Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
NCHRP LRD 91 37light. In this instance, the ASDE may be ultimately held liable for such offenses as ASDE is the entity that applied for authori-zation of the AV. In August 2022, the UK Government published a new policy framework to enable the deployment of self-driving vehicles in the UK by 2025. This includes providing proposals for a com-prehensive regulatory, legislative and safety framework.452VI. BARRIERS AND CONFLICTS OBSERVEDTo contextualize and frame decision-making, Table 3 shows how Merriam- Websterâs and legal dictionaries define conflict and barriers. Table 3: Definitions: Conflict and BarrierTerm Merriam-WebsterBlackâs Law DictionaryWorld Law DictionaryConflict Noun: competitive or opposing action of incompatibles: antagonistic state or action (as of divergent ideas, interests, or persons). Verb: to be different, opposed, or contradictory: to fail to be in agreement or accordFriction that happens when incompatible parties or differences.To be incompatible (where two things cannot exist together)Barrier Noun: something material that blocks or is intended to block passage, something immaterial that impedes or separates (behavioral/trade barriers are an example)Something that prevents movement, access, understanding or communicationThis was used to frame out key areas that create a barrier or conflict to effective and efficient harmonization of legislation for L3â5 AVs. It may be preferable to use the terminology 452 Id. at 42.eral tests and pilots444 have occurred. On April 13, 2023, Fordâs BlueCruise feature (SAE L2) received regulatory approval from the Secretary for consumer deployment.445 In 2022, the Law Commissions of England & Wales and Scotland published a joint report providing recommenda-tions for a new legal framework for the safe usage of AVs. 446 The report recommended the introduction of a new Automated Vehicles Act (Act) to regulate vehicles with ADS and offer a new accountability model for vehicles that use ADS features. This model would draw a distinction between cars that are equipped with self-driving features that have the capacity for a user to take driving control (user-in-charge [UiC] vehicles) and cars that do not allow a driver to take control (no user-in-charge or NUiC vehicles). The report clarified the responsibility of legal actors: Authorized Self-Diving Entity (ASDE),447 UiC and NUiC operator. The report developed recommendations for the Highway Code448 to support the safe use of ALKS and clarify the responsibility between the driver and the vehicle. The re-port also introduced several terms and ideas to be used going forward: SAE taxonomy for automation levels, DDT, ODD, ALKS449, and alternative ways of approving AVs using the EU vehicle exemption procedures.450 The report also recommended an amendment AEVA so that vehicles with self-driving features fall under the scope of its provisions concerning civil liability. A UiC should not be held liable for any criminal offenses or civil penalties which arise from dynamic driving,451 for example, dangerous driving, exceeding the speed limit or running a red 444 UK pilots include London pilots by Oxbotica, Wayve and the Academy of Robotics, See Jasper Jolly, Itâs a long term journey weâre on: taking a ride towards self-driving cars, The Guardian, (Feb. 16, 2023), https://www.theguardian.com/technology/2023/feb/17/taking-ride-self-driving-car-nissan-servcity-autonomous-vehicles. 445 Ford BlueCruise Approved for Use on UK Roads, Ford.Com, (Apr. 13, 2023), https://fordauthority.com/2023/04/ford-bluecruise-approved-for-use-on-uk-roads/#:~:text=Ford%20just%20announced%20that%20its%20BlueCruise%20feature%20has,Level%202%20assist%20features%20for%20the%20first%20time. 446 Law Commission of England and Wales, (No 404) and Scottish Law Commission (No 258), Automated Vehicles: joint report Presented to Parliament pursuant to section 3(2) of the Law Commissions Act 1965, HC 1068SG/2022/15, Jan. 26, 2022), https://www.lawcom.gov.uk/project/automated-vehicles/. 447 Id. At 20, (ASDE is the entity that has received authorization for the automated vehicle. This can be the manufacturer or the software developer of the ADS (or a joint venture)).448 Rules on the safe use of automated vehicles: summary of responses and government response, UKG, (Apr. 25, 2022), https://www.gov.uk/government/consultations/safe-use-rules-for-automated-vehicles-av/outcome/rules-on-the-safe-use-of-automated-vehicles-summary-of-responses-and-government-response. 449 Id. At 16. ALKS references include the ALKS UN Regulation 157 approved for use in the UK (on uniform provisions concerning the approval of vehicles with regard to Automated Lane Keeping Systems) E/ECE/TRANS/505/Rev.3/Add.156 (ALKS Regulation) 214.450 Id. At 76, (5.37, referring to Art. 39 of Reg. 2018/858 and UNECE procedure in art. 12.6 and sch 7 of the revised 1958 Agreement).451 Id. §Â8.67, The âDynamic Driving Taskâ definition used here is from the SAE taxonomy J3016.
38 NCHRP LRD 91Many states have adopted SAE J3016 terminology into statute. SAE J3016 however, is not a safety standard, but a terminology standard that defines some combinations of behaviors as levels, without taking into account whether the result will be safe in practice.455 For example, a L3 AV may change into many modes over one vehicle trip.456 The ULCâs UAOVA incorporated SAE J3016 components but made changes for legal clarity to ADS, âdedicated automated vehicleâ, DDT, MRC, and âoperateâ.457 ULC in its comments to its definition of AV noted it had excluded vehicles that had only a drive assistance system, because this was designed with expectation that a human driver would monitor the road, even when the system was steering, accelerating and braking. ULC stated it was referring to AVs and ADS and auto-mated operation of these vehicles.458The main conflict with L3 AVs today is delineation of respon-sibility between the human and the ADS. In L3 the human is expected to monitor the environment with the ADS, and to be prepared to take fallback requests if the vehicle cannot engage. SAE J3016 explains what a âfallbackâ is however this term does not appear in every state law. Several state laws have attempted to delineate L3 automation capability from other levels. This matters because of the changeable role of the human driver in this level of automation. SAE L2 & 3 are problematic as defined in most state statutes because these levels often have no legal requirement in the statute for any driver monitoring. How a vehicle is defined as an AVâ with hardware and software â will affect legal rights and duties, including how personal injury, product liability and state tort law frameworks apply after a crash in the future. 2. Gap in Regulation: Level 2+ with Level 3 FeaturesAt least four manufacturers are currently making AVs and using them on public streets, even though they are really at 455 See Koopman supra note 57. 456 See SAE supra note 109.457 See UAOVA supra note 173, 2 Definitions.458 Id. §1. Comment before Definitions. âchallengesâ rather than barrier or conflict which may be per-ceived negatively. One could argue that no jurisdiction has actively set out to create a barrier â in terms of intending to block passage to AV deployment. Similarly, conflicts that arise, are in many ways a casualty of time. It takes time to make changes to law that was set up in a non-AV era. The pace of this technology, and the global nature of the automotive market requires a huge burden of dedicated time to stay up-to-date. Challenges that may exist are not insurmountable, but will require coordinated and collaborative effort to ensure efficient effective and safe mo-bility. In considering time frames for short, medium, and long terms, previous TRB research placed short term into a two-year time frame; medium term at five years, and long term as five years and beyond.453 Other research has estimated timeframes based upon fleet evolution and deployment tied to technology cost.454 Areas that create challenges for L3â5 for interstate har-monization at the short, medium and longer term are shown in Table 4. A. Barriers and Conflicts1. DefinitionsHow an AV is defined in state law is absolutely critical, as this determines what type of public deployment permissions the AV receives, the licensing level of the operator(s) human and com-puter, and the legal responsibilities of the operators. From the legal definitions in laws flow legal rights and duties.453 See NCHRP Web-Only Document 253 supra note 2, Vol 4 for example.454 For example, Kockelman et al., Nov. 2016, placed adoption between 2015-2045 based upon surveys with scenarios that had levels of technology with evolving prices. Kockelman, K, et al., Bringing Smart Transport To Texans: Ensuring The Benefits Of A Connected And Autonomous Transport System In Texas. https://library.ctr.utexas.edu/ctr-publications/0-6838-2.pdf. Table 4: L3â5 Areas of Challenge for Interstate Harmonization at the Short-, Medium- and Longer-Term Short Term Medium Term Long Term⢠Lack of standardized definitions and key terms for legal analysis⢠Vehicle registration and titling that identifies AVs⢠AV driver licensing and education and training ⢠AV dealer education standards⢠Vehicle inspection standards⢠Manufacturing and aftermarket additions standards ⢠Platooning protocols and reciprocity/agreements across state lines ⢠Interaction plans for law enforcement engagement to be developed⢠AV product liability tort frameworks⢠Cybersecurity Laws for data collection data breaches and use of data and data protection for consumers⢠Vehicle inspection and maintenance harmonization standards to reduce unsafe vehicles crossing jurisdictional lines⢠Maintenance and aftermarket adaptations including recall process are not set⢠Crash reporting protocols so technology issues can be reviewed and monitored ⢠Technical manuals for state DOTs, DMVs and local jurisdictions need updating/changes⢠Consumer protection laws for data and vehicle safety/maintenance ⢠Ensuring a system that does not impact civil and disability rights, and does not cause equity issues, or disproportionate impacts for Environmental Justice communities⢠Criminal and civil code adjustment for safe operation and crash reporting requirements
NCHRP LRD 91 39operating L3-5 AVs, not for operating L2 AVs.467 States that regu-late L3 AVs as âfully automated vehiclesâ (but not L2) are missing this safety and policy gap of L2+ that industry intends to expand upon.468 SAE J3016 does not allow for an AV to be in both levels simultaneously.469Some experts have even suggested replacing the SAE J3016 levels in state laws with four operational modes due to thorny liability questions over when and how an ADS shifts duties to the human driver. Using four operational modes of operation in state laws (testing, autonomous, supervisory, and conventional) would clarify the roles and duties of the human versus the ADS better and create legal certainty â preventing inefficient and costly court resolution to liability issues on contributory and other forms or negligence. 470For liability purposes, state laws appear to lack precise con-trol transition rules, in highly automated driving (often L3-5) for scenarios where drivers are given a short time span to respond to a request to resume manual control. Each OEM may vary on design expectations here, for example, the Mercedes-Benz Drive Pilot L3 gives the human 10 seconds to take manual con-trol471 even though studies have shown that the optimal Take-Over-Request lead time (TORlt: the lead time from a âtake-over requestâ (TOR) to a critical event, such as a stranded vehicle) may be as much as 30 seconds.472 Different drivers occupied by via acceleration and deceleration (operational); 3. Monitoring the driving environment via object and event detection, recognition, classification, and response preparation (operational and tactical); 4. Object and event response execution (operational and tactical); 5. Maneuver planning (tactical); and 6. Enhancing conspicuity via lighting, sounding the horn, signaling, gesturing, etc. (tactical).467 Id. § 8.11, âThe definition of DDT provided in 3.10 includes tactical and operational effort but excludes strategic effort this Recommended Practice defines âoperateâ to include both operational and tactical efforts.468 Lindsay Brooke (for SAE) December 24, 2020. Level 2+: Making automated driving profitable, mainstream, https://www.sae.org/news/2020/12/rise-of-sae-level-2#:~:text=The%20terms%20% E 2 % 8 0 % 9 C e n h a n c e d % 2 0 L 2 % E 2 % 8 0 % 9 D % 2 0 a n d % 2 0%E2%80%9CLevel%202-point-something%E2%80%9D%20coined,ADAS%20trend%2C%20engineers%20and%20analysts%20tell%20SAE%20International. 469 See SAE supra note 17. §Â8.4 Levels are Mutually Exclusive - The levels in this taxonomy are intentionally discrete and mutually exclusive. As such, it is not logically possible for a given feature to be assigned more than a single level. See also, 8.11, The definition of DDT provided above (3.10) includes tactical and operational effort but excludes strategic effort this Recommended Practice defines âoperateâ to include both operational and tactical efforts.470 See Widen and Koopman at supra note 28. 471 Jason Torchinsky, Mercedes-Benz Claims To Have Level 3 Automated Driving But Thereâs Still A Huge Problem, Jalopnik, (July 26, 2021), https://jalopnik.com/mercedes-benz-claims-to-have-level-3-automated-driving-1847363146. 472 See Alexander Eriksson & Neville A. Stanton, Take-over time in highly automated vehicles: non-critical transitions to and from manual control, 59(4) Human Factors Table 1 (2017), Table 1, https://www.researchgate.net/publication/312922628_Takeover_Time_in_Highly_Automated_Vehicles_Noncritical_Transitions_to_and_From_Manual_Control. L2+ due to âautomated lane changingâ: ZF (ZF CoDrive),459 SuperCruise (2022),460 Tesla (Autopilot),461 Mercedes-Benz (Drive Pilot)462. State laws do not cover L2 AV regulation, for the most part.463 This is a legal âloopholeâ or gap in the law that some AV makers are thought to exploit by allowing L2+ AVs on public roads in permissive states.464 Automated lane changing is not mere âlane keepingâ, but appears to qualify as a tactical maneuver under the SAE J3016.465 Under SAE J3016, 8.11, tactical and operational maneuvers are defined and grouped together as the DDT466 for 459 ZF Press Release, ZF coASSIST Level 2+ Automated Driving System most affordable in the Industry, (Jan 6, 2020), https://press.zf.com/press/en/releases/release_14023.html. 460 See Jordan Golson, GMâs Super Cruise getting fully automatic, hands-free lane changes and more for 2022, https://www.theverge.com/2021/7/23/22589285/gm-super-cruise-automatic-lane-change-gmc-chevy-silverado. GMC, What is Super Cruise?, https://www.gmc.com/connectivity-technology/super-cruise. Zac Palmer, Fordâs BlueCruise gains hands-free lane changes and more in update, Autoblog, (Sep. 9, 2022), https://www.autoblog.com/2022/09/09/ford-blue-cruise-update-auto-lane-changes/.461 Simon Alvarez, Teslaâs Automatic Lane Change feature faces scrutiny from German regulator, Teslarati (Feb. 21, 2022), https://www.teslarati.com/tesla-autopilot-fsd-auto-lane-change-probe-germany/.462 See Andrew Hawkins, Mercedes-Benz is the first to bring Level 3 automated driving to the US, The Verge (Jan. 27, 2023), https://www.theverge.com/2023/1/27/23572942/mercedes-drive-pilot-level-3-approved-nevada. See Scooter Doll. Mercedes-Benz Drive Pilot becomes for L3 Autonomous Driving System to be Certified for US Roads. Electrek. (Jan 26, 2023), https://electrek.co/2023/01/26/mercedes-benz-drive-pilot-sae-level-3-autonomous-driving-certified-us/. (âAccording to Mercedes-Benz, its DRIVE PILOT conditional driving system complies with the requirements of Nevada Chapter 482A for Autonomous Vehicles and is now authorized to allow drivers to hand over driving to the vehicleâ¦under certain conditionsâ¦DRIVE PILOT is currently only authorized to operate at speeds up to 40 mph.â)463 However, note that L2 AVs are federally required to report crashes to NHTSA in accordance with the SGO [Standing Gen. Order] of 2021 (order ârequires manufacturers and operators to report certain crashes involving these vehicles that occur while the ADS or Level 2 ADAS is engaged, or immediately after it is in use, and to provide sufficient information for NHTSA to identify crashes warranting further follow-up.â)464 William H. Widen & Philip Koopman, Autonomous Vehicle Regulation & Trust: The Impact Of Failures To Comply With Standards, Vol. 27 UCLA Journal of Law & Technology, No. 3, (Spring 2022) at 178.465 See SAE supra note 17, §Â8.11. âThe overall act of driving can be divided into three types of driver effort: strategic, tactical, and operational (Michon, 1985). Tactical effort involves maneuvering the vehicle in traffic during a trip, including deciding whether and when to overtake another vehicle or change lanes, selecting an appropriate speed, checking mirrors, etc. Operational effort involves split-second reactions that can be considered pre-cognitive or innate, such as making micro-corrections to steering, braking and accelerating to maintain lane position in traffic or to avoid a sudden obstacle or hazardous event in the vehicleâs pathway.â466 See SAE supra note 17, §Â3.10 Dynamic Driving Task (DDT) All of the real-time operational and tactical functions required to operate a vehicle in on-road traffic, excluding the strategic functions such as trip scheduling and selection of destinations and waypoints, and including, without limitation, the following subtasks: 1. Lateral vehicle motion control via steering (operational); 2. Longitudinal vehicle motion control
