H.B. 357 Amendments to Motor Vehicle Data Privacy: transcript

Thank you. Chair and committee members. Can you hear me okay? Yeah, you're fine. Okay. The topic that's addressed by this bill is one that we discussed during interim in multiple interim committee meetings. And the problems we're addressing are the massive amount of data being collected by automobiles. Um, if staff could put up slide one. It's a slide from privacy for vehicles. Um, you guys have it, right? Yes. Okay. Okay. And the need for informed consent. Opting out of unnecessary collection and an ability to wipe data from a vehicle after use. Sometimes if you're selling a vehicle, there will be data that's left over in it. And also, if you're renting a vehicle, vehicles are loaded with electronics and sensors and integrate with personal devices like your phone, collecting huge volumes of personal data. And then if you can put, oh, can everybody see that? Yeah. Yeah. The, the writing is so small. Um, okay. If you can put up slide two. There's also the issue of hard to understand data and privacy policies. Um, privacy policies, as all of us know after having signed a million of 'em, are pages and pages long and you don't know what you're signing and people just scroll down and sign it. And so they don't know what they're getting into. The data that is gathered is used in ways that can harm consumers, sometimes used in ways that can harm consumers like stalking. One example of this would be years after a divorce, Carrie still had a full restraining order prohibiting her teenage son's father from contacting her in any way. One day her son drove home in his dad's brand new Tesla, saying that his father insisted that he park it in Carrie's driveway right by her door. Suspicious. Carrie discovered on the internet that Tesla has a century feature, enabling it to record action anywhere around the car. Her husband was using the car itself to monitor her home. They cars can also listen to private conversations. Information gathered can be sold to third parties like data brokers and insurance carriers for the purpose of tracking your driving habits and using that information to leverage higher insurance rates. Rental vehicles store your data after you leave. So what is the solution? Big manufacturers in Utah are already operating or supposed to be operating under the Utah Consumer Privacy Act. And this legislation clarifies that the bill amends the Utah Consumer Privacy Act to ensure that all car manufacturers adhere to consumer data privacy protections for vehicles sold in Utah. Under UCPA, consumers have the right to confirm whether a manufacturer is processing their personal data, accessing their personal data request that the personal data that they provided to a manufacturer be deleted, obtain a copy of the personal data that they previously provided to a manufacturer, correct inaccuracies starting in July of 2026, opt out of having their personal data used for the purpose of targeting advertising, targeted advertising, and the sale of personal data. UCPA requires that a manufacturer provide a consumer with reasonably accessible and clear privacy notices that describe the categories of personal data processed by a manufacturer, how a consumer may exercise their rights. The con the categories of personal data that the manufacturer shares with third parties, if any, the categories of third parties, if any, with whom? The, um, let's see. Did I guess that I restated that, sorry. If a consumer's personal data is sold u and used for targeted advertising, the consumer must be informed about how the consumer may opt out of the sale of personal data, the processing of their personal data for targeted advertising changes to UCPA, the Utah Consumer Privacy Act, HB 3 57 specifically adds in 2030, I think it says 2029, but the substitute says 2030, um, in vehicle access to privacy controls to see what data is collected, opt out of the sale, or sharing of data, delete stored data and provide that access is also allowed through an app or a website, but only addition in addition to the in-car option. So this streamlines the cumbersome online pro processes used for these requests right now. And let's consumer control this data from the vehicle itself. So when you rent a car, you, if you plug your phone into the car, the the car will store the data on your phone. So that's one of the things that, that should be part of the informed consent so that people know, um, know that they need to get that information deleted or at least know that it's out there. Um, thing, important notes here. Vehicle manufacturers can still use this data for safety features, vehicle operation, or other legally mandated uses. Delayed implementation of the newly manufactured vehicles is now 2030 for in-vehicle systems. I wanna thank the stakeholders that we've met with on this. We've met with lobbyists representing gm, Tesla, Tesla Nexus, LexiNexis, sorry. And the Alliance for Automotive Innovation, which has 45 members who represent domestic and international auto manufacturers who sell in the USA Privacy for Cars, division of Consumer Protection, office of Data Privacy, the DMV used and new Car Car dealer associations. And that is my presentation. I'm open for questions.

Uh, I, this is to the first substitute. Okay, Great. Yeah. Alright,

There you Go. Sorry, it's me again. But thank you Mr. Chair. Um, I, well, I really like 99% of this bill, but as somebody who religiously listens to an extensive amount of true crime podcasts, I'm wondering if, um, if this will impact, uh, law enforcement's ability to, to get the information that they need. I know there's a lot of criminal cases that are solved by being able to access data and find out where cars have been and distance that they've driven and things like that. Can you, I didn't hear you, um, name law enforcement as any of the stakeholders you met with, so I wasn't sure. So

The, the main points of this are that you have informed consent, you can opt out of third party data that would be sold to third party vendors. Um, any, any information I don't know about law enforcement. Can I call, can I?

