The Alliance for Automotive Innovation (Auto Innovators) has filed suit to challenge Maine Attorney General Aaron Frey over the enforcement of its 2023 Data Law because the “independent entity” it calls for doesn’t exist.

A news release from Auto Innovators references a portion of the complaint that states the entity is meant to “develop and administer data access to vehicles.” The complaint was filed in U.S. District Court for the District of Maine.

Beginning Jan. 5, automakers must provide access “through a mobile-based application” to an “inter-operable, standardized, and owner-authorized access platform across all of the manufacturer’s makes and models,” according to the complaint.

The release notes that the law states the “platform must be capable of securely communicating all mechanical data emanating directly from the motor vehicle via direct data connection to the platform” and requires Maine’s attorney general to “designate an independent entity… to establish and administer access to vehicle-generated data… transmitted by [that] standardized access platform.”

“This is an example of putting the cart before the horse,” Auto Innovators said in the release. “Before automakers can comply, the law requires the attorney general to first establish an ‘independent entity’ to securely administer access to vehicle data. The independent entity hasn’t been established. That’s not in dispute. Compliance with the law right now is not possible.

“This Data Law is commonly (but wrongly) characterized as an effort to guarantee vehicle ‘right to repair’ in Maine. That already exists. Mainers can have their car repaired by any repair shop they choose. All the information needed to diagnose and repair a vehicle today is also already made available to all vehicle repair shops.”

Auto Innovators seeks declaratory and injunctive relief through its lawsuit.

“Because compliance with the Data Law is impossible and the Data Law is unconstitutionally vague, the Data Law violates due process and harms vehicle manufacturers,” the complaint states. “Moreover, any means of compliance with the law that does not ensure cybersecurity, including any compliance strategies without the establishment of the ‘independent entity,’ is preempted by federal law.

“[V]ehicle manufacturers have developed and implemented hardware- and software-based security measures in their vehicles to ensure the integrity of their vehicle systems and the data contained on them. These security measures are intended to ensure that, inter alia, nefarious actors cannot remotely access or alter vehicle systems and data that control safety-critical functions, such as acceleration, braking, steering, and airbag deployment. However, access to vehicle systems and the accompanying security for that access is not subject to any particular or precise standard currently existing, and generally is administered by vehicle manufacturers themselves.”

Auto Innovators argues that the Data Law “directly conflicts with the requirements, purposes, and objectives of the National Traffic and Motor Vehicle Safety Act… and its regulations.”

To comply with Section 1 of the Data Law having to do with access via OBD II ports, Auto Innovators says in the complaint that OEMs would have to remove vehicle cybersecurity protections, which can’t be done under the Vehicle Safety Act, “thereby preempting immediate enforcement.”

“Acting on his view of the Data Law’s effectiveness, the Attorney General has issued a notice to Maine dealerships stating that as of January 5, 2025, vehicles sold in Maine would need to be equipped with the ‘platform’ that Subsection 6 mandates (but that no ‘independent entity’ has created). The notice also stated that the platform would need to communicate data securely through a direct data connection to the platform — even though Subsection 2 states that the ‘independent entity’ (which does not exist) must establish and administer access to that data. Thus, the foundational premise of that notice does not yet exist.

“Nevertheless, the Attorney General has mandated that dealers must deliver that notice to prospective owners of motor vehicles, ensure that those owners have read the notice, and obtain their signature.”

For automakers to comply with the law, the complaint states that the following would have to occur first:

• • “The Attorney General must have designated the relevant ‘independent entity;’
  • “The independent entity must have established and begun to administer access to vehicles through the ‘standardized access’ platform that the Data Law contemplates, having adopted standards and policies to ensure that such access would be consistent with laws, regulations, standards, and best practices regarding access for motor vehicle data; and
  • Automakers given the chance “to implement that a ‘standardized access’ platform in their vehicles.”

The Data Law and “right to repair” have been under debate by the Maine Right to Repair Working Group since August. The law was approved by referendum in November 2023 and formed the working group.

The group’s responsibility is to propose amendments that should be made to the Data Law and make recommendations to the legislature on what the independent entity should do. A report from the group that includes those recommendations is due to the legislature by Feb. 28.

The group’s next meeting is Feb. 12, and it’s expected the report will be finalized at that time.

In December, a state legislator and two automotive industry associations took issue with the group’s draft recommendations to amend the R2R law and carve out the responsibilities of a future commission that will handle vehicle data sharing in the state.

Rep. Tiffany Roberts (D-District 149) said “the overarching statute, while well-intentioned, is rife with ambiguities, potential conflicts with federal oversight, and cybersecurity risks.”

“I would urge the group to look at each stakeholder’s comment in the context of the statutory charge,” she said.

“The law’s telematics access provisions are a cornerstone of the debate, which has been very clear today but their necessity and practicality are questionable. As outlined in the GAO’s report, most vehicles repaired today do not require telematics data. Essential diagnostics information is already accessible through the onboard diagnostic port, or the OBD port. This raises a fundamental question: Why does Maine’s law emphasize telematics access when the industry and repair stakeholders agree it’s not currently essential?”

Group members and the public have voiced privacy and cybersecurity concerns via third-party access since the group first met.

Images

Featured image credit: ridvan_celik/iStock

More information

Auto Innovators, Mass. AG debate recalling witnesses in ‘right to repair’ case