40 NCHRP LRD 91public notice on possible case law development for AV civil and criminal liability questions. Fairness to all stakeholders, includ-ing test drivers like one charged with negligent homicide478 and pedestrians like the female pedestrian who died when struck by self-driving car must dominate these questions as law and pol-icy develops to accommodate AV innovation and provide legal certainty to all parties. Whether these specifics are determined by FMVSS, an industry standard, a regulation or statutory law, these gaps in rules for responsibility will affect consumersâ tort claims, state by state. Each state has different products liability law schemes and how fault is allocated among parties: contribu-tory, pure comparative, and modified comparative479 negligence will vary state by state on statute of limitations, liability stan-dards, damage limits, presumptions, and available defenses. Fault allocations in vehicle crashes for product, vicarious and negligent liability and entrustment are very fact specific and will vary in state courts.480 3. Testing Versus Deployment: A Distinction Without a Difference?Although several states are statutorily allowing testing of AVs on public roads,481 one could argue there is not much dif-ference between AV companiesâ testing on a public road and public deployment statute for public roads. Despite being legally subjected to some geographic area limitations, time limitations, state liability requirements, and state permitting documentation requirements, AV test performing companies who are testing on open public roads are driving among other drivers, cyclists and pedestriansâwhich looks similar to full public deploy-ment. Vulnerable road users, i.e., pedestrians, those on bicycles, wheelchair users, children and older adults, are often precisely the ones who are not always easily recognized by LiDAR sen-sors or cameras systems.482 School zones, in particular, may 478 Rafaela Vasquez, the Uber test driver, was charged with negligent homicide, although the NTSB report states that the Uber ADS failed to recognize or halt the AV she was âdrivingâ. It is unknown if she received training on test driving skills in accordance with industry testing safety standard J3018, which is only required by one agency, the NYC DOT. See infra. See also Phil Koopman, Autonomous Vehicle Testing Guidance for State and City DOTs, (Sept. 12, 2021), https://safeautonomy.blogspot.com/2021/07/DOTguidance.html. 479 Each state has different product liability fault schemes: contributory (f. ex. North Carolina N.D.C.C. Sec. 32-03.2-02), pure comparative (f. ex. Alaska Stat. 09.17.080), modified comparative (f. ex. Texas Civ. Prac. & Rem. Code Ann. Sec. 33.001-33.017).480 See Widen and Koopman supra note 28. (Detailed discussion of contributory negligence and roles of human driver versus ADS as âdriverâ).481 See, Test Tracking Tool, NHTSA, (Shows where controlled testing on public roads is occurring right now. States and companies can voluntarily submit information about automated vehicles and testing to NHTSA, as part of the AV TEST Initiative. This interactive tool allows the public to view a map), https://www.nhtsa.gov/automated-vehicle-test-tracking-tool. 482 Jonah Chiarenza, et al., Optimizing Large Vehicles for Urban Environments, ADAS, USDOT Volpe Center Report for NACTO, (Dec. 2018), at 13, https://nacto.org/wp-content/uploads/2018/12/NACTO-Volpe-Optimizing-Large-Vehicles_ADAS.pdf. See also NTSB Report, a secondary task may exhibit variance on slowness of responses to resume control and regain situational awareness.473 Drivers may not respond well due to too short of a lead time in the AV software design. Without driver monitoring or auto mated enforcement of the ODD,474 inevitable âautoma-tion complacencyâ in L2 and L3 may lull human drivers into a false sense of safety in which driving blame/ responsibility shifts to the human, no matter how small that reliance on the ADS was. This scenario has been called the âmoral crumple zoneâ- 475 where the scope of human accountability for AV crashes can be algorithmically unpredictable and where liability gaps allow OEMs, designers, developers, suppliers, and owners of AVs to escape liability because of complexities in establishing when a human occupant of an automated vehicle has contributory neg-ligence for her interactions with an ADS. The moral crumple zone where AV responsibility for harm may exceed the human driverâs responsibility, but there are no set legal boundaries in the AV level 2-3 space to establish design/ warning duties, breach, causation, or damages in the case of negligent legal ac-tors. In this scenario, test drivers and crash victims alike, such as in the Uber/Herzberg crash, could unfairly and disproportion-ately bear the accident costs, and/ or civil or criminal liability476 Liability questions about who is driving and precisely when in L2+ and L3 vehicles need answers that will satisfy our federal-ist common law legal framework. Civil liability determinations, supported by current case law and regulation may be inadequate to handle harm from new life-critical, software-defined AVs in that the software industry has relied on mostly contract law, not tort law, to disclaim warranties and cap damages. Legal reform at the state level may need to occur later, once the technology is ripe enough for use and inevitable AV crash claims enter the judicial system to create case law. In the cases like the Uber/Herzberg incident, private, out-of-court settlements477 prevent 473 Id.474 See Widen and Koopman supra note 28, at 35, (citing to the Tesla Press Release, Tesla Crash Investigation Yields 9 NTSB Safety Recommendations, and NTSB (Feb. 25, 2020), https://www.ntsb.gov/news/press-re-leases/Pages/NR20200225.aspx.). 475 Madeleine Clare Elish, Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction, 5 Engaging Science, Technology, and Society (2019) at 40.476 Sean Hollister, Uber wonât be charged with fatal self-driving crash, says prosecutor, The Verge, (Mar. 5, 2019), (Uber not held criminally liable for Herzbergâs death), https://www.theverge.com/2019/3/5/18252423/uber-wont-be-charged-with-fatal-self-driving-crash-says-prosecutor. Note that Uberâs ADS failed to classify her as a pedestrian or warn its test driver, NTSB Rept., supra note 110. See AP, supra note 251. AP, Driver in fatal Uber autonomous crash set for June trial, Arizona Capitol Times, (Apr. 25, 2023), (although no criminal charges were brought against Uber, its test driver Rafaela Vasquez is bring tried on negligent homicide in Elaine Herzbergâs death), https:azcapitoltimes.com/news/2023/04/25/driver-in-fatal-uber-autonomous-crash-set-for-june-trial. 477 Connie Loizos, Uber has settled with the family of the homeless victim killed last week, Techcrunch, (Mar. 29, 2018), (note that the private Uber settlement predated the NTSB report on the crash which listed contributing factors), https://techcrunch.com/2018/03/29/uber-has-settled-with-the-family-of-the-homeless-victim-killed-last-week/.
NCHRP LRD 91 412021 and May 15, 2022, including six fatal incidents.491 One can see the difference between the L2 and L3 results here, but many factors are involved, such as volume of AVs on the road, vol-ume of passengers, and time and geographical limits on L3 use on public streets. As more AV makers seek and achieve access to more public roads,492 adding to the existing AVs on public roads,493 the traffic mix will change and safety may become a challenge for local jurisdictions, especially for emergency re-sponders494 and law enforcement.495 There is no specific tort case law containing principles for allocating fault and liability among all the parties. It will depend on which tort liability framework a state imposes (Comparative fault, contributory negligence, strict liability, consumer expectation) and what defenses exist in that state (compliance with government standards,496 seatbelts, alcohol, assumption of risk, misuse, alteration, inherently unsafe products, state of the art, sophisticated user, and presumption). Although several state laws prohibit aftermarket alterations of ADS-equipped AVs,497 questions have arisen about a new state legislative push to allow residents a âright to repairâ electronics and vehicles. For example, a litigated, recent Massachusetts law required vehicle manufacturers to add standardized open access data platforms to telematic-equipped vehicles sold there, so that vehicle owners and independent shops could access the data.498 NHTSA claims that this law conflicts with the Safety Act and creates cybersecurity issues. This has created vital federal-ism questions which have implications upon how AVs may be 491 See NHTSA supra note 128, Summary Report: Standing General Order Report on Crash Reporting for Level 2 Advanced Driver Assistance Systems.492 Kristen Korosec, Zoox robotaxis start rolling out on California public roads, TechCrunch (Feb. 13, 2023), (Zoox autonomous robotaxis without steering wheels are moving from semi-private roads to carrying its employees on public roads), https://techcrunch.com/2023/02/13/zoox-robotaxis-start-slowly-rolling-out-on-california-public-roads/. Kevin Truong, Robotaxi Service Expansions in San Francisco Delayed by State Regulators, The San Francisco Standard (Jun. 27, 2023), https://sfstandard.com/business/vote-to-expand-cruise-waymo-robotaxis-in-san-francisco-delayed-amid-growing-pushback/. 493 Rhian Hunt, GM Cruise Rival Zoox Now Operating Robotaxi On California Roads, GM Authority, (Feb. 14, 2023), (GM Cruise started providing free rides to the public in January 2022 and charged fares starting in June 2022), https://gmauthority.com/blog/2023/02/gm-cruise-rival-zoox-now-operating-robotaxi-on-california-roads/. 494 Adrian Marshall, An Autonomous Car Blocked a Fire Truck Responding to an Emergency, Wired (May 27, 2022), https://www.wired.com/story/cruise-fire-truck-block-san-francisco-autonomous-vehicles/. 495 Pete Bigelow, San Francisco Feeling left out of Conversation about Avs, Automotive News, (Jul. 31, 2022), https://www.autonews.com/mobility-report/san-francisco-seeks-greater-av-voice-amid-cruise-friction. 496 The question of government standards persists as NHTSA amends crashworthiness and other standards. 497 Supra note 229 NCSL database on AV Legislation.498 Phil Tenser, NHTSA carmakers to disregard Massachusettsâ voter-approved âRight to Repairâ law, WCVB5, (June 15, 2023), https://www.wcvb.com/article/nhtsa-letter-ignore-massachusetts-right-to-repair-law/44209519#. need special regulation as they are unsuitable places for Level 2-3 automated feature operation, due to the proximity of many child pedestrians and bicyclists who are both vulnerable and more unpredictable than the average road user.483FHWA has re-cently announced 484 that §Â11135 of Infrastructure Investment and Jobs Act directs USDOT to update the Manual on Uniform Traffic Control Devices (MUTCD) by no later than May 15, 2023 to provide for the protection of vulnerable road users. Recent reports of crashes involving testing or otherwise limited-use vehicles on public roads are appearing in news,485 and in reports issued by California 486 and NHTSA.487 NHTSA has opened safety probes into these highly autonomous vehicles using public roads.488According to the Federal SGO data,489 there were 130 crashes reported for ADS-equipped (L3) vehicles, among 25 companies, between July 13, 2021 and May 15, 2022, with one resulting in a serious injury and 108 had no injuries.490 For ADAS-equipped (L2) vehicles, there were 392 crashes reported between July 20, supra note 103, at 16 (Uber ADS ânever classified her [Herzberg] as a pedestrianâ or correctly predicted her pathâbecause she was crossing ⦠without a crosswalk, and the system design did not include consideration for jaywalking pedestrians.â) 483 Laura Sandt and Justin Owens, Discussion Guide for Automated and Connected Vehicles, Pedestrians, and Bicyclists, Pedestrian and Bicycle Information Center (PBIC), (August 2017), at 8, Chapel Hill, NC.484 FHWA, MUTCD News Feed, (March 2, 2022), https://mutcd.fhwa.dot.gov/mutcd_news.htm.485 Brad Templeton, Cruise Cars Crash Into San Francisco Muni Bus and Tangle In Fallen Trolley Wires, Forbes (Mar. 23, 2023), https://www.forbes.com/sites/bradtempleton/2023/03/24/cruise-cars-crash-into-san-francisco-muni-bus-and-tangle-in-fallen-trolley-wires/?sh=4bba6e1937bd. 486 Brad Templeton, Cruise DMV Crash Report Suggests Their Car At Fault In Hitting Bus, Forbes (Mar. 31, 2023), (Cruise AV in autonomous mode rear ended a San Francisco Muni bus on Mar. 22, 2023, according to a DMV report), https://www.forbes.com/sites/bradtempleton/2023/03/31/cruise-dmv-crash-report-suggests-their-car-at-fault-in-hitting-bus/. See also California DMV has received 577 Autonomous Vehicle Collision Reports as of Apr. 3, 2023, https://www.dmv.ca.gov/portal/vehicle-industry-services/autonomous-vehicles/autonomous-vehicle-collision-reports/. 487 See NHTSA supra note 122, Report released on June 15, 2022 with SGO data, https://www.nhtsa.gov/sites/nhtsa.gov/files/2022-06/ADS-SGO-Report-June-2022.pdf. 488 E.g., NHTSA, Office of Defects Investigation, Preliminary Evaluation, (formal safety probe opened of GM Cruise after 3 crashes, with multiple reports where GM Cruise AVs were immobilized without human supervisor onboard, stranding passengers, possibly blocking emergency vehicles, and reports of excessive braking and 2 injuries), https://static.nhtsa.gov/odi/inv/2022/INOA-PE22014-4871.PDF. See also Trey Hawkins, NHTSA Opens Safety Probe Regarding GMâs Cruise AVs, (December 16, 2022), https://gmauthority.com/blog/2022/12/nhtsa-opens-safety-probe-regarding-gms-cruise-avs/. 489 Id.490 Nearly 400 car crashes in 11 months involved automated tech, companies tell regulators, National Public Radio (June 15, 2022), https://www.npr.org/2022/06/15/1105252793/nearly-400-car-crashes-in-11-months-involved-automated-tech-companies-tell-regul.
42 NCHRP LRD 91own safety standards.503 When issues arise as to whether state law claims are preempted by the NHTSA, express and implied preemption issues can complicate this unclear legal arena. As AVs deploy on public roads, the absence of a federal standard specific to an AV device may create confusion as to whether common law tort claims are wiped out,504 although NHTSA retains for states the state domain over common law claims.505 More clarity may be needed in the future as to when federal standards expressly preempt state law claims, especially if courts must struggle with how software fits into ânegligent designâ case law versus design defects506 in strict liability claims. NHTSAâs existing FMVSS sets minimum performance re-quirements for vehicles and equipment, are a long established performance-based, objective, practice with precise and re-peatable test procedures.507 If the FMVSS are written in terms of minimum safety performance requirements and NHTSA allows exemptions508 for safe motor vehicle and/or equipment performance, states may need clarity on how their regulatory roles and policy objectives will be defined as the technology and automation changes. Questions about jurisdiction doc-trines and whether plaintiffsâ state law claims are preempted by federal law may get complex. As ordinary consumers ex-pect technology to perform, consumer expectations may cre-ate issues from manufacturerâs defendants in states that follow the âconsumer expectations testâ for product liability claims509 503 Freightliner Corp v. Myrick 514 U.S. 280, 286 (1995). Where no express, minimum, objective federal motor vehicle safety standard is âin effectâ, states remain free to âestablish, or to continue in effect,â their own safety standards concerning those âaspect[s] of performanceâ. Citing §Â1392(d), which was in 1994, Pub. L. 103-272, §Â7(b) and was later restated in the revised title, 49 USCS §Â30101 et seq.). See also 49 USCS §Â30103(b)(2).504 Id.; See also on preemption topic, Geier v. Am. Honda Motor Co., Brief for the Chamber of Commerce of the United States of America as Amicus Curiae, Nov. 19, 1999 at 20 (arguing that âcommon-law decision-making is notoriously ill-suited to the establishment of nationwide standards that strike the proper balance among the multitude of societal interests at stake in a particular regulatory settingâ). 505 49 USCS § 30103(e) Common Law Lability. Note that this common law liability was preserved in the AV START Act supra note 142.506 States differ on which party bears the burden of proof to establish existence of a design defect. See F. Patrick Hubbard & Evan Sobocinski, Crashworthiness: The Collision of Sellersâ Responsibility for Product Safety with Comparative Fault, 69 S.C. L. Rev. 741, 762 (2018), (â[S]tates may agree on a substantive rule but disagree, on who has burden of proof on design defect.â).507 49 U.S.C. 30111(a); Chrysler Corp. v. Depât of Transp., 472 F.2d 659 (6th Cir. 1972); Natâl Tire Dealers & Retreaders Assân, Inc. v. Brinegar, 491F.2d 31 (D.C. Cir. 1974); Paccar, Inc. v. Natâl Highway Traffic Safety Admin., 573 F.2d 632 (9th Cir. 1978).508 49 U.S.C. §Â30114 Special exemptions.509 See Restatement (Second) of Torts §Â402A Special Liability of Seller of Product for Physical Harm to User or Consumer, Restat. 2d of Torts, §Â402A available at https://advance-lexis-com.ezproxy.lib.utexas.edu/api/document?collection=analytical-materials&id=urn:contentItem:42JH-HP90-00YF-T0JF-00000-00&context=1516831. States that currently adhere to the âconsumer expectationsâ doctrine are Alaska, California, regulated in the future. It is possible that state law on joint and several liability and on fault allocation will vary by jurisdiction - creating unpredictable and conflicting case law. a. Driver EducationIf states shift driver education role onto dealers and driver manuals, there is no data to determine how states may manage driver confusion over the difference between ADAS499 partial driving automation (L0-2) and ADS (L3-5). Tech companies have suggested that new Artificial Intelligence features on AVs may be deployed through software updates in the future, which could mean that automation levels could change according to over-the-air software, not hardware changes.500 A further conflict arises when the driver is the equipment (ADS) and the equipment is regulated traditionally by the fed-eral government. A draft federal AV bill includes a rule making federal role for consumer education on the capabilities and limitations of the AV systems, including any changes to these capabilities that may result from, software updates, including over-the-air updates.501 4. Safety StandardsStates enforce safety in variety of ways, but not necessarily across states in uniform ways. Safety is a shared domain be-tween the federal and state governments.502 How this will evolve with AVs may be complicated by questions of preemption. Under federal law, states may impose higher safety standards with limits.Although the FMVSS preempt state legislative authority in various ways, the negligent design case law states that in ab-sence of a direct FMVSS regulation, states may establish their 499 ADAS is an âadvanced driver assistance systemâ. The generic term âdriving automation systemâ refers to any L1â5 system. Individually, Tesla Autopilot subsystemsâsuch as Traffic-Aware Cruise Control (TACC), which provides longitudinal vehicle motion control; and Autosteer, which provides lateral vehicle directional controlâare considered L1 systems. When Autopilot is active and multiple subsystems like TACC and Autosteer are combined to provide both lateral and longitudinal vehicle motion control, the system is considered L2 driving automation. For more see SAE supra note 17.500 Matthew Beecham, Solutions for self-driving cars Q&A with NVIDIA, Just-Auto Global News, (Apr. 8, 2022), https://advance-lexis-com.ezproxy.lib.utexas.edu/api/document?collection=news&id=u r n : c o n t e n t I t e m : 6 5 7 D - G H 2 1 - J D N W - 4 0 4 2 - 0 0 0 0 0 -00&context=1516831. 501 Politico, House AV Discussion Draft bill, dated Mar. 14, 2023 (unnumbered, âTo amend title 49, United States Code, to provide for updated and new motor vehicle safety standards and regulations for highly automated vehicles and partially automated vehicles, and for other purposes.â), https://subscriber.politicopro.com/f/?id=00000186-e1f5-db28-afa7-ebf5f80f0000, (although the draft says â117th Congress,â it is dated Mar. 14, 2023, beyond 117th Congress end date of Jan. 3, 2023.)502 For more, see 23 U.S.C. §Â402 Highway Safety Programs, which details various tasks a State shall pursue in fulfilling its requirements for a Highway Safety Program. (Includes reducing injuries and deaths, encouraging proper use of occupant protection devices, and other tasks that parallel traditional state police powers in the transportation realm.)
