The only thing holding me back from a yes vote is the availability of detailed location data to 3rd parties. Can a mechanic sell this data? Can it be subpoenaed by police?
I think one way to read the decrease in volume is that - yea it'd sure be nice if six fewer dealerships had access to this information, so why don't we make sure they all get forced to close their doors because the automakers don't want competition - there would be fewer in count, but that doesn't really speak to the security of that data at all (additionally, most of the sensitive data you probably care about doesn't appear to be on the table for this bill - specifically telemetry about driving habits doesn't appear to be under consideration)
https://ballotpedia.org/Massachusetts_Question_1,_%22Right_t...
It just paints a big fat target on Toyota that screams "compromise us, we have so much PII it's almost embarrasing"
Actually, if the data is only accessible to a few authorized shops, that's when the data is especially likely to be sold. Data is really only valuable in aggregate - if more shops can service cars, then each shop really gets less access to aggregated car data. More choice means less centralization of the data which means it's more difficult to collect enough data for it to be sold.
I think the car manufacturers are the ones who are hoping to monetize the data, and that's why they're trying to restrict access.
I'd really rather my car not gather that much data to start with. My phone provides all the mobile compute and navigation (and privacy invasion) I need. I don't think historical telemetry data of any kind is going to deliver extra value to me, the car owner. Every extra feature in a car is just another thing that breaks.
Worse, it doesn't give you extra value, it detracts value. It's info about you, out of your control, yet unlike gmail, which is free, you've paid cold hard cash to be tracked.
I think what we need is just an "everything" bill. If you pay ANYTHING for the hardware, then you control EVERYTHING.
The full stack. You can't sell it, the code isn't yours, but by rights you get the full dev kit for the entire OS.
This is the only way forward. The only way to stop all spying, show everything malicious being done to end users, and ensure I can repair anything borked down the road.
I have my doubts re: reason, for it wasn't excessive, but point taken.
Do you mean because now some OnStar type API must be documented "for repair"? (if so, I'd argue that security through obscurity is little to no security at all and I'd hope that your API is properly secured. For example just because the Google email API is documented doesn't mean people suddenly can read my email!)