I do. Okay. I'm hoping that there call A friend.

You're with that would be great. I'm Katie Haas. I'm the Director of the Division of Consumer Protection. I wanna clarify, I'm not an expert on cars. Um, but we do enforce, uh, or we, uh, investigate, uh, claims under the UCPA and have worked with Representative Shelley on drafting this bill. My understanding is when she recently referenced, um, other legally required things, if there are things under the law for criminal proceedings that would be required to be stored on a car so that it could later be pulled, um, my understanding is that that could still happen. So even if somebody has deleted their data, if there's other information that is been maintained in the vehicle and law enforcement needs access to that, whether through a warrant or other ways, they would still be able to pull anything that's still available.

So, go ahead, if I may. So does that mean that the information is deleted but not actually if it's deleted, but it's still available for law enforcement that, so the information that people can delete are the things that are personal to them that they have provided to the vehicle as I understand it. But other information that the vehicle is naturally tracking in order to do safety and other things will still be in there. So I, I, I, I think I wanna, I want to think about that really carefully.

Um, I think people could still wipe, like if I got out of a rental car and my phone connected, I could wipe certain categories of information out off of it. I'd have to go back through carefully and look at all the categories. So I think the answer is yes and no. Some categories will be able to be deleted, some will not be able to be deleted. And if there are requirements under the law for the manufacturers to maintain that information for any reason, then they'll be required and people will not be able to delete that information. Thank

You. Right. And we also specifically excluded things that have to do with the operation of the vehicle, the safety of the vehicle. And I, I would assume that that would also include anything on the vehicle that is necessary for like, if there were an accident or something. I know a lot of cars have black box kind of things. I, those are excluded as well.

Thank you Mr. Chair and committee members. My name is Mackay Johnson. I'm with the local lobbying firm, Foxley Pig and Elli, Callie and Styler. We represent the Alliance for Automotive, um, innovation, which is the, as the good representative mentioned, it's the, um, it's the manufacturers, both, uh, domestic and international. We just wanted to, uh, convey our gratitude to the representative for bringing all the stakeholders together on this legislation. Um, she really has done such a artistic job of striking the right balance for, uh, protecting the consumers as well as hearing our concerns. Thank you, representative. Thank you.

That's what, and the legislator. Yes. Thank you.

Um, no, I really appreciate the spell. I know we talked about it a little bit in interim and, um, I think it's a good bill and, um, will protect us in so many different ways. So I move that we favorably recommend We got, oh, substitute With the substitute. Yes. I favorably recommend the first substitute.

No, I Waive. Okay.

Thank you. Now I wa I move that we favorably recommend this bill.

No, I, like I said, I think it's a great bill and I appreciate the sponsor bringing it forward.

I will Waive. Okay. Back. Thank you.

3 57 amendments to motor vehicle. Date of privacy Representative Shelley. Thank You, chair and committee. Um, the need for this bill was discussed during interim in the transportation committee, and I'm speaking to the first substitute with the First Amendment. The amendment has not yet been adopted. First, I wanna thank the stakeholders who have participated in discussions including gm, Tesla, and Lexus Nexus, the Alliance for Automotive Innovation, privacy for Cars, division for Consumer Protection, office of Data Privacy, the DMV used in new car dealer associations and Uber vehicles collect many times the data that your phone collects and your phone data as well via Bluetooth. Vehicle. Privacy policies are long, complicated, and rarely read. Gathered data can and has been used in ways that harm consumers like e stocking by partners who have access to the ve have had access to the vehicle, listening to private conversations being sold to third parties like data brokers and insurance carriers for the purpose of tracking your driving habits and using that information to leverage higher insurance rates and rental vehicles also store your data opening up a host of possible issues. This bill clarifies that big manufacturers in Utah are already operating under the Utah Consumer Privacy Act. It amends the Utah Consumer Privacy Act to ensure that all car manufacturers adhere to consumer data privacy protections for vehicles sold in Utah. The Utah Consumer Privacy Act requires that a manufacturer provide a consumer with a reasonably accessible and clear privacy notice that describes the categories of personal data processed by the manufacturer, the purpose purposes for which the personal data are processed, how consumers can exercise their rights, the categories of personal data that the manufacturer shares with third parties, if any, and the categories of third parties, if any, with whom the manufacturer shares personal data and how to opt out of personal data sharing for targeted advertising. HB 3 57 specifically adds by 2030 in-vehicle access to privacy controls. Vehicle manufacturers can still use this data for safety features, vehicle operation, and other legally mandated uses. And we have delayed implementation for in-vehicle systems to, in newly manufactured vehicles to 2030. And that concludes my presentation.

