Republicans and Democrats: 
Senator Johanns from Nebraska, Senator Angus King from Maine, Senator 
Kirk from Illinois, Senator Joe Manchin from West Virginia, Senator 
Saxby Chambliss from Georgia, Senator Michael Bennet from Colorado, 
Senator Roy Blunt from Missouri, Senator Mazie Hirono from Hawaii, 
Senator Johnny Isakson from Georgia, Senator Mark Begich from Alaska, 
Senator Orrin Hatch from Utah, and Senator Ron Wyden from Oregon.
  It is absolutely an equal number of Republicans and Democrats from 
across the United States have joined together, recognizing people are 
concerned about their privacy and we need to make sure their privacy is 
protected.
  I would like to make a few further introductory comments with the 
help of these charts and then turn to my colleague from Minnesota for 
her comments as well. We have seen with the NSA, with the IRS, with the 
Affordable Care Act, and with a whole range of issues that people 
believe what is going on, not only in government but with technology, 
is that their privacy is at risk these days and it is very much a 
concern. Many people do not realize that this event data recorder is in 
their car. It records all kinds of information, and in fact the Federal 
Government is requiring that this device be in their car. Neither is 
there a limitation on the amount of data that the device can record nor 
is there a law that protects individuals' privacy to make sure the 
owner of the car decides who gets that information, other than under 
very specific circumstances which I will take a minute to go through.
  What kind of data gets recorded by your event data recorder, this 
black box that is included in your car? There are more than 45 
different data points that are in fact recorded right now. Again, the 
manufacturer can change this--add to it. There are no limitations or 
restrictions or guidelines or requirements on what manufacturers can 
have the event data recorder do. Right now it records things like 
speed, braking, engine, seatbelt usage, driver information, passenger 
information, steering, airbags, and crash details. As

[[Page S328]]

I say, at this point the manufacturer determines what goes into that 
black box in terms of what its capabilities are.
  Just to give a sense, if you delve further, for example, engine--just 
pick one here: ``Number of times engine was started since being 
manufactured prior to a crash.'' Obviously the idea here with the event 
data recorder is that it provides information just like an event data 
recorder on an airplane. In the event of a crash, it provides 
information about the accident. It is recording this information in a 
loop on a continuous basis, and it retains it for a short period of 
time and constantly updates it.