NCHRP LRD 91 43federal government has not adopted the vehicle type-approval regulation of EU countries like Germany,516 which means that it may be more permissive in allowing OEMs to test level 3 â 5 AVs on public roads in the USA.As noted in section 4 several states have already banned the ability for local government or political subdivisions to control or regulate AVs.517 There are legal and policy reasons for and against this municipal preemption. As more AVs are on public streets, more incidents occur. For example, a Cruise AV recently stopped on streetcar tracks, blocking public transit in downtown San Francisco, which halted the N Line until a Cruise employee arrived to move the AV. In April, a Cruise vehicle blocked a fire engine in route to a three alarm fire.518 And recently, a Waymo AV hit and killed a dog, and in another incident a firefighter had to smash the window of a Cruise AV to keep it from edg-ing into an emergency scene.519 Incidents like these demonstrate that local input and a local law enforcement plan on how to react and move AVs out of the way may be required. The California Public Utility Commission (CPUC) will deliberate approving a 24-hour deployment permit expansion of Cruise and Waymoâs robotaxis in San Francisco on July 13, 2023. 520 Local officials protesting521 this expansion criticized the 516 Type approval of vehicles, European Commission, https://single-market-economy.ec.europa.eu/sectors/automotive-industry/t e c h n i c a l - h a r m on i s at i on / f a q - t y p e - approv a l - v e h i c l e s _en#:~:text=Type%20approval%20describes%20the%20process%20applied%20by%20national,cars%20that%20are%20equal%20to%20the%20final%20product. 517 Including Tex. Transp. Code Sec. Ann. 545.452; 625 Ill. Comp. Stat. Ann. 5/11-208(e-10) (West 2019); 106, Tex. Transp. Code Ann. §Â545.452(b) (West Supp. 2018); 107 Tenn. Code Ann. §Â55-30-105 (2017); 108 N.C. Gen. Stat. Ann. §Â20-401(i) (West 2018).518 See David Zipper, Self-Driving Taxis Are Causing All Kinds of Trouble in San Francisco Theyâve blocked traffic, driven on the sidewalk, sped away from copsâand the city is powerless to stop them, Slate, (Dec. 8, 2022), https://slate.com/technology/2022/12/san-francisco-waymo-cruise-self-driving-cars-robotaxis.html. 519 Kevin Truong, San Francisco Transit Chief Blasts Cruise, Waymo Robotoaxis as Unsafe: âRace to the Bottomâ, The San Francisco Standard, (Jun. 7, 2023), https://sfstandard.com/transportation/san-francisco-transit-chief-blasts-cruise-waymo-robotaxis-unsafe/. 520 Kevin Truong, Robotaxi Service Expansions in San Francisco Delayed by State Regulators, The San Francisco Standard, (Jun. 27, 2023), https://sfstandard.com/business/vote-to-expand-cruise-waymo-robotaxis-in-san-francisco-delayed-amid-growing-pushback/. 521 Letter to California PUC, San Francisco Comments on The Draft Resolution Approving Authorization for Waymo Autonomous Vehicle Passenger Service Phase 1 Driverless Deployment Program (May 31, 2023), (concerning CPUC Draft Resolution TL-19144 (Waymo) and Order Instituting Rulemaking on Regulations Relating to Passenger Carriers, Ridesharing, and New On-Line-Enabled Transportation Services R.12-12-011 (Filed May 31, 2012), https://sfstandard.com/wp-content/uploads/2023/06/SF-Comments-on-Waymo.pdf. See also prior protest letter to CPUC from San Francisco Municipal Transportation Agency and the San Francisco County Transportation Authority, dated Jan. 24, 2023, https://www.sfmta.com/sites/default/files/reports-and-documents/2023/01/2023.01.25_ccsf_23.0125_cpuc_cruise_tier_2_advice_letter_protest_002.pdf. (a product is defective in design if it fails to perform as safely as an ordinary consumer would expect). How a AVs âdesign intentâ factors in to state law automation levels may create conflicts as courts examine a productâs âintended useâ and its âintended usersâ. 510 B. State Police PowersConflicts will also emerge with state preemption of local AV regulation of traffic and safety. Local governments need to be able to adapt AV operational restrictions to local conditions and events and not be in conflict with this law. Construction zones, in particular, appear to be problematic for unmanned AVs.511 Without this ability to control local traffic conditions, a munici-palityâs autonomy and jurisdictional interests are challenged. If an ADS-equipped AV becomes incapacitated and stops (MRC or system failure)512 in rush hour, local law enforcement and government need to be able to resolve the problem in real time without consulting the state government.513Several AVs being âtestedâ on public roads and high-ways have had crashes.514 FMVSS rely on manufacturer self- certification, so manufacturers self-certify their AVs.515 The US and New Jersey. The Consumer Expectations test looks at the product from the perspective of an ordinary consumer and asks whether the danger posed by the defective design is greater than the danger an ordinary consumer would have expected when using the product in an intended or foreseeable way.510 Bruce Ottley, Rogello Lasso, and Terrence Kiely, Understanding Products Liability Law. at 135, LexisNexis, (2006).511 Joe Lorio, Waymo Autonomous taxi has to be rescued when confused by construction, Autoblog (May 14, 2021), (Waymo van with passenger became confused by a construction zone cones in 2021, partially blocking traffic, requesting a roadside assistance. See video at 12:30. A construction worker asks the rider to move the car, but he cannot. The human had to complete the ride.), https://www.autoblog.com/2021/05/14/waymo-self-driving-taxi-video/. Phil Mayer, Self-driving car stops at SF construction site, Waymo responds, KRON4 (Jan. 16, 2023), (Waymo AV pulled up to a trench at a construction site and stopped) https://www.kron4.com/news/bay-area/self-driving-car-stops-at-sf-construction-site-waymo-responds/. 512 See SAE supra note 109 §3.11 Failure Mitigation Strategy, p.10.513 Matt Shipman, Study Highlights Complicated Relationship Between AI and Law Enforcement, NC State University, (âofficers will need to know how to proceed if they pull over a vehicle being driven autonomously for a traffic violation⦠they will need to know how to pull over a vehicle being driven autonomously. Because of their role in maintaining public order, itâs important for law enforcement to have a seat at the table in crafting these policies.â), https://news.ncsu.edu/2023/03/ai-and-law-enforcement/. 514 Andrew Hawkins, TuSimple reportedly tried to pass off a self-driving truck crash as âhuman errorâ, The Verge, (Aug. 4, 2022), (TuSimple autonomous semi-trailer truck, while âtestingâ on public highway, crashed into a concrete highway divider narrowly missing other vehicles around it. The crash occurred ostensibly because the operator hadnât properly rebooted the ADS before engaging it, causing it to execute an âoutdated command.â), https://www.theverge.com/2022/8/4/23288794/tusimple-self-driving-truck-crash-investigation. 515 See VSSA or Voluntary Self Assessments, suggested by NHTSA for AV Regulation, https://www.nhtsa.gov/automated-driving-systems/voluntary-safety-self-assessment.
44 NCHRP LRD 91type of policy removes direct voter accountability and respon-siveness at a local level, and removes ability of local government to manage local streets and curb irresponsible behavior by AV developers.530 This trend may be changing, as seen in the pas-sage of Pennsylvaniaâs HB 2398 that became law in 2020. There is also the potential conflict that may emerge around FMVSS standards surrounding AV performance. The NHTSA currently expressly preempts States from issuing any standard that regulates performance if that standard is not identical to an existing FMVSS regulating that same aspect of performance.531 Conflict may arise when the system is faced with human prob-lems of suspended or revoked licenses due to very serious offenses (e.g., leaving the scene of an accident) and the owner/operator (who was nowhere near the incident) cannot be a true witness to what happened despite holding the full responsibility for traffic violations. Splitting legal responsibilities, testimony and neces-sary evidence between the nonhuman system performance and the human owner/operator performance may be more complex in the case of fatal accidents than the law can handle under cur-rent preemption status between the federal and state government.Federal bill drafts have used,532 preemption language pre-venting state or political subdivisions from enforcing, prescrib-ing or regulating the design, construction, or performance of HAVs, ADS, or components of an ADS with respect to Title 49 USC. However, Congress has been wrestling with this problem of preempting local and state control and regulation of AVs with five senators commenting:The bill indefinitely preempts state and local safety regulations even if FMVSS are never developed. Placing a sunset on this interim pre-emption provision would encourage collaboration with federal regu-lators and maintain a firm timetable for new safety standards, which will have their own preemptive effect.533against local government preemption on AV regulation). See also Autonomous Vehicles: Promises and Challenges Of Evolving Automotive Technologies before the U.S. House of Representatives Committee on Energy and Commerce Subcommittee on Consumer Protection and Commerce (Feb. 11, 2020), (Statement of Jeffrey P. Tumlin, Director of Transportation, SFMTA, https://docs.house.gov/meetings/IF/IF17/20200211/110513/HHRG-116-IF17-Wstate-TumlinJ-20200211.pdf. 530 See Koopman, supra note 57.531 49 U.S.C. §Â30102(b)(1).532 SELF Drive Act, H.R. 3388, 115th Cong. 2017, (passed House amended Sept. 6, 2017) https://www.congress.gov/bill/115th-congress/house-bill/3388 would expressly preempt state regulation of design, construction or performance of AVs despite leaving to the states their control over safety, emissions inspections, collision investigations, traffic laws, congestion management, driver education, licensing, vehicle registration, insurance, and law enforcement. See supra note 126; and see Politico, House AV Discussion Draft bill, dated Mar. 14, 2023, unnumbered, (see Sec. 3(b); Bill was meant to amend title 49 USC, dding a new section 30130 with updated and new motor vehicle safety standards and regulations for highly automated vehicles and partially automated vehicles), https://subscriber.politicopro.com/f/?id=00000186-e1f5-db28-afa7-ebf5f80f0000. 533 Letter to Chairman Thune and Senator Peters from Five Senators (Mar. 14, 2018, (voicing concerns with the AVSTART Act), https://www.feinstein.senate.gov/public/_cache/files/f/1/f168c367-bec0-48cc-9220-6a13cbd9dd27/D00752809320841613B5F03BB8517FC2.03.14.2018-av-start-act-letter.pdf. safety of Waymoâs operations 522 requesting CPUC modify the Draft Resolution on Waymoâs AV permit to approve only limited service hours, geographic area, and fleet size.523 They further noted that:â¦[Waymoâs moving] violations, show that their AVs are currently a developmental technology not ready for unconstrained commercial deployment. California law provides no mechanism for state/local law enforcement officials to issue citations for AV moving violations. Moving violations that would prevent a human applicant from ob-taining a driverâs license have no apparent consequence for Waymo LLC. State law provides no mechanism for moving violations com-mitted by AVs to offer a path toward revocation of the privilege to drive on public roads. Under these circ*mstances, the Draft Resolu-tionâs unlimited approval of the Expansion Advice Letter abrogates CPUCs responsibility to protect public safety.524San Francisco has also seen the Street Rebel group using cones to confuse and stop self-driving robotaxis during the summer of 2023.525 Excluding local stakeholders and emergency responders concerns can create problems when industry seeks expansion of a permit or an ODD.526 Much discussion has occurred about impaired/drunk AV âdriversâ someday not needing to worry about driving home. However, AV users also need to understand the limits of their own vehicles and be able to respond to law enforcementâs demands if the AV violates traffic rules in an unsafe situa-tion. For example, a driver in a Tesla (Autopilot is L2 with L3 features)527 fell asleep on Hwy.101 in Palo Alto and the California Highway Patrol tried for seven miles to get the driverâs attention and stop the vehicle, ending up blocking the car with the patrol vehicle to force the Tesla to stop, whereupon the human driver was arrested for DUI.528 Although the AV industry may enjoy the certainty these municipal preemption clauses in state laws that protect AVs from local control, there are safety and policy reasons to not allow this wholesale local preemption.529 This 522 Id., Comments at 4. ââ¦Waymo driverless AVs have committed numerous violations that would preclude any teenager from getting a California Driverâs License.â523 Id. at 6.524 Id. at 9.525 Rebecca Bellan, Robotaxi haters in San Francisco are disabling the AVs with traffic cones, TechCrunch, (July 6, 2023), https://techcrunch.com/2023/07/06/robotaxi-haters-in-san-francisco-are-disabling-waymo-cruise-traffic-cones/. 526 See supra note 519.527 Some have argued that, by having Tesla customers driving on public roads with FSD (Full Self Driving) software, this is actually an illegal beta testing of level 4 on public roads with untrained drivers, see William Widen and Philip Koopman, Do Tesla FSD Beta Releases Violate Public Road Testing Regulations?, Jurist (Sept. 27, 2021), https://www.jurist.org/commentary/2021/09/william-widen-philip-koopman-autonomous-vehicles/. 528 Timothy B. Lee, It took seven miles to pull over a Tesla with a seemingly asleep driver, arstechnica (Nov. 30, 2018), https://arstechnica.com/tech-policy/2018/11/cops-pull-over-tesla-cruising-on-a-freeway-with-apparently-asleep-driver/.529 Chris Teale, Officials: Federal AV law should not stop cities from regulating tech, Smart Cities Dive (Feb. 12, 2020), https://www.smartcitiesdive.com/news/federal-autonomous-vehicle-law-congress-preemption/572129/, (AV Congressional hearing included testimony
NCHRP LRD 91 45ing a system failure due to transmission problems, or the ADS may fail to send alerts to the remote driver at all.538 Remote operation creates a new path for seller negligence in which the product must not be unreasonably dangerous during normal use. Manufacturers who install industry-standard automation technology may benefit from state of the art defenses. b. AV Software and OTA Updates: A Service or a Product?The question of whether software is considered a product or service539 persists. EU law540 has attempted to examine this, but the US tort law system may not be prepared for this, because the answer determines the application of product liability to software defects moving forward. In 2022, the European Com-mission began to reevaluate how their current product liabil-ity frameworks will handle AI and AV related product liability claims in the future541, expanding the definition of âproductâ to include software and AI-enabled products and systems and compensable âdamageâ to specifically include AI components. This proposed revision also includes language about remote software updates by the developer after selling the product.542The Restatement of Torts does not consider services to be products.543 Yet, AVs are mostly driven by life-critical software, similar to how medical products in the body affect lives. The US legal system has just begun to really examine the ques-tion of whether software is a product544 or not545 with plaintiffs 538 Id.; see also Koopman, supra note 57.539 Study on Emerging Issues of Data Ownership, Interoperability, (Re-)Usability and Access to Data, and Liability, at 119, SMART number 2016/0030, (Apr. 25, 2018), https://op.europa.eu/en/publication-detail/-/publication/74cca30c-4833-11e8-be1d-01aa75ed71a1/language-en [hereinafter Study on Emerging Issues]. 540 See EU PLD (Product Liability Directive), Directive 85/374/EEC, of 25 July 1985 on the approximation of the laws, regulations and administrative provisions of the Member States concerning liability for defective products, 1985 O.J. (L 201), 29. Art. 2 applies to AVs and attempts to harmonize EU law.541 Davis Wright Tremaine LLP, Nov. 25, 2022, European Commission Proposes AI-Related Revisions to EU Product Liability Directive, Newstex Blogs JD Supra, November 25, 2022 Friday, available at https://advance-lexis-com.ezproxy.lib.utexas.edu/api/document?collection=news&id=urn:contentItem:66Y5-MB41-F03R-N32W-00000-00&context=1516831. 542 Id. Citing to the Sept. 28, 2022, Proposal for a Directive of the European Parliament and of the Council on Liability for Defective Products https://ec.europa.eu/transparency/documents-register/detail?ref=COM(2022)495&lang=en. See also EU Product Liability Directive 85/374/EEC, https://osha.europa.eu/en/legislation/directives/council-directive-85-374-eec (last update April 10, 2017).543 Restatement Third of Torts: Prods. Liab. §Â19(b) (Am. Law. Inst. 1998).544 Holbrook v Prodomax Ltd., No. 1:17-cv-219, (W.D. Mich. Sept. 20, 2021). (Decision held that software was either a product itself, or a component part of an assembly line in a negligence claim against the designer and manufacturer of software that automated an assembly line that allegedly caused the plaintiff âs death. Thus, this court recognized software as a product for purposes of state product liability law.)545 Rodgers v. Christie, 795 Fed. Appx. 878, Third Circuit L.A.R. 34.1(a) Mar. 6, 2020, (Dismissal. Held AI algorithm is not a product. 1. LiabilityIn terms of liability, so far, the state regulatory effort appears to ignore the granular liability questions surrounding ADS as driver, and instead focuses on automation levels and technical terms. These important questions about human contributory negligence and comparative fault among legal actors in a crash may not fit the new paradigm being imposed by new state AV laws. Questions remain about the duties of the human driver (if there is a steering wheel) and about the user-in-charge534 or occupant or passenger (in the AV case of no available steering controls or brakes). Since the inherent problem in L3 remains, (i.e., âwho is the real driver?â), some experts suggest new legal actors with certain legal roles. Phillip Koopman and William Widen have recommended a new statutory legal category for the ADS as a âComputer Driverâ for legal (negligence) and product liability purposes with the legal standard of âreasonable manâ as a factor.535 This alternative ap-proach theoretically provides the least amount of disruption to the existing legal doctrine / framework536 in which the state regu-lates the human driver and the federal government focuses on regulating the vehicle and equipment. Whether a new legal actor is introduced or not, governments will need to determine how state law on tort liability will interact with the federal domain of regulating the equipment on an AV.a. Remote DriverThe remote driver is a legal quandary with liability and ac-countability issues to be resolved given the problematic duties assigned to this driver. Lack of physical vicinity to the vehicle could make visual and auditory cues hard to receive.537 Plus, there could be delays in receiving the alerts from the AV in dur-534 New term/legal actor coined by the UK Law Commission. See Law Commission of England and Wales, (No 404) and Scottish Law Commission (No 258), Automated Vehicles: joint report Presented to Parliament pursuant to section 3(2) of the Law Commissions Act 1965, HC 1068 SG/2022/15 (Jan. 26, 2022), https://www.lawcom.gov.uk/project/automated-vehicles/, (â2.44 The user-in-charge is âa human in the driving seat while a vehicle is driving itself.â i.e., an individual in the vehicle and in a position to operate the driving controls while an ADS feature is engaged. 2.45 The user-in-charge must be qualified and fit to drive, as they may be called on to take over driving if the ADS issues a transition demand. While the ADS feature is engaged, the user-in-charge is not responsible for dynamic driving. They do not control the vehicle through steering, accelerating or braking, and do not need to monitor the driving environment. They cannot be held liable for criminal offenses which arise from these activities.â)535 William H. Widen and Philip Koopman, Winning the Imitation Game: Setting Safety Expectations for Automated Vehicles, (April 25, 2023), https://ssrn.com/abstract=, at 7.536 Supra note 18 at 13, and William H. Widen and Philip Koopman, The Awkward Middle for Automated Vehicles: Liability Attribution Rules When Humans and Computers Share Driving Responsibilities, University of Miami Legal Studies Research Paper No. 4444854, (May 10, 2023), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4444854.537 Especially in events one can âfeel âsuch as a tire blowout, See AV Safety with a Telepresent Driver or Remote Safety Operator, blog, Oct. 21, 2022), Philip Koopman, http://safeautonomoy.blogspot.com/2022/10/av-safety-with-telepresent-driver-or.html.