Thank you, Mr. Chair. Um, would this enactment prevent us from having full access to all the vehicles available on the market if we are the only state leading out on this kind of, I don't believe so. Okay. We have had bills like this with, um, technology on our phones, and it's created quite the excitement because then that would prevent us from having access to certain tools and phones here in this state. So I'm just wondering if this would follow that same

Path. Right. We've worked with the manufacturers and put an IMPLE implementation date in place that they can work with, so I don't think that it's going to impact that, but we can ask them if you want.

Thanks. Thanks.

So this applies to vehicles, uh, model year 2030 going forward. What about somebody who wants to get rid of this data on their current vehicle?

I believe there are ways to do that. It's just not as easy. I think there that if you actually contact the manufacturer, you can do that. But maybe we can ask the consumer privacy people.

Uh, thank you. So the Utah privacy, uh, the Consumer Privacy Act already requires an ID Didn't invite Sorry, Please. Sorry. Sorry, sorry, sorry. Katie Haas. I'm the Director of the Division of Consumer Protection. We investigate, um, and work with, um, companies on the Utah Consumer Privacy Act. The, actually, the Attorney General enforces it, but typically consumers have a right to ask that the company, provide them with information about what they've collected and then delete it, um, if so requested. And so this just puts all manufacturers under that statute and people can send in a request to delete, um, the data that the car is carrying, um, about them. So that provides that opportunity for consumers to reach out to the manufacturers.

Thank you Mr. Chair and committee members. My name is Mackay Johnson. I'm with Foxley and Pagan, the lobbying firm that represents the Alliance for Automotive Inno Innovation, which is the Trade Association of the Domestic and International Manufacturers. Um, we wanted to compliment the representative for her collaboration on this bill. Um, she did a very good job of listening to the stakeholders throughout this process, and we feel like she struck the right balance between the consumers and the industry concerns.

Yes. Hello. Thank you, Mr. Chair. This is Stephanie SaaS with Uber Technologies. Um, uh, thank you so much. I wanted to just touch base and ensure that I was on to, uh, thank the sponsor for collaborating with us on this legislation. We appreciate the work to, uh, add the amendment, which successfully addresses our concerns regarding potential impacts on both our AV and EV operations. We strongly encourage the committee to support this amendment today. Thank you.

Yes, I'd make that a motion to adopt amendment one Discussion representative nun a Aye.

Um, I would make motion that we favorably recommend first substitute house bill 3 57 as amended

Thank you, Mr. Speaker. HB 3 57 addresses the massive amounts of data collected by our vehicles. Our vehicles are collecting 10 times as much data as our phones are, and when we hook our phones into the Bluetooth, they collect the data from our phones as well. The purpose of this bill is to, um, well, let me talk about the use of the data first. So, the use of the data is for car functionality sometimes, however, it can also be used for e stocking. Um, it can be used for listening to private conversations. It is also collected for insurance companies who track the movements of your vehicle if you swerve, if you hit your brakes fast. Those kinds of things are, are collected and affect your insurance rates. What we are doing with this bill is that we're making all the provisions of the Utah Consumer Privacy Act applicable to the motor vehicle manufacturers. Um, consumers will be able to view categories of data that are collected, view categories of data that are being, being sold or shared with third parties. Opt out of personal data sharing or processing that is, is, um, used for targeted advertising and delete or wipe data that has been collected by a car, which you would want to do if you're selling the car or if you have rented a car. Um, you should all have a flyer on your desk that has an outline of the types of data that is collected by vehicles, and there's more information on the back of it. Um, the lobbyists that we worked with on this we're gm, Tesla, Lexus Nexus Alliance, Alliance for Automotive Innovation, privacy for Cars, division of Consumer Protection, office of Data Privacy, the DMV and the Used and New Car Dealer Association. And that is the bill. Thank you, Representative Shelley.

