Congress Considers Right to Repair Bill for Vehicle Owners

Last week, the House Energy and Commerce Committee voted to send the Right to Equitable and Professional Auto Industry Repair (REPAIR) Act to the full U.S. House of Representatives for consideration. This legislation, if enacted, would give car owners access to their vehicle-generated data and repair data and tools from vehicle manufacturers. It would also grant owners certain rights over the use of that data, including the right to delete it, and would prevent recipients of vehicle-generated data from selling, transferring, or licensing that data absent certain exceptions. As indicated by its name, the REPAIR Act is reflective of the so-called “right to repair” movement to allow consumers and independent repair shops access to the same data for repair and maintenance that manufacturers make available to themselves or franchised dealers. It also has important implications for data privacy in modern vehicles, which generate increasingly large volumes of information.

Data Sharing Requirements for Motor Vehicle Manufacturers

The REPAIR Act would require vehicle manufacturers to provide vehicle owners or their designees vehicle-generated data through and including the interface ports of the motor vehicle and electronically when the car is equipped for wireless transmission over wireless technology via any telematics system.

“Vehicle-generated data” is defined in the bill to include “any direct, real-time, in-vehicle data generated . . . by the operation of a motor vehicle related to diagnostics, repair, service, wear, and calibration or recalibration of parts and systems.” It does not include specified data related to automated driving systems or any personally identifiable information.

The manufacturer would have to provide the owner access to this data in the same manner and using the same security protections as when it provides the data to any other manufacturer, dealer, service provider, or other third party.

Similarly, manufacturers would have to provide access to “critical repair information and tools” to vehicle owners — as well as aftermarket parts manufacturers and repair facilities — to allow for independent repair. “Critical repair information and tools” are defined to include “technical and compatibility information, tools, equipment, . . . software, and technology, including information related to diagnostics, repair, service, and calibration or recalibration of parts and systems.”

Prohibitions on the Use of Vehicle-Generated Data

Under the REPAIR Act, any entity that accesses or stores vehicle-generated data — including manufacturers and other parties to whom a car owner provides the data — could not use that data for any purpose other than diagnostics, repair, and other similar services requested by the owner. Further, vehicle-generated data could not be sold, licensed, or transferred to any other person, unless the car owner requests it or consents for service-related reasons. However, manufacturers could retain data in de-identified form for research and development.

This provision seemingly limits the disclosure of certain driving data to third parties like credit reporting agencies or insurance companies.

Data Rights for Vehicle Owners

Vehicle owners would have the right to receive their own vehicle-generated data and repair information. Relatedly, owners would have the right to designate (and de-designate) other persons to access such data including, presumably, independent repair shops. And manufacturers could not impose any unreasonable or deceptive burdens on de-designation, or limit the number of designees. The bill, however, is otherwise silent on how vehicle manufacturers should implement the designation process.

Vehicle owners would also have the right to request that anyone who accesses their vehicle-generated data delete such data within 72 hours, unless the data is necessary for record-keeping, accounting, or safety purposes or fits into certain exceptions for research and development using de-identified data. Again, the bill does not prescribe a particular deletion request process, but various entities including manufacturers, dealers, and independent repair shops would apparently have to comply with such requests.

Other Manufacturer Requirements

In an attempt to put independent repairers on equal footing with dealerships, the REPAIR Act would prohibit vehicle manufacturers from technologically or legally impairing the ability of vehicle owners or designees to use any service provider of their choosing, or to diagnose, repair, or maintain their vehicle in the same manner as any manufacturer or dealer. Manufacturers also could not impair the ability of aftermarket parts manufacturers, equipment manufacturers, or vehicle repair shops to produce or offer compatible aftermarket parts.

Federal and State Enforcement

The REPAIR Act would be enforced by the Federal Trade Commission (FTC) pursuant to its existing unfair and deceptive trade practices enforcement authority. The FTC would also be advised by a new “Fair Competition After Vehicles Are Sold Advisory Committee.” That committee would consist of the FTC’s Director of the Bureau of Competition, the Administrator of the National Highway Traffic Safety Administration, and 11 individuals from relevant industry groups and consumer rights organizations.

The bill contains a provision preempting similar state laws, which could affect right to repair laws enacted in states like Massachusetts and Maine.

Takeaways

• As modern vehicles have increasingly become “computers on wheels,” the amount of data they generate has become immense. This data can include not only vehicle operations but also driver and occupant behavior and even biometric readings. The uses, and potential abuses, of this data have correspondingly increased. And federal and state regulators have taken an interest in curtailing the sharing and selling of this data without consent.
• The REPAIR Act is intended to remove roadblocks for independent vehicle repair shops and the aftermarket parts market, and to grant vehicle owners more control over the maintenance of their vehicle and their vehicle-generated data. The law, if enacted, would not only require vehicle data to be available to independent repair shops, but also limit manufacturers’ ability to use that data for non-repair purposes.
• Battles over the right to repair have been fought in several states that have enacted or considered similar legislation. The REPAIR Act would federalize the issue and create a uniform national standard rather than more localized requirements.
• Right to repair requirements implicate important cybersecurity questions. In 2023, the National Highway Traffic Safety Administration raised concerns about the risks posed by Massachusetts’ right to repair law, which required open remote access to vehicle telematics. NHTSA observed that “[a] malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently.”

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.