46 NCHRP LRD 91injury, property damage, or pain and suffering resulting from the intended use of an unsafe or defective product. How will AV cases incorporate the three theories of legal recovery under product liability law: Recovery under Manufacturerâs Defect, Recovery under Insufficient/Unclear warnings or instructions, and Recovery under Design Defect is not yet known. State product liability claims cases often reach settlement before any substantive rulings,550 further hampering development of useful case law in a new emerging area of law, such as that of liability for personal injury due to problematic hardware or software in AV crashes. As AV software failures become the basis for product liability claims in which consumers over-rely or trust the ADS to drive the car551, courts will examine all three types of product defects: design, manufacturing and marketing defects. Design defects claims will necessarily attack the manufacturerâs own design standards and the self-regulation system currently in place.2. Product Liability a. Vehicles and Tort Law GenerallyTort law falls into three categories: intentional, negligent (including failure to obey traffic rules causing an accident), and strict liability (including product liability/manufacturing a de-fective product).552 The law allocates liability for vehicle crashes using legal definitions and tests defined in statutes, regulations and case law that has evolved over centuries as transportation modes have evolved. Many legal experts have proposed novel systems to allocate AV negligence553 and product liability in the new era of automated vehicles, however the lack of pervasive, real public deployment of HAV, means these legal schemes have yet to be tested significantly in courts.550 For example, Yinling v. GM, W. Dis. PA 3:14-cv00116(39) (before the case went to trial, GM agreed to a confidential settlement with the plaintiff in a wrongful death suit related to an extensive Feb. 2014 recall of defective ignition switches. The claim was that the ignition switch defect shut off the engine seconds before the crash, causing the driver to lose control of the vehicle.) See also GM settles bellwether ignition lawsuit avoiding trial, AFP, (Apr. 8, 2016), https://sg.news.yahoo.com/gm-settles-bellwether-ignition-lawsuit-avoiding-trial-174055358.html. 551 We cannot have technology and sales take over safety: Tesla is being sued again for a deadly Autopilot crash, Business Insider (Aug. 2, 2019), https://www.businessinsider.com/tesla-sued-family-jeremy-beren-banner-autopilot-crash-2019-8. (Jeremy Banner case against Tesla, 2018 fatality.)552 Tort, Cornell Law School, Legal Information Institute, https://www.law.cornell.edu/wex/tort.553 Abraham, Kenneth S. and Rabin, Robert L., Automated Vehicles and Manufacturer Responsibility for Accidents: A New legal Regime for a New Era, 105 Va. L. Rev. 127, 148 (2019), https://ssrn.com/abstract=3151133 or http://dx.doi.org/10.2139/ssrn.4444854. https://virginialawreview.org/articles/automated-vehicles-and-manufacturer-responsibility-accidents-new-legal-regime-new/; Widen and Koopman supra note 35; Widen and Koopman supra note 28, and Koopman and Widen, supra note 246. sometimes suing software companies under negligence theories rather than strict liability. If AV technology is classified as a service, it can be subject to the negligence rules on proof of causation â leaving the average consumer to prove highly tech-nical facts about algorithms.Note that an expert or professional, especially a licensed one, will be held to even a higher professional standard of care estab-lished within the field. Professional negligence is the term that applies to the care used by members of a profession (medicine, engineering) in the course of providing professional services. Negligence is a failure to exercise the care and skill that is ordi-narily exercised by other members of the said profession in per-forming professional services under similar circ*mstances. This arena will get interesting as the human gets blamed for perhaps poor human/ machine interface design or essentially software type problems.How software will be deemed by courts in AV cases: either as an intangible product546 or as a tangible manufactured product,547 will matter. The Uniform Commercial Code (U.C.C.) may be ill equipped to handle complex AV crashes and resulting tort liability claims with related personal injury recovery under state laws. Already, several claims have been filed against Tesla and GM based upon software.548 If software is not tangible, a court might find that manufacturing defect theory is not appli-cable to software or its errors in AVs. 549 c. Theories of RecoveryHow an AV, whether software or hardware is categorized as a product will matter more in the future. State law theories of recovery that courts will apply in determining how AV crash victims seek compensation for injuries may be able to adapt to incorporate unique AV factors in torts in determining bodily Case involved an AI algorithm (PSA risk estimation model) used by the state court which later resulted in plaintiff being murdered by a released criminal. Court applied state law (NJPLA) which imposes strict liability on manufacturers or sellers of defective products. Court stated that information, guidance, ideas and recommendations are not âproductsâ under the Restatement (Third) of Torts, both as a definitional matter and because extending strict liability to the distribution of ideas would raise serious First Amendment concerns.)546 America Online, Inc. v St. Paul Mercury Insurance Co., 347 F.3d 89, 95 (4th Cir. 2003). (Computer software was not considered âtangible personal propertyâ for an insurance claim. Instead the software was called âideasâ: â[i]instructions to the computer and the data and information processed by it are abstract ideas in the minds of the programmer and the user.â)547 Restatement Third of Torts: Products Lability 19(a) (1998) (âa product is tangible personal property distributed Commercially for use or consumption.â)548 See Tesla Deaths, https://www.tesladeaths.com/ [https://perma.cc/584H-TNVZ] (last visited Apr. 6, 2023). Complaint at 34-40, Umeda v. Tesla, Inc., No. 5:20-cv-02926 (N.D. Cal. Apr. 28, 2020); Complaint at 3-5, 18, Banner v. Tesla, Inc., No. 50:19-CA-09962 (Fla. Cir. Ct. Aug. 1, 2019); Complaint at 2-4, Nilsson v. Gen. Motors LLC, No. 4:18-cv-00471 (N.D. Cal. Jan. 22, 2018).549 Note that U.C.C. Defines âgoodsâ as not including âa computer program embedded in goods that consist solely of the medium in which the program is embeddedâ. This means that software is a âgeneral intangibleâ, not a âgoodâ for U.C.C. purposes. U.C.C. 9-102(44).
NCHRP LRD 91 47The most obvious issue in such proposals is who will be liable. There are several possibilities: the automotive company (car manufacturer), the supplier, the software provider, the soft-ware operator, the AV owner, the driver, the carâs occupants, the insurance company, among others. Since part, or all, of the re-sponsibility for causing the accident could be placed on the AV, the potential to invoke claims based upon product defect would increase. The situation will be even more complex in the case of partially autonomous vehicles (L3), where one could ask if it is appropriate, for instance, to make the human driver liable for failing to use the manual override function available in the car. If liability is attached to more than one subject, the additional issue of its apportionment arises.Products liability law is a newer body of law and provides the framework for seeking remedies when a defective product causes harm to persons or property.c. Product Liability for AVsStates dominate products liability law.562 There is no federal products liability law per se because the type of claim (negli-gence, strict liability or breach of warranty of fitness) a plaintiff pursues is based on the jurisdiction within which the claim is based. State by state, products liability claims can be based upon negligence, strict liability or breach of warranty of fitness.563 These areas are influenced by state tort law schemes. This com-plex area of law lacks uniformity, despite the US Department of Commerceâs creation of the Model Uniform Products Liability Act (MUPLA).564 Per the MUPLA, defects fall into four catego-ries: design, manufacturing, marketing or warranty.565 The law will need to determine contributory negligence for the interactions between the ADS as the Driver566 and human drivers when control of a vehicle is transferred from the ADS to a human driver by specifying a portion of time during the take-over transition period in which the Human Driver cannot have contributory negligence as a matter of law. d. Products Liability: Marketing DefectsPart of the state role in driver education will be to determine how to ensure drivers of ADAS and ADS-equipped AVs truly understand the limits and capabilities of their vehicles. There is the possibility that states attempt to push this driver educa-tion role onto dealers and driver manuals. Public driver con-fusion over the difference between ADAS567 or partial driving and âComputer Driver,â depending on the operational mode â one of which is âsupervisory modeâ with the AV steering).562 See Restatement (Second) of Torts: §Â402A (strict liability) which many states have adopted legislatively. This complex area requires its own focus of study which will not be thoroughly covered here.563 This complex area requires its own focus of study. 564 Model Uniform Products Liability Act (MUPLA), 44 Fed. Reg. 62,714 (1979).565 Id.566 Under several state laws, the ADS is deemed the âdriverâ of a highly automated vehicle now by statute. See infra, Texas and Oklahoma.567 ADAS is an âadvanced driver assistance systemâ. The generic term âdriving automation systemâ refers to any 1â5 level system. b. Negligence Negligent torts occur when the defendantâs actions are un-reasonably unsafe. Unlike negligence, strict product liability torts allow victims to receive compensation without showing the degree of care that a defendant used, so victims rely on the result or harm of the actorâs behavior.554 However, too much strict liability on AV makers may dis-incentivize research and development of the technology.555 Negligence liability claims may raise issues of proof of causation that make it too difficult to hold manufacturers responsible for problems.556 In the US, liability for a car crash places the burden of paying damages on the human driver, with an assumption that the driverâs con-duct led to the accident. States follow a system that combines compensation from the first-party/injured partyâs insurance with the ability to bring a traditional fault tort claim. No-fault legislation in a twelve states557 mostly limits victimsâ claims to their own insurance. In seven states, if a monetary threshold is met, the victim may use a general negligence action to recover non- compensated losses. 558 However, a majority of states allow injured parties to bring a tort claim against a negligent driver without these limitations. Claims against a car manufacturer based upon the sale of a defective product are rare with conventional vehicles with car defects accounting for only as 2% of the total number of acci-dents.559 If an injured party was driving a defective car in a crash, she may have both a product liability claim against the manufac-turer (and other defendants) in addition to a negligent driving claim (with fault issues) against the other driver. Despite state law progress on AV regulations, it is unclear who is liable when control of the vehicle is divided between a partially or fully autonomous vehicle and a human. Some ex-perts have suggested that the introduction of AVs should be preceded by the adoption of a completely new legal actor,560a new liability regime,561 or a revision of existing laws concerning liability for accidents caused by AVs.554 Id.555 Lai, Alicia, Artificial Intelligence, LLC: Corporate Personhood as Tort Reform (June 15, 2020). 2021 Mich. St. L. Rev., 597, at 613, https://ssrn.com/abstract=3677360 or http://dx.doi.org/10.2139/ssrn.3677360. 556 Id.557 Outside of the traditional tort system, twelve states and Puerto Rico have a true âno-faultâ laws with an insurance system where in the right to sue is restricted: Florida, Hawaii, Kansas, Kentucky, Massachusetts, Michigan, Minnesota, New Jersey, New York, North Dakota, Pennsylvania and Utah. See https://www.iii.org/article/background-on-no-fault-auto-insurance. 558 Id.559 NHTSA. DOT HS 812 506, Traffic Safety Facts: Crash Stats, Critical Reasons for Crashes Investigated in the National Motor Vehicle Causation Survey (Mar. 2018), https://crashstats.nhtsa.dot.gov/Api/Public/Publication/812506. 560 See Widen and Koopman, supra note 36.561 See Abraham and Rabin, supra note 553 (suggesting that, only after a threshold percentage of HAVs are registered, should a uniform national rule on negligence/tort liability be adopted for them to avoid a patchwork of state liability laws). See Widen and Koopman supra note 28 (defining the rules of liability transfer between the Human Driver
48 NCHRP LRD 91partial-automation technology when a new car is delivered and when software is updated.571Confusion over AV automation capabilities and levels can create many problems, which states must address. As an exam-ple although plaintiffs sued Tesla for ADAS-AV related fraud,572 negligent misrepresentation and violation of the California False Advertising Law (Cal. Bus Code §17500, et seq.),573 this 2022 lawsuit was not technically a marketing defect claim.574 As we discuss infra, letting manufacturers determine how AV fea-tures are classified into the various levels can create confusion. States have already begun to use J3016 as a unifying founda-tion of laws and regulations, so if any misapplication of law or loopholes are emerging, these issues should also be examined to reduce conflicts as states endeavor to harmonize laws moving forward. e. Design Intent, Regulation of AVs, Negligence in Tort, Software, and Products Liability QuestionsSome experts have said that the revisions made the J3016 less suitable to define the scope of a law or regulation with any cer-tainty by, among other things, introducing the concept of design 571 California Legislature. Senate Bill No. 1398. Approved by Governor September 13, 2022. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220SB1398. 572 Complaint against Tesla Finance, LLC, Tesla Lease Trust, Tesla, Inc. (Filing fee $ 402, receipt number ACANDC-17533351). Filed by Briggs A. Matsko. (Attachments: # 1 Civil Cover Sheet) (Cotchett, Joseph) (Filed on 9/14/2022) Modified on 9/15/2022 (slh, COURT STAFF). (Entered: 09/14/2022), Matsko V. Tesla, Inc., et al., (US District Court for the Northern District of California September 14, 2022, Filed), available at https://advance-lexis-com.ezproxy.lib.utexas . e du/api /do c ument?col l e c t ion=br ie f s -p le ad ings-motions&id=urn:contentItem:66GK-28T1-F8SS-63DM-00000-00&context=1516831 .573 Id., citing to DMVâs caseâIn the Matter of the Accusation Against Tesla Inc. dba Tesla Motors, Inc., a Vehicle Manufacturer, Case No. 21-02188, Accusation (July 28, 2022), and In the Matter of the Accusation Against Tesla Inc. dba Tesla Motors, Inc., a Vehicle Dealer, Case No. 21-02189, Accusation (July 28, 2022). (After a year-long investigation, the California DMV, which licenses motor vehicle manufacturers and dealerships in California, brought two related administrative enforcement actions against Tesla for âuntrue,â âmisleading,â and âdeceptiveâ marketing of its Autopilot and FSD technology. The DMV specifically alleged that Teslaâs use of the product labels âAutopilotâ and âFull Self-Driving Capability,â as well as statements about those technologies that have appeared on Teslaâs website in 2022, ârepresent that vehicles equipped with those ADAS features will operate as an autonomous vehicle, but vehicles equipped with those ADAS features could not at the time of those advertisem*nts, and cannot now, operate as autonomous vehicles.