If this law required the boxes to be installed surreptitiously (like they are now), or stipulated that the data on the boxes belonged to the government, or stipulated that they RF backhaul the data back to some central government computer, that would indeed be cause for alarm.
But this bill does the exact opposite of that.
So there are benefits here, and the public is more educated about the risks. Another benefit of the Senate legislation is that it applies to all EDRs in cars, so folks who put EDRs into your car today and do sell information to third parties (I'm looking at you OnStar) will also be bound by this.
So a more reasonable story might have been:
EDRs are in a lot of vehicles now, they represent both a privacy threat and a potential benefit. There are no explicit rules around what folks can do with them. Your government is 'fixing' that by making explicit what can and can not be done. Generally that would be an encouraging sign, and participating early in the process will help ensure its done in the best interest of the consumer rather than the installer.
Regarding your last sentence though: a likely trend may arise where all EULAs for modern cars include giving consent to the manufacturer to do what they please with the information from the EDR.
This would bypass the discussed bill because the bill allows you to give such consent. I think most people wouldn't be in an uproar about this. Thereby making this bill rather irrelevant; at least tooth-less against protecting the data.
Unlike CISPA, however, it means assholes who drive 70MPH down residential side streets in Benzes will be accountable when they cause accidents (Benzes don't have EDRs now). In other words: unlike CISPA, it actually does what it sets out to do.
That's enough of a win for me.