AVs shall not sell or distribute personally identifiable information of any person to any third parties without their explicit consent.

• AVs generate tremendous amounts of data that may reveal intimate details of its passengers’ private lives. AVs must not provide any personally identifiable information to any third parties without explicit permission on a per-transaction basis. (In other words, AV passengers must opt-in to data release each and every time it has been collected by an AV.)

• The scope of the third-party data distribution prohibition must include not only the authorized user but also other passengers, occupants, and other persons who may have been identified by, for example, facial recognition algorithms.

AV OEMs, their agents, representatives, and dealers shall assume legal responsibility and liability for safe AV operation. In no case shall a vehicle occupant who is not actively driving an AV be held responsible for the actions or consequences of its automated controls.

• Liability for AV operation must lie with the entity that is controlling the vehicle. If no occupant is directly controlling the vehicle, then the liability must be vested in those who designed, built, and introduced the vehicle into commerce
• No one who is not actually controlling an AV may be held liable for its operation any more than a passenger in a taxi is responsible for its safe operation.

AVs shall collect and report operational data to support research and development to improve safety, performance, and reliability.

• As a quid pro quo for licensing or permission to operate on public roads and to assess the impact of AVs on highway safety, AVs must record and report on demand of responsible investigators video, parametric, and dynamic vehicle operational data needed to objectively determine AV safety, safety metrics, and safety trends.
• AVs must expedite and not make it difficult or impossible for responsible third-party requests to recover or interpret data supporting investigations of failures, fires, crashes, or cybersecurity violations.