â). To get around California regulation, Tesla, some experts argue, has possibly mischaracterized its FSD beta features as SAE L2 when they really qualify as more heavily regulated L4 under J3016.574 Id., The 2022 Matsko class action suit included the following claims: 1. Violation of The Magnuson Moss Warranty Act; 2. Breach of Express Written Warranty; 3. Breach of Implied Warranty of Merchantability; 4. Violation of the California False Advertising Law; 5. Violation of the California Consumer Legal Remedies Act; 6. Violation of the California Unfair Competition Law; 7. Fraud and Deceit; 8. Negligent Misrepresentation; 9. Unjust Enrichment; 10. Negligence. automation (usually L0-2, with Tesla classified as L2) and ADS systems (usually L3-5) has caused NTSB to publicly remark on the misuse of automation and included this discussion in the safety recommendations to NHTSA in a 2018 crash investiga-tion report.568When the producer of the product or its seller is perceived to not offer adequate directions for its usage or notify consumers about the dangers associated with the product, will necessar-ily intersect with driver education, consumer expectations and public perception of AVs. NHTSA has investigated this issue in Tesla Autopilot and how it appears its Autopilot may have exac-erbated human factors or behavioral risks by undermining the effectiveness of the driverâs supervision in 16 crashes â which included crashes with first responders and road maintenance vehicles. In 11 collisions studies, no drivers took evasive action between 2-5 seconds prior to impact despite having their hands on the wheel. The ODI Resume did not appear to be clear on how much was due to driver complacency or a lack of driver engagement technologies, however the report says that four out of nine vehicles exhibited no visual or chime alerts at all during the final Autopilot use cycle in the last minute before a collision.569 Californiaâs DMV also accused Tesla of mislead-ing prospective customers with advertising that overstated how well ADAS worked in Autopilot and FSD.570 In August 2022, California acted by passing SB1398 which reinforces its DMV regulation banning advertising of cars as self-driving when they are truly not. This new California law also sets requirements for the automakers to clearly explain the capabilities and limits of Individually, Tesla Autopilot subsystemsâsuch as Traffic-Aware Cruise Control (TACC), which provides longitudinal vehicle motion control; and Autosteer, which provides lateral vehicle directional controlâare considered Level 1 systems. When Autopilot is active and multiple subsystems like TACC and Autosteer are combined to provide both lateral and longitudinal vehicle motion control, the system is considered Level 2 driving automation. For more, see J3016:2021.568 Collision Between a Sport Utility Vehicle Operating with Partial Driving Automation and a Crash Attenuator Mountain View, California, at 59. (Mar. 23, 2018, Accident Report, NTSB/HAR-20/01, PB2020-100112, National Transportation Safety Board.569 NHTSA, Office of Defects Investigation, Preliminary Evaluation/ODI Resume, EA 22-002, June, 2022, https://static.nhtsa.gov/odi/inv/2022/INOA-EA22002-3184.PDF. 570 In the Matter of the Accusation Against Tesla Inc. dba Tesla Motors, Inc., a Vehicle Manufacturer, Case No. 21-02188, Accusation, and In the Matter of the Accusation Against Tesla Inc. dba Tesla Motors, Inc., a Vehicle Dealer, Case No. 21-02189, Accusation (both 7/28/2022). (After a year-long investigation, the California DMV, which licenses motor vehicle manufacturers and dealerships, brought two related administrative enforcement actions against Tesla for âuntrue,â âmisleading,â and âdeceptiveâ marketing of its Autopilot and FSD technology. DMV specifically alleged that Teslaâs use of the product labels âAutopilotâ and âFull Self-Driving Capability,â and statements about those technologies that have appeared on Teslaâs website in 2022, represent that vehicles equipped with those ADAS features will operate as an autonomous vehicle, but vehicles equipped with those ADAS features could not at the time of those advertisem*nts, and cannot now, operate as autonomous vehicles.)
NCHRP LRD 91 49device cases in the future for legal direction on how to treat soft-ware defects that cause severe injuries or fatalities and not just economic loss. For example, in Louisiana, in Corley v. Stryker Corp., a physical product â a medical device â was âdesigned and manufactured from patient-specific 3D imaging data and the use of proprietary 3D imaging software.â582 On a motion to dismiss, the court concluded that the physical implant plus the defen-dantâs âsoftware used in creatingâ it, was âa necessary partâ of the âproductâ as a whole, and therefore was subject to strict liability as a component part even though, physically, the software was entirely separate from the device.583 Precedents like this have led most plaintiffs to pursue software584 companies under negli-gence rather than strict liability585, theories of liability.586 Depending upon how much the federal government regu-lates ADS technology, potential non-defect presumptions avail-able under certain statesâ product liability laws for FMVSS com-pliance may not apply to claims concerning ADS technology.587 Normally, an injured plaintiff could argue that FMVSS noncom-pliance is evidence of a defect. State laws may need to adapt or anticipate changes in state products liability doctrines as ubiq-uitous deployment of AVs occurs. In the future, federal actions, like the March 2022 NHTSA final rule588 amending occupant protection FMVSS to account for ADS-equipped AVs without traditional manual controls, will affect how state tort law (with new auto designs and standards) is applied in personal injury litigation.Without an applicable FMVSS, evidence of compliance or noncompliance will not be available to litigating parties on either side. A plaintiff cannot argue that the FMVSS non-compliance is evidence of a defect. Potential non-defect pre-sumptions available under certain statesâ product liability laws for FMVSS compliance may not apply to claims involving advance-lexis-com.ezproxy.lib.utexas.edu/api/document?collection=news&id=urn:contentItem:645J-7701-F03R-N3MR-00000-00&context=1516831. 582 Corley v. Stryker Corp., 2014 U.S. Dist. LEXIS 92002, 2014 WL 3375596, at 1, (United States District Court for the Western District of Louisiana, Lafayette Division May 27, 2014, Filed), available at https://advance-lexis-com.ezproxy.lib.utexas.edu/api/document?collection=cases&id=urn:contentItem:5CM4-25M1-F04D-C0PH-00000-00&context=1516831. 583 Id. at 4.584 Whether AV software is a âproductâ for product liability purposes remains unsettled. See U.C.C. 9-102(42)(software is considered a âgeneral intangibleâ not a âgoodâ), however, computer programs embedded in goods are part of âgoodsâ and are not software according to U.C.C. 9-102, commentary at 4(a).585 See Michael Rustad, Products Liability for Software Defects in Driverless Cars, 32 S. Cal. Interdisc. L.J. 171, (Fall 2022).586 See Alexander, supra note 581.587 Note that the Motor Vehicle Safety Actâs defect provisions (49 U.S.C. Ch. 301) apply to an ADS and ADS-equipped vehicle; and Manufacturers may seek exemptions to FMVSS under 49 C.F.R. Pt. 555, https://www.ecfr.gov/current/title-49/subtitle-B/chapter-V/part-555.588 https://www.federalregister.gov/documents/2022/03/ 30/2022-05426/occupant-protection-for-vehicles-with-automated-driving-systems. intent as one factor in setting a level.575 In contrast to the 2014 version of J3016, âdesign intentâ now impacts the setting of a level in J3016:2021, meaning that levels are assigned by the man-ufacturer (not a government or standards entity).576 Automation levels thus reflect the design intent of the manufacturer for the driving automation system feature as defined by the manufac-turer.577 The ADS consists of both hardware and software (J3016, 2021), so this means that a manufacturerâs reference to software updates when disclosing the presence of initial AV software and the design intent to continuously upgrade system automation capabilities578 will likely matter in examining future crash liabil-ity and product liability claims. Generally negligence claims under products liability law in-clude careless mistakes in the manufacturing of products, de-sign errors, and failure to warn consumers of dangers associated with a product. For AV crash liability claims, the plaintiff will have evidentiary challenges, such as the burden of proving the at fault party failed to take reasonable care.579 Courts may have to determine if ADS software is product or a service in future AV claims. Courts are already handling ADAS design and manu-facturing defect claims580 in which poorly calibrated software, which controls the sensors and reverse automatic braking re-sponses, is seen as defective programming. If underlying coding and algorithms which discriminate between landscape and ob-stacles cannot make decisions, this defective programming is at odds with the intended design of the software.Most software cases follow the Restatement and the U.C.C. to hold that computer software is not a product for product liability purposes.581 In terms of AVs, courts may look to medical 575 Widen and Koopman, supra note 18. 576 SAE supra note 109 §Â8.2577 Id., § 8.2: ââ¦the manifestation of one or more performance deficiencies in either the driving automation system or in the userâs use of it does not automatically change the level assignment. For example: ⢠An ADS feature designed by its manufacturer to be Level 5 would not automatically be demoted to Level 4 simply by virtue of encountering a particular road on which it is unable to operate the vehicle. ⢠The user of an engaged Level 3 ADS feature who is seated in the driverâs seat of an equipped vehicle is the DDT fallback-ready user even if s/he is no longer receptive to a request to intervene because s/he has improperly fallen asleep.â578 See Widen and Koopman, supra note 35. 579 Manufacturers may be able liable under strict product liability, regardless of whether they exercised the duty of reasonable care: Restatement (Third) Of Torts: Prods. Liab. §Â1 cmt. (a) (Am. Law Inst. 1998) (noting it âis no defense that [manufacturers] acted reasonably and did not discover a defect in the productâ).580 Sampson, et al., v. Subaru of America, Inc. et al., U.S Dist. Ct. of New Jersey, Case 1:21-cv-10284-RMB-KMW, filed Apr. 27, 2021. (Class action: plaintiffs claim Subaru failed to warn customers about the AEB systems which allegedly have defects with software calibration from multiple control modules. plaintiffs claim LKA is defective due to poor software calibration from the power steering control module and other modules, among other defects. The lawsuit alleges the KLS jerks the steering wheel and âeven steers the vehicle into other vehicles,â making the EyeSight systems dangerous.).581 Eric Alexander, Unintended Consequences for Software Liability?, Newstex Blogs Drug and Device Law, (Nov. 26, 2021). https://
50 NCHRP LRD 91mandatory legal car insurance requirements. Although states have maintained this regulatory framework for decades, the federal government could, as with other areas, rescind the del-egation and create a federal regulatory framework, as it has done in the banking arena. AAMVA noted that âfinancial responsibil-ityâ includes both insurance and liability as areas that need a state examination for barriers to safe testing, deployment and operation of ADS-equipped vehicles.593a. Insurance and the Inescapable Liability Problem: Who is the Driver?How will state insurance regulation respond to AV crashes? Some scholars have postulated that the proliferation of AVs might spell the end of auto insurance â that auto insurance in-dustry would slowly be replaced by product liability claims.594 However this may be short sighted and omits the fundamental problem of how states have defined liability and legal responsi-bilities for the AV âdriverâ, âownerâ and âoperatorâ within state laws in a non-uniform way. States must examine whether the human or âpersonâ in the vehicle is called the âownerâ, âopera-torâ, âuserâ, âproviderâ âpassengerâ or âdriverâ. State law is not uniform here. Although state or federal laws may call corpo-rations, companies, associations, firms, partnerships, societies, and joint stock companies a âjuridical personâ (i.e., a âlegal personâ), each state determines the various rights available to this nonhuman entity that may be sued, own property or enter into contracts. 595 As states have created whole new sections defining the âfall-back ready userâ596 or have simply kept the traditional definition of âdriverâ in its code while defining the AV, states have not yet detailed if the âlicenseâ is attached to traffic violations belonging to the ADS, a human âpersonâ or a corporation.b. ControlOne key question for AV insurance claims will be who is really controlling the vehicle: the ADS or the user/passenger who is expected to intervene when the vehicle malfunctions. In NTSB crash reports, the ADS is said to be âcontrollingâ the must be regulated by state law; and 3. The action must not be designed to boycott, coerce or intimidate.593 Safe Testing and Deployment of Vehicles Equipped with Automated Driving Systems Guidelines, Edition 3, AAMVA, (July 2022), at 17, https://www.aamva.org/getmedia/66190412-ce9d-4a3d-8b6e-28c1b80e3c10/Safe-Testing-and-Deployment-of-Vehicles-Equipped-with-ADS-Guidelines_Final.pdf. 594 Ryan Mardini, 35 Mich. U.T.M. Cooley L. Rev. 193, Fall 2019, The Justification of Remedying Change: How the Proliferation of Autonomous Vehicles Will Transform Michiganâs Insurance Regime. 595 See The Law Dictionary, âNatural Person,â (noting that a ânatural personâ is a human being, naturally born, versus a legally generated âjuridical personâ (i.e., a âlegal personâ), which may be an entity, as a firm, that is not a single natural person (i.e., a corporation). See also Federal Dictionary Act, 1 U.S.C. Sec. 1 (ââ¦the words âpersonâ and âwhoeverâ include corporations, companies, associations, firms, partnerships, societies, and joint stock companies, as well as individualsâ).596 The human âuserâ of an AV is referred to in the J3016: 2021 as a âdriverâ and a âfallback-ready userâ in L3 examples 3, at 7. automation. OEMs may be less likely to assert federal pre-emption defenses to state law tort claims based on a lack of, or alleged malfunctioning of, automation technology. Because the adoption of automation technology has been largely voluntary and industry-driven, plaintiffs alleging that lack of automation is a defect can potentially offer defect, negligence, and punitive damages arguments that focus on noncompliance with the state of the art. From the defense perspective, manufacturers who in-stall industry- standard automation technology should benefit from state of the art defenses. If a vehicle was defective when it left the factory, then the state of the art defense could foreclose manufacturer liability when programming weaknesses are later identified.589State No-Fault Acts, such as Michiganâs No-Fault Act590 and product liability statutes will require changes to adapt to the in-evitable rise of product liability AV claims. Analysis of state laws and product liability statutes with a focus on the inflexibility of state insurance laws may need to occur as the roads incorporate higher level of automation. How states choose to legally or technically connect algorith-mic errors to tortious human actions and how the ADS maker is assigned criminal and/or financial responsibility for losses prox-imately caused by a negligent ADS remains unsettled. Added to this uncertainty is the fact that Testing Mode Operation is a new liability arena when testing on public roads looks just like public deployment. Without further statutory guidance, leaving resolution to the courts, or to less transparent mediation and arbitration, will cloud legal certainty for all stakeholders. This scenario leaves the nation with possibly inconsistent case law across jurisdictions.3. Insurance RequirementsInsurance regulation is legally in the statesâ domain Paul v Virginia, 75 U.S. 168 (1869).591 However, Congress did decide to explicitly delegate this regulatory arena to the states in the McCarran â Ferguson Act of 1945,592 States generally establish 589 Cassandra Burke Robertson, Litigating Partial Autonomy (Mar. 2023). At 56, Case Legal Studies Research Paper No. 4, 2023, 109 Iowa L. Rev., Forthcoming 2023, https://ssrn.com/abstract=4392073; See also Bryant Walker Smith, ProximityâDriven Liability, 102 Geo. L.J. 1777, 1805 (2014) (discussing courtsâ historical skepticism of a postâsale duty to update and how that is changing with technological developments); see also Bryan H. Choi, Crashworthy Code, 94 Wash. L. Rev. 39, 115 (2019) (â[T]he repeated exercise of having to defend how oneâs software fault tolerance compares to the state of the art would drive manufacturers to inspect and adopt new techniques at a faster clip.â)590 Mich. Comp. L. §Â2111e (2022).591 Paul v. Virginia, 75 U.S. 168 (1869), (selling insurance is not âinterstate commerceâ subject to the Commerce Clause of the Constitution.). However, this was later overturned by U.S. v. South Eastern Underwriters Assn., 322 U.S. 533 (1944), which concluded that insurance was interstate commerce and that it should be subject to antitrust laws. Shortly after this case, federal law (infra, in 1945) was passed to return regulatory power to the states over the insurance industry.592 McCarran-Ferguson Act, 15 U.S.C. §Â1011-1015 (1945). The actâs antitrust exemption applies only if three conditions are met: 1. The insurerâs action pertains to âthe business of insuranceâ; 2. The action
