The law appears to be worded with no such stipulation. Which means it's up to the manufacturer how and where they process the data. The odds of the data being processed locally to the car are long.
Which does give rise to some questions:
if the car can't get a data connection, and therefore can't get the data analysed, will it assume the driver is incapacitated and refuse to start? If not, circumvention is simple.
If the manufacturer's servers have an issue, will the car refuse to start?
Will the data be the property of the driver, not the manufacturer? (hahaha, I'm kidding, of course the data will belong to the manufacturer, ready to be sold to anyone who wants it)
edit: clarified first question