Federal law mandating ‘kill switches’ in vehicles remains intact

Attempts to defund a federal law that requires OEMs to add a “kill switch” to vehicles that detect if a driver is drunk or impaired have failed and could end up on vehicles in the near future, JD Supra reports. 

A bill introduced by Rep. Thomas Massie (R-Kentucky) failed 164-268 in January. The bill would have defunded Section 24200 of the 2021 Infrastructure Investment and Jobs Act, which directs the National Highway Traffic Safety Administration (NHTSA) to require all new passenger vehicles to be equipped with advanced drunk and impaired-driving prevention technology. 

JD Supra defines the equipment as a passive performance monitoring system that continuously observes a driver’s behavior and restricts or prevents vehicle operation if the system determines the driver may be impaired, or a blood-alcohol detection system that prevents or limits operation when BAC meets or exceeds the legal limit of 0.08%. 

The law has created Congressional debate, along with questions about privacy and data governance that businesses, fleet operators, and their legal counsel are trying to answer, JD Supra says. 

According to Section 24220, NHTSA was required to publish a rule within three years of enactment; a deadline that NHTSA has missed. 

Following publication of the rule, manufacturer compliance would be expected no later than three years after the date. 

“NHTSA is still finalizing the technical standards — a detail that matters, because the specific data collection methods will drive (no pun intended) privacy and security compliance,” JD Supra writes. “Notably, many of these features and capabilities — often embedded in devices referred to as ‘dashcams’ — have already become popular in fleet vehicles.”

JD Supra says the government won’t have access to the software, and the vehicle’s algorithms would impose operational restrictions. 

“Whether the system uses cameras, eye-tracking, biometrics, or driving pattern analysis, it is continuously collecting sensitive behavioral and physiological data about the driver,” JD Supra’s article says. “It is generated, stored — somewhere — and potentially transmitted. To whom? Under what retention schedule? With what security controls? The statute is silent. NHTSA’s rules are not yet final. The answers will depend heavily on what manufacturers build and what their privacy policies and terms of service say.”

It says that Congressional debate raised whether insurance companies or law enforcement would have access to event data without the driver’s knowledge or a warrant. 

Fleet-wide attacks could also impact the economy, the article says. 

“Simultaneously activating kill switches on millions of vehicles could shut down entire transportation networks  — supply chain disruptions from disabled commercial vehicles could affect food, fuel, and medical supply delivery. A Consumer Watchdog report estimated a fleet-wide hack could cause approximately 3,000 deaths from a single coordinated breach,” the article says. 

There are also questions about what will happen once a vehicle is disabled. It says the statute contains no provision defining how a driver challenges or overrides a lockout. 

Businesses that operate fleets should start considering legal issues now as NHTSA works on the rule, JD Supra says. 

This includes whether their business already operates similar technology. Businesses should also review what data their vehicle management agreements allow them to access, who receives it, how long it is retained, and under what circumstances it is disclosed to third parties, including law enforcement. 

HR and employment counsel should evaluate whether passive monitoring and biometric data components trigger state-level employee monitoring notification laws. 

“Section 24220 is not an isolated development,” the article says. “It reflects a broader pattern of embedded sensors and passive monitoring becoming standard infrastructure in physical environments — vehicles, workplaces, commercial buildings — generating continuous data streams about individuals going about their ordinary daily activities. The challenge, which legislatures and regulators, and businesses, are only beginning to confront, is how to govern systems that never stop collecting.”

Image

Photo courtesy of arlutz73/iStock