NCHRP LRD 91 51saying that it is a motor vehicle on which an ADS is installed.608 Contrast that with Arizona, which has classified FAV as an SAE defined L4 or 5 in automation,609 as have some other states.610 Using SAE levels of automation611 may be problematic for legal purposes as there is a difference between strict rules and flexible conduct standards.612 The J3016 generally assigns levels based on a manufacturerâs design intent:613 This means the manufac-turer determines the assignment of automation level, which is subjective and varies by company, impeding legal certainty.614 The NTMVSA and NHTSAâs regulations require vehicle and equipment manufacturers to certify that their vehicles or vehicle equipment comply with all applicable FMVSS.615 A vehicle manu-facturer, distributor, dealer, rental company, or repair business generally may not knowingly make inoperative any part of a device or element of design installed in or on a motor vehicle in compliance with an applicable FMVSS. NHTSA has the author-ity to issue regulations that exempt regulated entities from the make inoperative provision616 if the Agency finds that the exemp-tion would be consistent with motor vehicle safety and with 49 U.S.C. 30101617 for example, disability accommodations.618 Under the system of self-certification established by the NTMVSA,619 NHTSA does not pre-approve vehicles, through testing or other means, before they can be sold into interstate commerce. Instead, vehicles must be certified as compliant by the manufacturer. Under NTMVSA, new motor vehicles must meet two require-ments before they are sold or otherwise introduced into inter-608 TTC §Â545.451 (2).609 Ariz. Rev. Stat. §28-101 (2022).610 States explicitly using SAE J3016 to define âautomated vehiclesâ as L4 and above are: Conn. Gen. Stat. §Â13a-260 (2018) pilot; Ark. Code §Â27-51-2001 (2019); Nev. Rev. Stat. §Â482A.036 (2021); N.H. Rev. Stat. §Â242.1 (2019) (âADSâ defined with level four or five in Pilot Program). Note that the codes do not necessarily refer to which iteration of the SAE taxonomy being used in the code â 2018 or 2021. 611 SAE level-focused statutes, see Figure 4, table, infra: Arizona, Florida, Georgia, Kansas, Nebraska, Nevada, North Carolina, North Dakota, Utah, W. Virginia.612 Pierre Schlag, Rules and standards, 33 UCLA L. Rev. 379 (1985).613 See SAE supra note 1 §Â5 at 30.614 See Widen and Koopman, supra note 18.615 See 49 U.S.C. 30112; 49 C.F.R. part 567.616 49 U.S.C. §Â30122(c).617 49 U.S.C. §Â30101, âPurpose and Policy,â of the Safety Act states: âThe purpose of this chapter is to reduce traffic accidents and deaths and injuries resulting from traffic accidents. Therefore it is necessaryâ(1) to prescribe motor vehicle safety standards for motor vehicles and motor vehicle equipment in interstate commerce; and (2) to carry out needed safety research and development.â618 For example, the Agency has used its authority to promulgate 49 C.F.R. part 595, subpart C, âMake Inoperative Exemptions, Vehicle Modifications to Accommodate People with Disabilitiesâ, 85 Fed. Reg. 84,281 (Dec. 28, 2020), Make Inoperative Exemptions; Vehicle Modifications To Accommodate People With Disabilities, Supplemental Notice of Proposed Rulemaking (SNPRM), NHTSA on 12/28/2020, (supplemental notice of proposed rulemaking (SNPRM), discussing exemptions to FMVSS and vehicle modifications for disabled with regard to rental car companies).619 Safety Act 49 U.S.C. 30111.vehicle.597 Regulators should examine how the engineering term for vehicle motion âcontrolâ598 clashes with the legal term for â controlâ - in which liability follows who legally âcontrolsâ the AV.599 Perhaps newer statutes more accurately reflect the tech-nologyâs reality on control.In Colorado, â(5) Liability for a crash involving an ADS driv-ing a motor vehicle that is not under human control is deter-mined in accordance with applicable state law, federal law, or common law.â600 In Arkansas, â(2) âAutonomous vehicleâ means a vehicle equipped with an ADS that can drive the vehicle for any duration of time without the active physical control or monitoring of a human operator.â601 Older statutes may need an update to reflect changes in legal and tech terminology so that the control of AVs can be distributed across the supply chain in the case of negligence. 602 Nevada law for example, 603 reflects the SAEâs statement604 that a L3 ADSâs âDDT fallback ready userâ is also expected to be receptive to evident DDT performance-relevant system failures in vehicle systems that do not necessar-ily trigger an ADS-issued request to intervene, such as a broken body or suspension component. c. License HolderThe determination of license holder will also play a deter-minant role for insurance in the future as well. Is there a severe consequence for severe fatalities due to traffic violations? For example, under Texas law, the ADS (software) holds the license to drive.605 However, the ADS owner is the âoperatorâ606 with regard to traffic law compliance,â regardless of whether a person is physically present in the vehicleâ. d. Automation Levels Matter for LawThe level of automation will also play another role here. As an example, Texas law does not delineate which of the J3016 levels of automation607 apply to automated motor vehicle simply 597 Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, Arizona (Mar. 18, 2018, Accident Report, NTSB/HAR-19/03, PB2019-101402.598 See SAE supra note 17. §Â3.10 Dynamic Driving Task [DDT], now written into various state laws, involves âvehicle motion controlâ by the ADS.599 Jerrold Soh Tsin Howe, Towards a control-centric account of tort liability for automated vehicles, 26 TLJ 221 (2021).600 Colo Rev. Stat. §Â42-4-242 (2017).601 Ark. Code §Â27-51-2001 (2019).602 Especially where they have utilized SAE J3016 which focuses on levels of driving automation features whereas the law tends to regulate the vehicle (not the features).603 Nev. Rev. Stat. §Â482A.070 (2019).604 See SAE supra note 108, p. 31.605 TTC §Â545.453. Note that the Texas law mentions no J3016 levels of automation. 606 TTC §Â545.453.607 Note that this Texas law was written in 2017, before the SAE updates to its taxonomy in 2018 and 2021, SAE Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles.
52 NCHRP LRD 91Arizona operators must submit a law enforcement interac-tion plan that addresses the protocol developed by the Arizona Depart ment of Public Safety and certifies to AZDOT that the vehicle meets certain standards and is titled, registered, licensed and insured. To add to the confusion, the same Arizona law states: When engaged, the ADS is considered the driver or operator of the autonomous vehicle for the purpose of assessing compliance with ap-plicable traffic or motor vehicle laws and is both: 1. Deemed to satisfy electronically all physical acts required by a driver or operator of the vehicle. 2. Exempt from the requirements of chapter 8 of this title.629However, AVs without human driver capability are respon-sible for the following:C. A fully autonomous vehicle may operate on public roads without a human driver only if a person submits both: 1. A law enforcement interaction plan to the DOT and the DPS that is consistent with and addresses all of the elements in the law enforcement protocol that was issued by the DPS on May 14, 2018, before beginning the operation or if the operation has already begun, within sixty days after the effective date of this section. 2. A written statement to the DOT acknowledging all of the following: (a) when required by federal law, the fully autono-mous vehicle is equipped with an ADS that is in compliance with all applicable federal laws and FMVSS and bears the required certification labels including reference to any exemption granted by the NHTSA under applicable federal law. (b) if a failure of the ADS occurs that renders that system unable to perform the entire DDT relevant to its intended ODD, the fully autonomous vehicle will achieve a minimal risk condition. (c) the fully autonomous vehicle is capable of complying with all applicable traffic and motor vehicle safety laws of this state and the person who submits the written statement for the fully autonomous vehicle may be issued a traffic citation or other applicable penalty if the vehicle fails to comply with traffic or motor vehicle laws. (d) the fully autonomous vehicle meets all applicable certificate of title, registration, licensing and insurance requirements of this title.The Arizona legislature recognized the practical distinction between a driverless and driver-capable AV. A vehicle that has the capability for a user to take control of the DDT calls for ex-pectations on that driver if it chooses to do so. To the contrary, if a vehicle has no driver capability (or user control), there is little need for user regulation. This three-tiered system of (1) tradi-tional drivers, (2) drivers of AVs in which they are responsible to taking control of, and (3) driverless vehicles could be advisory to other differing approaches in this sector, such as legislatively defining a driver for insurance purposes.4. Privacy a. Common Law of Privacy â State Law, TortThe right to privacy as it was conceptualized by Warren and Brandeis in a famous law journal article in 1890 is said to be the original source of this common law tort claim and right.630 However, a state Supreme Court case law in 1905 truly estab-lished this privacy right within common law in state tort law. In Pavesich v. New England Life Insurance Co.,631 a Georgia court 629 Ariz. Rev. Stat. §Â28-9602(E) (2022).630 Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890).631 Pavesich v. New England Life Insurance Co., 8122 Ga. 190 (Ga. 1905).state commerce in the United States. (i) vehicle must meet all ap-plicable FMVSS that are in effect on the date of manufacture.620 (ii) vehicle must be covered by a manufacturer certification issued under 49 U.S.C. 30115. By certifying a vehicle, a manufacturer as-sumes responsibility for compliance with all applicable FMVSS.621 The NTMVSA requires NHTSA to establish requirements for compliance with the FMVSS by setting performance standards.622However, in addition to requiring actual compliance with applicable FMVSS, the Act itself expressly established a separate requirement that manufacturers exercise reasonable care when certifying compliance.623 The reasonable care language mirrors that in most state law tort liability standards. For AVâs, problems may arise when L3 AVs are deployed and the manufacturer has designed the vehicle so that the users are expected to handle the DDT fallback, but the vehicle manufacturer calls its AV L2, pos-sibly to avoid more regulation.624e. Humans Are Licensed TooArizona acknowledges that a vehicle that is capable of per-forming the DDT - but also has the human driver capability that allows for the human to control all or parts of the DDT and - requires the human user to retain a driverâs license.625 In the Arizona law, there is no reference to an AV owner until §28-9708 Enforcement, and it also mentions the person who signed a statement.626Arizona has especially unique protocols for law enforce-ment interaction627. This may affect how crashes get investigated and how insurance gets involved. In Arizona, the citation for not being registered gets issued to the vehicle owner per ARS §28-2532. In the event of injury, in a collision, the officer shall provide the FAVâs ownerâs name, address and insurance infor-mation to the drivers of all other vehicles, any injured parties involved in the collision and the owners of damaged property.628 620 49 U.S.C. 30112.621 For vehicles, the manufacturer affixes a certification label on the vehicle, and for equipment the FMVSS generally require the manufacturer to provide its certification by marking the equipment with the letters âDOTâ in a prescribed location.622 49 U.S.C. §Â30111.623 49 U.S.C. §Â30115.624 Although Tesla FSD intended design capability describes an SAE level 4 feature, it has labeled FSD Beta as level 2. https://electrek.co/2022/11/16/tesla-reports-two-fatal-crash-autopilot-fsd-beta/#:~:text=It%E2%80%99s%20not%20clear%20if%20the%20crashes%20involved%20Autopilot,to%20a%20lot%20of%20telemetrics%20in%20its%20vehicles. NHTSA is investigating 11 crashes between Tesla vehicles with Autopilot Level 2 driver assistance from 2014 â 2021 and at last one stationary first responder vehicle since 2018, which involve 17 injuries and a death. See Christopher Smith, Feds Open New Investigation into 11 Tesla Autopilot Crashes (Aug. 16, 2021), https://www.motor1.com/news/526983/nhtsa-investigates-tesla-autopilot-crashes/.625 Ariz. Rev. Stat. §Â28-9602(B); note that under Arizona law the fully automated vehicle FAV is level 4 or 5. 626 Ariz. Rev. Stat. §Â28-9708 (2021).627 https://azdot.gov/sites/default/files/2019/07/law-enforcement-protocol.pdf. 628 2018 Law Enforcement Protocol for Fully Autonomous Vehicles, Arizona.
NCHRP LRD 91 53with limited exceptions,639such as a limited private right of action for certain privacy violations. The bill would be enforceable by the FTC and by state attorneys general, as well as state privacy authorities in civil actions.640 This bill would also give consum-ers rights of access, correction, deletion, opt out, and portability. 641 The ADDPAâs duty of loyalty642 imposes a data minimization requirement and defines several prohibited data practices.643 Other federal privacy related legislation includes The Elec-tronic Communications Privacy Act (ECPA),644 which protects against the interception of electronic communications or access to stored communication by un authorized third parties; and the Federal Communications Act (FCA),645which requires tele-communications carriers to protect the confidentiality of pro-prietary information of customers ( although OEMs or service companies may not be carriers). The Drivers Privacy Protection Act,646 is limited to protecting motor vehicle records from dis-closure by state DMVs.d. Event Data Recorderâs in VehiclesMost vehicles on the road already have an event data recorder (EDR),647 which captures a limited amount of information about a vehicle, the driver, and passengers in the few seconds before a crash. In 2015, Congress passed the Driver Privacy Act (DPA) of 2015, which was part of the FAST Act.648 DPA established that EDR data is the property of the vehicle owner but does not gov-ern the other types of voluminous data that will be accumulated by AVs and connected personal smartphones. While general consumer privacy is an important concern for NHTSA, the FTC has primary jurisdiction over privacy issues not related to motor vehicle safety. As the United Statesâ princi-639 See also Overview of the American Data Privacy and Protection Act, H.R. 8152, CRS, (Updated August 31, 2022), https://crsreports.congress.gov/product/pdf/LSB/LSB10776. (Bill preserves 16 different categories of state laws, including consumer protection laws of general applicability and data breach notification laws. It expressly preserves certain state laws like Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq) and Genetic Information Privacy Act (410 ILCS 513/1 et seq).640 Id.641 H.R. 8152, (advanced by vote of the House Energy and Commerce Committee on July 20, 2022), https://www.congress.gov/bill/117th-congress/house-bill/8152?r=29. 642 Id., See bill, Title I- Duty of Loyalty, §Â101. Data Minimization. 643 See supra note 639. See HR 8152 (117th), American Data Privacy and Protection Act, https://www.congress.gov/bill/117th-congress/house-bill/8152?s=1&r=15.644 18 U.S.C. §Â2510, et seq.645 47 U.S.C. §Â222.646 18 U.S.C. §Â271, et seq.647 EDRâs are defined in 49 C.F.R. Sec. 563.5 and include information to be used for a NHTSA investigation (seatbelt use, accelerator depression, position of driver, brake use and speed).This data may be useful in determining liability and fault after a collision; however it does not include âaudio and video data.â648 H.R. 22 Fixing Americaâs Surface Transportation Act (FAST Act), 114th Congress (2015-16), https://www.congress.gov/bill/114th-congress/house-bill/22, (a surface transportation reauthorization); also known as P. L. 114-94, (Dec. 4, 2015), 129 Stat. 1312.recognized a right to privacy cause of action in tort with poten-tial damages to be awarded.Today common law privacy invasion breaks down into four areas: 1. intrusion upon seclusion;632 appropriation of name or likeness;633 public disclosure of private facts;634 and false light or publicity.635 Data privacy actions in common law most often fall into the first category, intrusion upon seclusion.636 b. Legislating PrivacyData privacy has evolved into national and state legislative mandates recently. Privacy legislation may cover most privacy aspects of emerging technology, but this is a moving target for any legislature. At the federal level, there is the Driverâs Privacy Protection Act (DPPA)637 which covers government collection of data, but not that of commercial collection.Due to the connected nature of the Internet of Things (IoT) inherent in the operation of AVs, consumers, manufactures and service providers will need a predictable legal framework to ensure privacy in their data collection, storage, disclosure and use. Data collected for AI use, diagnostics, driver-assist sys-tems, communications, geolocational services, and insurance purposes will need to be secured, encrypted, authenticated and somehow anonymized. In securing the connection between de-vices and vehicles, authentication and certification at the time of manufacturing will be necessary, but also later, this connection must be secured in both hardware and software to prevent un-authorized access, tampering or theft. c. Federal Data Privacy RegulationAs of April, 2023, there is no overarching comprehensive Data Privacy federal law in the USA, but several bills have been proposed, including the, American Data Privacy Protection Act (ADPPA) which may supersede existing state laws in the future if it passes.638 The ADPPA includes the preemption of state laws 632 Restatement (Second) Of Torts §Â652B (AM. LAW INST. 1977), § 652B Intrusion Upon Seclusion, One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.633 Id. §Â625C.634 Id. §Â625D.635 Id. §Â625E.636 Hernandez v Hillside, 211 P.3d 1063, 1072 (Cal. 2009).637 DPPA, 18 U.S.C. §Â2721, et seq (1994), Public Law No. 103-322, codified as amended by Public Law 106-69, (enacted to protect the privacy of personal information gathered by the State Departments of Motor Vehicles; prohibits the release, use or sale to a third party by any state DMV of personal information connected to a motor vehicle record). Note that the DPPA survived a constitutional challenge in Reno v. Condon, 528 U.S. 141 (2000), in which the Court found that the DPPA did not violate principles of Federalism and the Interstate Commerce Clause.638 H.R. 8152, advanced by vote of the House Energy and Commerce Committee on July 20, 2022, https://www.congress.gov/bill/117th-congress/house-bill/8152?r=29.
