Full story
GM privacy settlement
General Motors agreed to pay $12.75 million in civil penalties and stop selling driving data to consumer reporting agencies for five years as part of a privacy settlement announced by California Attorney General Rob Bonta and other California prosecutors.
“agreed to pay $12.75 million in civil penalties and to stop selling driving data to any consumer reporting agencies for five years”
The settlement centers on GM’s OnStar program, which the Bonta office says involved GM selling “names, contact details, geolocation data, and driver behavior data” of hundreds of thousands of Californians to data brokers Verisk Analytics and LexisNexis Risk Solutions.
TechCrunch reported that the settlement also requires GM to delete any retained driver data within 180 days if consent is not obtained, and to urge LexisNexis and Verisk to delete the data.
TechCrunch further said Bonta’s office stated the data did not lead to higher insurance prices in California, “likely because state law prohibits insurers from using driving data to set rates.”
Officials and legal pressure
At a news conference in Oakland, Calif., Bonta said, “General Motors sold the data of California drivers without their knowledge or consent,” and he added that the “trove of information included precise and personal location data that could identify the everyday habits and movements of Californians.”
San Francisco County District Attorney Brooke Jenkins said, “Californians must have confidence that they know what data is being collected, how it is being used and what their opt-out rights are,” framing the duties as falling on automobile companies.
The settlement was announced alongside San Francisco County District Attorney Brooke Jenkins, Los Angeles County District Attorney Nathan J. Hochman, Napa County District Attorney Allison Haley and Sonoma County District Attorney Carla Rodriguez, with CalPrivacy describing it as the largest California Consumer Privacy Act penalty in the state’s history to date.
Action News Now also reported that the investigation found GM sold the names, contact information, geolocation data and driving behavior data of hundreds of thousands of Californians to 2 data brokers, Verisk Analytics, Inc. and LexisNexis Risk Solutions, and that GM reportedly made approximately $20 million nationwide from these sales.
What changes next
The settlement is subject to court approval and requires GM to stop selling driving data to any consumer reporting agencies for five years, while also requiring GM to delete driving data retained by the company within 180 days except for limited internal uses.
“stop selling driver data to consumer reporting agencies, including data brokers, for five years”
Spectrum News said the agreement includes restrictions on GM’s use of consumer driving data and a ban on such data being sold to data brokers, and it described the case as involving “data that not only shows how a person drove but also precisely where they drove.”
The Record from Recorded Future News reported that the settlement also requires GM to establish a privacy program to analyze, fix and document risks related to collecting data from its OnStar product, with assessments reported to California prosecutors and the California Privacy Protection Agency.
CalMatters added that starting August 1, the more than 500 data brokers registered with the state must comply with requests California residents can make using the Delete Request and Opt-out Platform, or DROP, which the privacy protection agency introduced earlier this year.
