Security and Privacy in Your Car Act of 2019 or the SPY Car Act of 2019

This bill requires the National Highway Traffic Safety Administration (NHTSA) to establish cybersecurity standards for motor vehicles.

Specifically, the bill directs

• the NHTSA to issue regulations that require motor vehicles manufactured for sale in the United States to protect against unauthorized access to electronic controls, critical software systems, or driving data;
• the NHTSA to require the fuel economy labeling that manufacturers attach to motor vehicles to display a cyber dashboard with a standardized graphic to inform consumers about the extent to which the vehicle protects individuals' cybersecurity and privacy beyond the minimum requirements; and
• the Federal Trade Commission to require manufacturers to notify owners or lessees about the collection, retention and use of driving data and provide an option to terminate such data collection and retention, and to prohibit manufacturers from using such data for advertising or marketing without the owner's or lessee's consent.

The Federal Highway Administration must (1) develop a tool to assist transportation authorities in identifying, detecting, protecting against, responding to, and recovering from cyber incidents; and (2) designate a cyber coordinator to monitor, alert, and advise transportation officials of cyber incidents.