54 NCHRP LRD 91so this may be why the states have moved to bridge the gap on data privacy legislation. Although federal legislation proposed on AVs658 has includ-ed a privacy component, these bills did not pass. The GAO659 found that there is no one agency with clearly defined roles and responsibilities for regulating vehicle data privacy. The FTC and NHTSA have coordinated on privacy issues involving connected vehicles, with the FTC having authority to protect consumer privacy and the NHTSA having authority over the safety of passenger vehicles. e. USDOT Data Protection and Privacy IssuesNHTSA latest policy document660 noted it would âwork with developers, manufacturers, integrators, and service providers of AVs and AV services to ensure the successful prevention, miti-gation, and investigation of crimes and security threats targeting or exploiting AVs, while safeguarding privacy, civil rights, and civil liberties.â However, as of April 2023, there is no umbrella federal data privacy law â just various targeted privacy laws.661 Many industry organizations,662 groups,663 and government bodies664 have created best practices and policies for data pri-658 See AV START Act, supra note 142. 659 Vehicle Data Privacy, Industry and Federal Efforts Under Way, but NHTSA Needs to Define Its Role, Government Accountability Office (July 2017) 17-656, https://www.gao.gov/assets/690/686284.pdf. 660 NHTSA, supra note 10. (Data collection, privacy, and security, plus Monetizing data are listed as priorities.)661 The Privacy Act of 1974 (5 U.S.C. 552a) is a code of fair information practices which mandates how federal agencies maintain records about individuals, but it does not target consumer data collection or use by commercial parties.662 Federal Policy Framework for Our AV Future, AVIA (Autonomous Vehicle Industry Association) (Mar. 2023), https://theavindustry.org/. Consumer Privacy Protection Principles: Privacy Principles for Vehicle Technologies and Services. Alliance of Automobile Manufacturers, Inc. (Nov. 12, 2014, reviewed May 2018). Available at: https://autoalliance.org/wp-content/uploads/2017/01/Consumer_Privacy_PrinciplesforVehicleTechnologies_Services-03-21-19.pdf (in conjunction with U.S. Association of Global Automakers (âAssociationâ). See, Connected Cars and Privacy: Automotive industry adopts consumer privacy principles, DLA Piper, (Nov. 17, 2014), https://www.technologyslegaledge.com/2014/11/connected-cars-privacy-a u t o m o t i v e - i n d u s t r y - a d o p t s - c o n s u m e r - p r i v a c y -principles/#:~:text=The%20Privacy%20Principles%20aim%20to%20p r o v i d e % 2 0 a % 2 0 f r a m e w o r k , r e d u c i n g % 2 0 t r a f f i c % 2 0c o n g e s t i o n % 2 C % 2 0 c a l l i n g % 2 0 f o r % 2 0 e m e r g e n c y % 2 0assistance%2C%20etc. AUTO-ISAC, July 2016, https://automotiveisac.com/best-practices/. 663 AASHTO Connected and Automated Vehicle Policy Principles, AASHTO, (October 2021), https://cav.transportation.org/wp-content/uploads/sites/61/2021/11/CAV-Policy-Principles-v4-press.pdf. 664 NIST (National Institute of Standards and Technology), (part of U.S. Dept. of Commerce), https://www.nist.gov/privacy-framework. NHTSA, https://www.nhtsa.gov/technology-innovation/vehicle-data-privacy#:~:text=In%20the%20context%20of%20vehicle%20safe ty,under%20the%20Motor%20Vehic le%20Safe ty%20Act.&text=In%20the%20context%20of,Motor%20Vehicle%20Safety%20Act.&text=context%20of%20vehicle%20safety,under%20the%20Motor%20Vehicle. DHS, FIPPs, https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-pal consumer protection agency, the FTC enforces Section 5 of the Federal Trade Commission Act,649 which prohibits unfair or deceptive acts or practices in or affecting commerce. In the AV context, the FTC could, for example, use its Section 5 authority to take action against a company that makes deceptive claims about the performance capabilities or limitations of AVs or their component systems.650 The FTC could also use its Section 5 authority to take action against a company that makes deceptive claims with respect to consumer data that is collected, used, or maintained in connection with automated or connected vehicles or that has inadequate privacy or security practices. The FTC protects consumers with a variety of measuresâsuch as policy initiatives, including issuing reports or holding workshops.651Without comprehensive data protection legislation, Con-gress left it to the FTC to enforce and seek remedies in data reg-ulation cases in which settlements include corporate structural reforms that become de facto regulations by shaping corporate practices nationwide.652 State attorneys general (AGs) have also made policy via en-forcement settlements (including multistate ones)653 as well. However, regulation by settlement is not the same as regulation by formal rulemaking â which the FTC arguably may not do under the American Planning Association (APA) and the FTC Act.654 With unclear overlapping enforcement authority among federal agencies in the area of data protection, the FTC has limitations. The FTC has APA rulemaking power and enforcement authority under the Gramm-Leach-Bliley Act (GLBA) 655 and the Childrenâs Online Privacy Protection Act (COPPA),656 and has managed to act in formal rulemaking and bring enforcement actions under those statutes.657 However, federal law is unclear on its authority, 649 See FTC Act, 15 U.S.C. Sec. 45. (§Â5a governs data enforcement).650 NHTSA, supra note 10.651 Connected Cars Workshop, FTC, Staff Perspective, (Jan. 2018), https://www.ftc.gov/system/files/documents/reports/connected-cars-workshop-federal-trade-commission-staff-perspective/staff_perspective_connected_cars_0.pdf. 652 Elysa M Dishman, Settling Data Protection Law: Multistate Actions and National Policymaking, 72 Ala. L. Rev. 840 (2021).653 See Attorney General DeWine Announces $ 148 Million Multistate Settlement with Uber, Ohio Off. Attây Gen. (September 26, 2018), https://www.ohioattorneygeneral.gov/Media/News-Releases/September-2018/Attorney-General-DeWine-Announces-$148-Million-Mul [hereinafter Ohio AG Uber Press Release]. 654 See Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583, 620 (2014).655 Gramm-Leach -Bliley Act, GLBA, 15 U.S.C. §Â6801-6809 (1999); See 15 U.S.C. § 6804(a)(1)(C) (rulemaking authority); 15 U.S.C. § 6805(a)(7) (enforcement authority). The GLBA safeguard requirements mirror the FTCâs requirements for a comprehensive information security program. 16 C.F.R. §Â314.4 (2020).656 See 15 U.S.C. § 6502(b) (rulemaking authority); 15 U.S.C. §Â6505(a) (enforcement authority).657 See, e.g., Stipulated Order for Civil Penalties, Permanent Injunction, and Other Relief at 2, United States v. Musically, No. 2:19-cv-01439 (C.D. Cal. 2019) (COPPA); Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief, United States v. PLS Fin. Servs., Inc., No.1:12-cv-08334 (N.D. Ill. 2012) (GLBA, FCRA).
NCHRP LRD 91 55the expectation of privacy (not trespass) has continued to evolve â as have our technologies that track âthe whole of [our] physical movementsâ671 that are integral to privacy our daily lives. Although GPS use by law enforcement has some judicial rules for a Fourth Amendment application,672 real controversies that reflect current HAV locational data gathering technology and the aggregation of personal and other data collected by sys-tems such as an ADS have yet to be adjudicated. Law enforce-ment can easily aggregate or correlate personal information with other information and gain much knowledge about a per-sonâs daily routines, hobbies, and relationships with groups and businesses. The Court has attempted to evolve with technology in the privacy realm.673 Encroachment upon AV usersâ constitu-tional privacy interests, without any federal legislation, is inevi-table, but AV developers and regulators can hopefully anticipate how to protect these users.h. Surveillance of Vehicle DataIf L3-5 AVs connect remotely with other vehicles or smart infra structure, the government could observe, collect, use, or share data with other entities (within or outside of government).674 Personal identifiable information (PII) should be encrypted and rendered anonymous. With interconnected AVs communicating location and other data over a wireless network there is risk of unseen targeted surveillance. Establish-ing policy or regulation around access to an AV network might protect immediate remote access to the real time location of an AV and its user. Questions about how law enforcement, national security, developers, advertisers, and public and private agen-cies use or collect longitudinal records of past locations and how entities monetize this data will need answers. As of now, the US has no umbrella national data protection act similar to the Europeâs GDPR.675 Aside from the EDRâs, a driverâs synced cell phone contacts and messages are also data that may be collected by a manu facturerâs ADS. The ADS may also sync to a system within the home, which implicated the privacy of the home (not weaker privacy of an automobile). NHTSA has acknowledged this may happen with AVs.676 During comment periods on fed-eral AV policy, various commenters have raised concerns about 671 Carpenter v. US, 138 S. Ct. 2206, 2217 (2018).672 Jones v. US, 565 U.S. 400 (2012) (Court analyzed GPS use in the Fourth Amendment context).673 See Carpenter supra note 626, and also, Riley v. California, 573 U.S. 373, 393-94 (2014); United States v. Jones, 565 U.S. 400, 404-11 (2012). 674 Aaron Gordon, San Francisco Police Are Using Driverless Cars as Mobile Surveillance Cameras, Vice (May 11, 2022), (Avs are recording their surroundings continuously and have already used these to help San Francisco police investigations.), https://www.vice.com/en/article/v7dw8x/san-francisco-police-are-using-driverless-cars-as-mobile-surveillance-cameras. 675 GDPR Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ 119, 04.05.2016; cor. the OJ 127, 23.5.2018, https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng,pdf: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679. 676 See NHTSA, supra note 10 (2016 ed. at 17).vacy.665 However the states are the ones being proactive in this legal arena. f. State Privacy StatutesBroad state data privacy regulation may encompass many issues, such as: consumer data, biometric data, childrenâs pri-vacy, social media safety, data brokers, health data, automated decision tools, and algorithmic discrimination bills.666 g. Fourth Amendment and Privacy in AVsThe Fourth Amendments automobile exception gener-ally allows vehicles to be searched without a warrant because a vehicle is subject to search by law enforcement on the basis or probable cause only, rather than the usual basis of a search war-rant 667 This lower degree of protection is based partially on the policy need to afford law enforcement officials more discretion to act when a suspect, contraband or evidence or contraband is found in a traffic stop. The diminished expectation of privacy in vehicles is linked to our highly regulated use of public road-ways668 and the interests of the state in public safety. However, constitutional privacy and rights in AVs revolves arguably more around the data they will collect, use and share than the physical search concerns of the AV. Although criminal law will still be concerned with drunk or distracted drivers and traffic violations. For decades, the Fourth Amendment was focused on war-rantless search and seizure of a personâs property.669 However in 1976, the Courtâs questioned the concept of privacy and the trespass doctrine question, holding that the Fourth Amend-ment protects people, not places, and that while what someone knowingly exposes to the public is not protected by the Fourth Amendment, what they hold back as private is.670 This new era of practice-principles. Vehicle Data Privacy, Industry and Federal Efforts Under Way, but NHTSA Needs to Define Its Role, Government Accountability Office. (July 2017). Available at: https://www.gao.gov/assets/690/686284.pdf. FTC, June 28, 2017, https://www.ftc.gov/news-events/events/2017/06/connected-cars-privacy-security-issues-related-connected-automated-vehicles. 665 Federal Policy Framework for Our AV Future, AVIA (Autonomous Vehicle Industry Association) (Mar. 2023), https://theavindustry.org/. The U.S. Alliance of Automobile Manufacturers (âAllianceâ) with the U.S. Association of Global Automakers (âAssociationâ) published their âConsumer Privacy Protection Principlesâ (âPrinciplesâ) on 12 Nov. 12, 2014. See DLA Piper, supra note 205. 666 See David Stauss and Husch Blackwell, 2023 State Privacy Law Tracker, https://www.huschblackwell.com/2023-state-privacy-law-tracker (updated regularly). Note that these proliferating state privacy laws are prompting lawsuits now, particularly in California and Illinois. See Keir Lamont (FPF), State Privacy Updates â 7/7, Linked In Article, July 7, 2023, https://www.linkedin.com/pulse/state-privacy-updates-77-keir-lamont/ ?trackingId=5rER33xVQsCmLFu0sZYSwQ%3D%3D. 667 See, e.g., California v. Carney, 471 U.S. 386, 394-95 (1985).668 Lindsey Barrett, Herbie Fully Downloaded: Data-Driven Vehicles and the Automobile Exception, 106 The Geo. L. J., 181(2020).669 Katz v. United States, 389 U.S. 347, 352 (1967) (now called the Katz privacy test), citing Olmstead v. United States, 277 U.S. 438, 457 (1928); Goldman v. United States, 316 U.S. 129, 134 (1942).670 Id., See also Hresko Pearl, Tracy, The Fourth Amendment in the Age of Autonomous Vehicles (Mar. 3, 2022). Geo. Mason L. Rev, forthcoming, https://ssrn.com/abstract=4050909.