  For example, for your engine, it can record the number of times the 
engine was started since being manufactured prior to a crash. It can 
record the number of times the engine was started since being 
manufactured prior to the EDR data download that is taken in case the 
box is removed and the information is taken and there isn't a crash. It 
can record how fast the engine was running. That is just 1 of the 45 
data points, but it shows the kind of information that is recorded and 
can be extracted from the black box.
  So what does our legislation do? It is very simple and very 
straightforward. The Driver Privacy Act provides that the data from 
your EDR in your car cannot be extracted or taken by another party 
other than under very specific circumstances, and that means it cannot 
be done without your consent unless it is authorized by a court of law 
or the information is retrieved pursuant to NHTSA, which is the 
National Highway Transportation Safety Administration, recall or the 
information is needed in the event of a medical emergency, essentially 
unless there is some kind of recall on the car--and then they can't 
disclose any data about you as an individual. It is macrodata. But 
other than that, without your consent, that information can only be 
taken from you by a court of law or in the event of a medical 
emergency, and that is done, obviously, for the very reason you have 
the black box in the car--safety, right?
  Law enforcement might be getting it pursuant to a court order. They 
can't just take it; they have to have a court order. If you are in a 
car accident and they need that information because of a medical 
emergency, then there is a special condition to take it.
  In developing these, we were very careful to work both with the 
organizations that advocate privacy as well as the automobile dealers, 
the insurance industry, and law enforcement. We consulted with 
stakeholders, such as the Electronic Privacy Information Center, 
Heritage, AAA, the Auto Alliance, the International Association of 
Chiefs of Police. Again, we wanted to make sure the law enforcement 
issues were covered as well as the ACLU. We have a broad and diverse 
group that has been consulted and that we have worked with in putting 
together this information.
  Fourteen States have their own laws on this issue. I have highlighted 
the 14 different States that have passed laws that, in fact, assure you 
that this information is your information and cannot be taken from you 
without your consent other than through a court order or in the case of 
a medical emergency. But when you leave your State and you are driving 
in another State, you are no longer protected. So even though 14 States 
have stepped up and said: Yes, this is something we need to do--in 
fact, it was something we did when I was Governor in my State. Not only 
are the other States not protected, but you are not protected either 
when you drive outside your State, which all of us do on many 
occasions. So that is why we need a Federal law.
  The reality is this technology is evolving and developing. This 
technology is going to continue to develop with all kinds of other 
aspects--obviously now we have GPS--and all the different things that 
are being done with automobiles. In many cases these are things people 
want, but they need to know their privacy is protected, and that is 
what we are doing here. We are doing it in a way that we made sure we 
continue to assure law enforcement, first responders, and manufacturers 
that the safety issues are being dealt with, and at the same time 
assure American citizens and consumers that their privacy rights are 
being respected and protected as required under the Fourth Amendment of 
our Constitution.
  With that, I will turn to my esteemed colleague from Minnesota and 
again thank her and her staff for the work they have done on this bill. 
With her background in law enforcement, she truly understands the 
issues and has been invaluable in putting this legislation together. 
Again, I thank her and ask her for her comments.
  The PRESIDING OFFICER. The Senator from Minnesota.
  Ms. KLOBUCHAR. Madam President, I am introducing this bill today with 
Senator Hoeven, who has been a true leader on this issue. When he was 
Governor, he worked to pass a similar law in North Dakota.
  As Senator Hoeven just described, the Driver Privacy Act will 
strengthen safety and protect consumer privacy. I think the bipartisan 
support Senator Hoeven has gathered for this bill--seven Republicans, 
seven Democrats, and people all over the country from Hawaii to Georgia 
to Oregon to Alaska, not to mention the two of us from the middle of 
the country--demonstrates the strong support and the concerns people 
have about emerging technology. We want this technology, but I figure 
our laws have to be as sophisticated as the technology we have out 
there. Right now our laws are lagging and this information is not 
protected. There is no roadmap on how it should be protected, and that 
is why we are introducing this bill.
  I have long supported improving safety on the roadways. Too many 
people die on our highways, and we need to do something about it. In 
2010, there were more than 30,000 fatal crashes and more than 1.5 
million crashes that resulted in injuries. This is unacceptable. Rural 
road safety is a critical issue for my State, as well as for Senator 
Hoeven's State. Only 23 percent of the country's population lives in 
rural areas, and yet 57 percent of all traffic fatalities occur in 
rural America.
  As a Member of the Senate Commerce, Science, and Transportation 
Committee, I have worked to advance efforts to improve safety for all 
drivers, especially on rural roads, and we have made some progress. The 
transportation bill, MAP-21, ensured strong funding for safety 
improvements at rail-highway grade crossings, and the allocation of 
Federal funding was improved to put resources into roadways that need 
attention the most.
  My amendment in MAP-21, with Senator Sessions, required the Federal 
Highway Administration to work with State and local transportation 
officials to collect the best practices from around the country that 
are also cost-effective ways to increase safety on high-risk rural 
roads. The report was just released, and I am now looking for 
opportunities for how we can best address some of the challenges 
addressed in the study, but it is clear we have more work to do.
  Vehicle technologies that assist drivers and prevent crashes have 
grown tremendously in recent years. From new sensors that identify 
unsafe conditions, to driverless cars, these emerging technologies 
could dramatically increase safety for drivers and passengers.
  Event data recorders, which are the subject of our discussion today, 
hold similar promise in improving safety on our roadways. An EDR, as 
Senator Hoeven described, is a device that records data on a loop it 
receives from vehicle sensors and safety systems. The data is 
constantly being replaced and it only records 5 seconds of technical 
safety information when a crash occurs, although I am sure that could 
change when the technology changes.
  EDRs can be the only resource available to determine the cause of a 
crash by providing information about what a driver was doing in the 
seconds leading up to a crash, such as how fast the vehicle was going, 
whether the brake was activated in the seconds before the crash, if 
airbags were deployed, and whether the driver and passengers were 
wearing seatbelts.
  As a former prosecutor, I know how useful this data can be. It can be 
very useful for investigators to put the pieces back together to more 
easily determine the cause of a crash for safety reasons and also 
determine who caused the crash.
  The proven benefits to driving safety that EDRs provide are not new. 
In the summer of 2012, the Senate included in

[[Page S329]]