Thank you, Mr. Speaker. I would like to speak in favor of this bill. This is a piece of legislation that I was going to run. I, uh, personal story. I, I bought a vehicle to drive up to the Capitol a couple years ago from my father, and he had a tracking service on his vehicle, and he didn't think of it, and I didn't think of it because we were related to each other. And about three or four months later, he is like, Hey, I saw that you were at so and so, you know, in these different places. And I'm like, how did you, I mean, it's okay, but how did you know I was there? And he's like, oh, I paid for this tracking service. And so that was really surprising to me that a private person could sell a vehicle, have tracking service on it, not tell the other person, and this could be accidental or it could be done on purpose. Maybe it's a, an ex-spouse, maybe it's a someone you're wanting to track for nefarious purposes. But the, regardless, regardless, your data is your data. And, and that should be disclosed to you. I think there's probably is still a little bit more work to do on this, on the, the third party sales, but this is good for consumer protection and, and I stand in strong support of this bill.

I'll waive Summation has been waived.

and Lexus Nexus Alliance for Automobile Innovation, privacy for Cars to Division of Consumer Protection, DMV and the New and Used Car Association and others to go through and clarify that, uh, there's a way, uh, that clarifies that Big ma that the auto manufacturers in Utah were already on operating under the Utah Consumer Privacy Act to go through and amend that to go through and ensure that all car manufacturers adhere to the di consumer. Data privacy protections for vehicles sold in Utah, uh, creates categories of personal information purposes for which, and then of what it does, it says, uh, specifically by 2030 in vehicle access to privacy controls will be enabled so that people will be able to delete their, uh, personal DA data off a rental car. The cars the old they sell. Um, anyway, it's a pretty good one for starting off things with, uh, all the data that's collected in cars. And with that, I'm open for questions.

I rise in opposition to HB 3 57. Let me begin with a reminder of how dramatically cars have changed. Many of us remember vehicles from before the OBT two diagnostic systems existed. If the car made a strange noise, you open the hood, listen carefully. And if you were lucky, someone nearby had a wrench and a theory. Modern vehicles are not like that anymore. Today's cars are essentially distributed computer networks on wheels. They contain dozens of processors, sensors, safety systems and communication platforms constantly exchanging data in order to operate safely. Those systems monitor braking, engine performance, collision avoidance, software updates, navigation, and reliable diagnostics. Now here is where the bill runs into trouble. The bill requires manufacturers to create a dashboard interface where drivers can view every category of data collected. See every third party receiving that data out of certain uses and delete personal data stored in the vehicle. But that's, as that assumes that all that data sits neatly in one place where you can simply open a menu, press delete. That is not how modern vehicles work. Vehicle data moves through multiple control modules, safety systems, diagnostic platforms, and cloud services. Some data exists for milliseconds, some is required for safety and federal compliance. Some never resides in the vehicle at all. So that's what this bill really does. So what this bill really does is an attempt to write software architecture for automobiles into Utah statute. And that raises a broader concern. Utah has traditionally tried to avoid becoming California or New York, where legislatures increasingly adapt and nanny state regulate to a model that attempts to micromanage the internal design of private technology. We should absolutely reg regulate harmful conduct, but we should be very cautious about turning the legislature into a software design authority for complex technologies. Because if we truly eliminate the kinds of data system, this bill assumes our optional Well, good luck with your Tesla self-driving feature, your Apple CarPlay mapping system, and most of the safety systems that modern drivers now depend on. And if someone really wants a car with absolutely no d data collection at all, there's always another option you can go find yourself a treant. For those reasons I respectfully urge a no vote. Thank you.

Thank you. I, I think the good senator went through and made my point here. There is hundreds if not thousands of data points that are, uh, collected in a vehicle. Some are temporary, some are, um, collected for safety or functionality. That's why in conjunction with the manufacturers and other stakeholders, this, uh, talks about the model year 2030 going forward. So there's plenty of time to create those interfaces. They, uh, expressed interest in doing that. It's a partnership. The question is, is who owns your personal data? This goes through and deals with that. The two issues that were also brought up, the safety and functionality are not affected by this bill. It's your rather personal data that will be enabled to be deleted at some point in the future. And with that, I would move that first substitute house bill 3 57 pass under suspension of the rules.

Vote. Senator Vickers Baldy Lewin Bramer Bus Comore. Mia Fillmore Grover Harper Aye. Kins Ipson Johnson. Quan McKay. McKay. Mikel Aye. Milner Aye. Wo Owens pitcher Plum Rebi Sandal Stevenson Stratton Bickers Aye. Weiler Aye. Wilson. Aye. Winterton Escamilla

You Mr. Speaker Motion to concur with the Senate amendments.

Yes. Um, we just extended the timeline for compliance for the motor vehicle manufacturers and we removed vehicles from that are not technologically capable of compliance from, um, from the requirement to comply and we changed the posting of the privacy information to the motor vehicle, uh, division website.