56 NCHRP LRD 91and/or data sharing, profiling, consent, sensitive data, childrenâs rights, and privacy policies.684While the WPA never became law, it appears to have in-fluenced bills in various states.685 Three of the six 2023 states (Indiana,686 Iowa,687 and Tennessee688) have passed bills with requirements that are more business-friendly than Virginiaâs law. Montanaâs bill aligns with the Connecticut law and, is more consumer friendly. Since they all follow the same model there is interoperability between the laws and passed bills. Rather than having chaos, we are seeing a controlled expansion of compre-hensive privacy laws across the US.689 j. Software and PrivacyPrivacy notices within ADS software connected to the vehicle components will need to be clear and accessible to con sumers. The state laws appear to cover privacy notices to a degree, however, software updates and warnings for vehicles are currently regulated by NHTSA under its recall authority.690 OEMs and third parties connected to the ADS will need to ex-amine data protection and data retention practices, including contracts related to software operation. Jurisdictional overlap regulating data security practices will need to stay current with state rules as they emerge or are revised by various authorities. Since federal overarching legislative action has yet to pass in the data privacy realm,691 various states may choose to continue to regulate data privacy issues.Legislation, with privacy by design and anonymization may be employed to help protect personal information collected and stored by AVs. Although AV simulation models are useful for AV design, data collection in the real-world is still essential to generating possible AV scenarios. This idea is called privacy by design692 in which companies choose to implement technical 684 For more see State Privacy Law comparison charts by Husch Blackwell, Iowa chart dated Mar. 15, 2023, https://www.bytebacklaw.com/wp-content/uploads/sites/631/2023/03/Iowa-Comparison-Chart.pdf. 685 Tennessee HB 1181, passed Apr. 21, 2023, https://www.capitol.tn.gov/Bills/113/Bill/HB1181.pdf. 686 Indiana SB 5, passed Apr. 13, 2023, https://iga.in.gov/legislative/2023/bills/senate/5#document-8806200c. 687 Iowa SF 262, passed Mar. 2023, https://www.legis.iowa.gov/legislation/BillBook?ga=90&ba=SF%20262. 688 Tennessee HB 1181, Tennessee Information Protection Act, passed Apr. 19, 2023, https://www.capitol.tn.gov/Bills/113/Bill/HB1181.pdf. 689 If you want to see charts comparing the laws and passed bills, visit https://lnkd.in/gRZm4hDz. 690 49 U.S.C. §Â30118a. (NHTSAâs recall authority is limited to non-compliances with motor vehicle safety standards and defects that present an unreasonable risk to safety.)691 In 2022, federal attempts at an omnibus data protection law that would preempt state data protection laws failed, https://www.datameetsworld.com/blog/proposed-federal-data-protection-law-amended-and-advanced-for-a-full-chamber-vote-in-the-house. See also https://www.politico.com/news/2023/02/22/statehouses-privacy-law-cybersecurity-00083775. 692 GDPR, art. 25. (Note that U.S. made vehicles operating in the EU and collecting data will be subject to âprivacy by designâ principles in uncertainty on what data will be collected and how consumers would limit or control the data collected.677i.. State Privacy Laws Approach A UniformityFor AV operators, AV OEMs, AV developers and AV com-ponent parts suppliers, ensuring compliance with each stateâs consumer privacy laws may be a challenge, however, state pri-vacy laws appear to be following a similar pattern. The com-prehensive consumer privacy bills are mostly following the same model set in the Virginia Consumer Data Protection Act (VCDPA)678 and the 2021 Washington Privacy Act (WPA) model (which never became law).679 Although some privacy laws appear to be more business-friendly680 (Indiana,681 Iowa,682 and Tennessee683) than Virginiaâs law, each state privacy law has various provisions/ elements in common: data access, algorithm discrimination, opt out of sale, opt out of targeted advertising 677 See e.g., Lauren Smith, Future of Privacy Forum, Comment Letter on Proposed Rule Federal Motor Vehicle Safety Standards; V2V Communications 4-6 (Apr. 12, 2017), https://fpf.org/wp-content/ uploads/2017/04/FPF-Comments-on-V2V_041217 Final.pdf [https://perma.cc/6WRG-5E4U] (noting concerns about the opacity of privacy policies governing the use of V2V data, and the risk of third-party access to BSM data); See also Leonid Reyzin et al., Center for Democracy & Technology, Comment Letter on Proposed Rule Federal Motor Vehicle Safety Standards; V2V Communications 1 (Apr. 12, 2017), https://www.ftc.gov/system/files/documents/public comments/2017/04/00008-140526.pdf [http://perma. cc/35MJ-KVRQ] (âOur concern is that the privacy protections currently proposed for V2V communications may be easily circumvented by any party determined to perform large-scale real-time tracking of multiple vehicles at once. This poses a serious costs [sic] for both individual privacy and society at large, and we caution that the proposed privacy statement does not adequately disclose these threats to consumers.â); Lauren Smith, Future of Privacy Forum, Comment Letter on Proposed Rule Federal Motor Vehicle Safety Standards; V2V Communications 4-6 (Apr. 12, 2017), https://fpf.org/wp-content/ uploads/2017/04/FPF-Comments-on-V2V_041217_Final.pdf [https://perma.cc/6WRG-5E4U] (noting concerns about the opacity of privacy policies governing the use of V2V data, and the risk of third-party access to BSM data).678 Virginia Consumer Data Protection Act (VCDPA), passed Mar. 2, 2021, (amended Code of Virginia by adding Title 59.1, Ch. 52), see bill: h t t p s : / / l i s . v i r g i n i a . g o v / c g i - b i n / l e g p 6 0 4 .exe?212+sum+HB2307. ( California had previously passed a comprehensive privacy law in 2018 under pressure from a possible ballot initiative); See also https://iapp.org/news/a/virginia-passes-the- consumer-data-protection-act/. 679 Davis Stauss, Husch Blackwell Privacy Law tracker website, (although the Washington privacy law model took time to pass, its precepts were used to draft various other statesâ laws). https://www.bytebacklaw.com/2022/04/connecticut-legislature-passes-consumer-privacy-act/#more-3886. 680 Id.681 Indiana SB 5, passed Apr. 13, 2023, https://iga.in.gov/legisla-tive/2023/bills/senate/5#document-8806200c; https://www. natlawreview.com/article/follow-leader-indiana-becomes-latest-state-to-enact- consumer-privacy-statute (discussing Indiana SB 5).682 Iowa SF 262, passed Mar. 2023, https://www.legis.iowa.gov/legislation/BillBook?ga=90&ba=SF%20262. 683 Tennessee HB 1181, Tennessee Information Protection Act, passed Apr. 19, 2023, https://www.capitol.tn.gov/Bills/113/Bill/HB1181.pdf.
NCHRP LRD 91 57as well as international laws697 such as the GDPR in EU. Privacy regimes and data protection in various states and countries are not uniform, but the tech industry has already been wrestling with disclosure, breaches and consumer consent issues in the software arena. Privacy and data collection / sharing from AVs and connected vehicles is another area needing in-depth re-search, as this area is changing rapidly with proliferating state privacy laws, international frameworks,698 and AV camera/ driver monitoring use.699 As software harms move beyond just economic loss and into personal injury, courts will need to reexamine language that limits a software developerâs liability for defective software. Pub-lic policy choices about how liability will be shared between the human driver and the ADS will need more examination. Contract law has mostly handled these limited liability soft-ware issues to a degree, with strong licensing agreements be-tween the user and software developers reducing liability.700 Note that where automation, software, and tort liability intersect with product liability, these issues of contract and tort law may belong mostly to the state law domain. However, software devel-opers and hardware manufacturers may both be held liable for an AV that causes physical injury or property damage. Software developers may enjoy more protection than medical device companies for now, but fatalities are likely to increase once full deployment of AVs on public roads begins with a mix of traffic, automation levels and types of drivers. The automotive industry has already seen that improper patches for software, if they land in court at all, can generate expensive lawsuits. 701697 Nevada Online Privacy Law, NRS 603A (last amended by SB260 in June 2021); California Consumer Privacy Act of 2018 (CCPA) [1798.100-1798.199.100], and Regulations 11 Cal. Code Regs. 999.300 et seq.698 Press Release, European Commission, Data Protection: European Commission adopts new adequacy decision for safe and trusted EU-US data Flows, (July 10, 2023). (The EU-U.S. Data Privacy Framework introduces new binding safeguards to address all the concerns raised by the European Court of Justice. Rules on Personal data flow from the EU to US is detailed in this framework.), https://ec.europa.eu/commission/presscorner/detail/en/ip_23_3721. 699 Tesla to warn of data privacy risk from car security cameras in Germany, Automotive News Europe, (April 5, 2023), https://www.reuters.com/technology/tesla-workers-shared-sensitive-images-recorded-by-customer-cars-2023-04-06/. 700 See F. Patrick Hubbard, âSophisticated Robotsâ: Balancing Liability, Regulation, and Innovation, 66 Fla. L. Rev. 1803, 1813 (2014). (âContract law and tort law are largely matters of state law.â)701 See, Hearing on Response by Toyota and NHTSA to Incidents of Sudden Unintended AccelerationÂBefore the Committee on Energy and Commerce Subcommittee on Oversight and Investigations U.S. House Of Representatives, (Feb. 23, 2010), (Statement of The Honorable Ray LaHood Secretary Of Transportation). (Starting in 2010, recalls possibly involving Toyotaâs electronic throttle control (ETC) systems on the brakes and unintended acceleration were examined in House hearings in 2010), https://www.transportation.gov/testimony/response-toyota-and-nhtsa-incidents-sudden-unintended-acceleration. See Hoganâs Petition for Defect InvestigationâToyota Hybrid Brake Failures Causing Crashes and Injury, (Sept. 19, 2019), https://static.nhtsa.gov/odi/inv/2019/INBC-DP19004-77358.pdf. See Roger Hogan v Toyota Motor Sales, USA Inc., Cal. Super. 4th Dist., Complaint at 3, filed July and procedural measures at the start of the product develop-ment, to ensure privacy right from the beginning. Governments could provide legal definitions and standards for privacy leaks or security risks to support privacy protections from start until the validation phase (field and safety tests). In other privacy frameworks, such as the GDPR, data minimization principles, i.e., limiting of personal data collection is mandatory.693 Note that data collected by AVs will also be possibly shared with third parties and many privacy laws will require consent from the data subject before sharing information. How or if data will be anonymized will be an important part of privacy law moving forward. k. International and Cross-Border Privacy GapsThe patchwork of state privacy laws and the various areas to which they are limited694 may make data collection and trans-fers via AVs a complicated legal area for International OEMs to comply with in the USA in the future. As cross-border data transfers make news695 and international privacy concerns and laws696 affect the USA, the privacy of data transfers involving connected transportation infrastructure and vehicles will need more attention and legal gap analysis.The subject of privacy and AVs needs to be examined in-depth due to the many facets and parties involved in the combi-nation of hardware and software. The large amounts of data pro-cessed by an AV create cyber vulnerabilities in both a privacy and a cybersecurity perspective. This vulnerability of connected data will also involve government-owned transportation infra-structure in the processing, storage and transfer of PII under different state privacy laws - if a state has passed one. Legisla-tors creating state laws in this arena will have to consider how vehicles cross international and state borders. This means state and federal laws will need to consider other state privacy laws art. 25.) See also Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, which also encompasses this idea. 693 GDPR, Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ L 119, 04.05.2016; cor. the OJ 127, 23.5.2018, https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng.pdf: h t t p s : / / e u r - l e x . e u r o p a . e u / l e g a l - c o n t e n t / E N / T X T /PDF/?uri=CELEX:32016R0679. 694 Social security numbers, identification, financial account information health insurance information, medical information, and personal identifiable information collected from children are among the areas with targeted laws on personal information data. 695 David Shepardson and Philip Blenkinsop, Biden signs order to implement EU-US data privacy framework, Reuters, (Oct. 8, 2022). See also Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities, (Oct. 7, 2022) https://www.whitehouse.gov/briefing-room/presidential-actions/2022/10/07/executive-order-on-enhancing-safeguards-for-united-states-signals-intelligence-activities/. 696 GDPR, Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ 119, 04.05.2016; cor. the OJ 127, 23.5.2018, https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng, pdf: h t t p s : / / e u r - l e x . e u r o p a . e u / l e g a l - c o n t e n t / E N / T X T /PDF/?uri=CELEX:32016R0679.
58 NCHRP LRD 91updated its general data breach notification law in HB 5310708 and Texas updated its law in June, 2021.709 Both Utah and Connecticut have enacted laws providing that certain types of cybersecurity programs/requirements may be the basis for an affirmative defense against data breach lawsuits710 These laws, as well as Ohioâs law,711 include national and international cyber-security frameworks that satisfy the lawsâ requirements, such as: NIST SP 800-171,712800-53713 and 800-53a;714 the ISO/IEC 27000 family of standards;715 the FedRAMP Security Assess-ment Framework;716 the Center for Internet Securityâs Critical Security Controls for Effective Cyber Defense framework;717 708 Connecticut Public Act 21-59 (2021), https://www.cga.ct.gov/2021/act/Pa/pdf/2021PA-00059-R00HB-05310-PA.PDF (amended law applies to any entity that âowns, licenses or maintains computerized data that includes personal informationâ of Connecticut residents and has an expanded definition of covered âpersonal information,â which includes biometric information, aligning Connecticut with trends in other states). See also HB 5310, https://www.cga.ct.gov/2021/TOB/H/PDF/2021HB-05310-R00-HB.PDF. 709 HB 3746, https://legiscan.com/TX/text/HB3746/id/2406873. 710 Utah Cybersecurity Affirmative Defense Act, Utah Code § 78B-4-701, https://le.utah.gov/~2021/bills/hbillenr/HB0080.pdf. Connecticutâs Act Incentivizing the Adoption of Cybersecurity Standards for Business, Public Act 21-119, https://www.cga.ct.gov/2021/ACT/PA/PDF/2021PA-00119-R00HB-06607-PA.PDF, (adding safe harbors from tort liability and requiring various safeguards which include physical safeguards).711 Ohio SB 220 (2018), O.R.C. §Â1354.01-1354.05.712 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Computer Security Resource Center (CSRC),. NIST SP800-171 Rev. 2. (January 28, 2021), https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final. 713 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Computer Security Resource Center (CSRC), NIST SP800-171 Rev. 5. (February 2020), https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final. 714 Id.715 ISO/IEC 27001 Information Security Management Systems, International Standards Organization, Published Stage 60.60. https : / /w w w.iso.org/ isoiec-27001- informat ion-secur ity.h t m l # : ~ : t e x t = I S O % 2 F I E C % 2 0 2 7 0 0 1 % 2 0 i s % 2 0 t h e % 2 0world%E2%80%99s%20best-known%20standard%20for,a%20dozen%20standards%20in%20the%20ISO%2FIEC%2027000%20family. 716 The Federal Risk and Authorization Management Program (FedRAMP) provides U.S. federal agencies and their vendors with a standardized set of best practices to assess, adopt, and monitor the use of cloud-based technology services under the Federal Information Security Management Act (FISMA) (securing cloud technologies among U.S. government agencies). The goal of FedRAMP is to protect government data in cloud environments and strengthen agenciesâ IT security. The program requires all cloud systems that process or transmit government data to include security controls that comply with FedRAMP standards. FedRAMP standards are jointly implemented and governed by the U.S. Department of Homeland Security (DHS), the Department of Defense (DoD), the General Services Administration (GSA), and several other entities, https://www.fedramp.gov/governance/. 717 The CIS Controls (aka. the Center for Internet Security Critical Security Controls for Effective Cyber Defense) is a publication of best practice guidelines for computer security. Owned by the (nonprofit) Center for Internet Security (CIS) since 2015, https://www.cisecurity.org/controls. 5. Cybersecurity and Data Breaches in AVsa. Federal CybersecurityAlthough NHTSAâs safety regulations and voluntary guid-ance apply primarily to manufacturers of motor vehicles and vehicle equipment, it does not have a unique role or specific authority to regulate consumer privacy or third parties in the context of motor vehicles or vehicle data.702 The FTC is the primary federal agency tasked with protecting consumer pri-vacy and personal information.703 However, the cybersecurity of ADS within AVs must be addressed by NHTSA within its recall role.704 In the 2020 SELF DRIVE Act bill, several cyber-security provisions were included, with an FTC study examin-ing which entities in the ecosystem have access to vehicle owner or occupant data and have privacy plans.705 The 2020 bill further required the FTC to give a study report on several cybersecurity issues to the House and Senate. The bill also required the FTC to enforce the provision banning the sale of an AV that has no privacy plan.706 b. Statesâ Role in AV CybersecurityStates also create their own laws to prevent data breaches, as well as notifying the public once a breach has occurred to pre-vent identity theft and other damage. These laws are connected to the various state tort law frameworks. There are limited state data breach notification laws that often distinguish between who is responsible or liable for privacy and data breaches, dis-tinguishing between government and commercially handled data, with penalties attached.707 This data regulation is on the back end, after a breach has occurred, however. Various states have passed data breach notification laws, and some are updat-ing them to be encompass broader types of data that could be collected by AVs. Government, OEMs, and third parties using ADS vehicles should consider these state laws in creating legal frameworks for AV deployment. For example Connecticut has 25, 2017, The antiquated system Toyota put in place for its dealers made it difficult, if not impossible, for dealers to identify open recalls. See also https://www.businesswire.com/news/home/20170725006511/en/Prominent-Toyota-Dealer-Roger-Hogan-Sues-Toyota. See also Ralph Vartabedian. Toyota ordered to pay auto dealer $15.8 million in trial over Prius defects, Los Angeles Times, (July 15, 2019), https://www.latimes.com/local/california/la-fi-toyota-prius-verdict-20190715-story.html. 702 NHTSA, https://www.nhtsa.gov/technology-innovation/vehicle-data-privacy.703 Protecting Consumer Privacy and Security Topics, Federal Trade Commission, https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security. 704 Id.705 See HB 8350, § 12 (a)(4)(b) (requiring FTC study of AV manufacturer privacy plans); See Federal Autonomous Vehicle Bill Includes Detailed Privacy, Cybersecurity Requirements, JDSupra (Sept. 28, 2020), https://www.jdsupra.com/legalnews/federal-autonomous-vehicle-bill-45330/. 706 HB 8350, §Â12 (c) (FTC Enforcement).707 State Data Breach Notification Chart, IAPP (Mar. 2021), https://iapp.org/resources/article/state-data-breach-notification-chart/. See also NCSL database, supra note 227.