its version of the Transportation bill, MAP-21, a requirement that the 
National Highway Traffic Safety Administration, NHTSA, initiate a 
rulemaking to require passenger vehicles and light-duty trucks to 
include EDRs.
  At the same time, there were many legitimate questions regarding what 
impact expanding EDRs to all passenger vehicles would have on consumer 
privacy. Who owns the data? Who can access the data? It became clear 
that an effective EDR provision would need to strengthen driver and 
vehicle safety while protecting consumer privacy, and the EDR provision 
was removed from the final transportation bill.
  Over the past 2 years, NHTSA has continued to work with law 
enforcement safety groups and the automobile manufacturers to ensure 
the safety benefits of EDRs, which could reach the most consumers. The 
auto manufacturers had already begun expanding the inclusion of EDR 
technology in more new vehicles each year. EDRs became so commonplace 
that 96 percent of 2013 cars and trucks had the EDR built in, and NHTSA 
and the industry it regulates, the automakers, were able to agree that 
all new cars and trucks should have an EDR in place in September 2014. 
I am not sure everyone who goes out and buys a car is aware of this, 
but by 2014 every single car and truck will have this capability.
  However, NHTSA does not have the authority to address the consumer 
privacy concerns related to EDRs that have remained outstanding for 2 
entire years. We have seen an enormous increase in new cars and trucks 
containing the EDRs, and that is where Senator Hoeven comes in.
  Congress does have the authority to clarify ownership of EDR data, 
and that is why we are introducing the Driver Privacy Act, along with 
12 other Senators. Our bill makes crystal clear that the owner of the 
vehicle is the rightful owner of the data collected by that vehicle's 
EDR, and it may not be retrieved unless a court authorizes retrieval of 
the data, the vehicle owner or lessee consents to the data retrieval, 
the information is retrieved to determine the need for emergency 
medical response following a crash, or the information is retrieved for 
traffic safety research, in which case personally identifiable 
information is not disclosed. So that is where you have it.
  We have worked hard with safety groups and law enforcement to make 
sure this would work for them. You would need a court authorization or 
you would need a consent or you would need a determination that it is 
needed to determine the cause of a crash or it is needed for research, 
and in that case, no identifiable data.
  This was really important for me, as a former prosecutor, that we 
made this work for law enforcement and our safety groups, but, most 
importantly, our goal was to make it work for the individual consumers, 
the citizens of the United States of America. We realize while all of 
this was done for good intentions, no one had taken the broom behind 
and made sure the American people were protected.
  Having just left a judiciary hearing this afternoon about NSA and 
data collection and privacy and civil liberties, it was very timely 
that I came over here. While this may not quite have the huge 
ramifications of that hearing, I do think to myself that maybe if 
people thought ahead a little bit, we wouldn't have been sitting in 
that hearing. That is what we are trying to do with this bill. We are 
trying to think ahead so we can keep up with the technology so it 
doesn't beat us out and it doesn't beat our constitutional rights out.
  I have seen firsthand the devastating effects automobile crashes can 
have on families as they are forced to say goodbye to a loved one much 
too early. Oftentimes families just want answers. They want to know 
what happened and why. EDRs can help provide those answers. Our bill 
accounts for those needs of law enforcement and these families. You 
don't have to take my word for it. The International Association of 
Chiefs of Police has concluded that the Data Privacy Act will not cause 
any additional burden to law enforcement agencies in accessing the data 
they need.
  Advancements in technology oftentimes force us to take a look at 
related laws to ensure they remain in sync. Senator Hoeven and I are 
introducing the Driver Privacy Act to do just that. Our bill strikes 
that balance between strengthening consumer privacy protections while 
recognizing that EDR data will be required to aid law enforcement, 
advance vehicle safety objectives, or to determine the need for 
emergency medical response following a crash.
  I thank Senator Hoeven for his leadership. He is a true bipartisan 
leader. We have worked together on many bills. When we work together, I 
always say the Red River may technically divide our States, but it 
actually brings us together, whether it is about flood protection 
measures or important bills such as this. I appreciate the opportunity 
to work with him on this bill.
  I yield the floor.
  The PRESIDING OFFICER. The Senator from North Dakota.
  Mr. HOEVEN. Madam President, I thank Senator Klobuchar for joining me 
on this legislation and working to develop a great group of 14 original 
cosponsors.
  Senator Klobuchar brings such a great background as a prosecutor in 
the law enforcement industry and truly understands law enforcement 
issues, safety issues, and the informational benefits there are with 
not only event data recorders, but also understands the need to protect 
individual privacy.
  As I think we both said very clearly here on the Senate floor, this 
is a technology that is new and evolving. It is not just that this is a 
new and evolving technology where new capabilities are being added all 
the time, we don't know what additional capabilities will be added.
  But now the Federal Government is requiring that this device be in 
every single automobile made. So when the Federal Government--the U.S. 
Department of Transportation, NHTSA, the safety branch--steps up and 
says: OK, we are going to require this device to be in every single 
car, we need to make sure we are also providing the privacy that goes 
with it that assures our citizens that their Fourth Amendment rights 
will be protected.
  Again, I think the Senator from Minnesota makes a really great point 
that when we look at some of these areas in terms of whether it is NSA, 
IRS, or other areas, people feel there wasn't enough work done on the 
front end to protect their personal privacy, so we are in a catchup 
situation. Let's not do that when every single citizen across this 
country owns or their family owns or has access to some type of 
automobile. That is what we are trying to do.
  Again, as the technology develops we need to understand what the 
ramifications are and how to protect privacy. I think, on behalf of 
both of us, we are appreciative that we have 14 Senators engaged 
already, and we look to add, and we are open to ideas on making sure 
this is the right kind of legislation that addresses safety but 
ultimately protects the privacy of our citizens.

                          ____________________