General Motors has agreed to pay $220 million to a coalition of 36 US attorneys general, according to an announcement from the New York Attorney General on 29 October. Investigators found that from 2016 to 2024 GM sold data from its Smart Driver programme, such as braking, acceleration and driving times, to data brokers, and the information ended up with insurance companies. In many cases drivers were enrolled at dealerships without meaningful consent. GM will limit the data it collects and run a privacy programme with internal and third-party assessments.

What it means: The case is one of the largest in the US over connected-car data and shows how sensitive vehicle telemetry is now considered. Driving data can affect premiums, risk scores and other decisions about a driver, without the driver knowing where they came from. The main problem the prosecutors identified was not only the sale but the enrolment process: a single form for several services, sales staff paid bonuses per sign-up, and an app that showed the wrong status to hundreds of thousands of drivers. In Europe, a similar practice would run into the GDPR, which requires clear and specific consent for this kind of use, and the new Data Act, which gives users of connected devices rights to access and control their data. For car dealers, insurers and fleet management companies in Greece, the lesson is that consent must come from the customer, separately for each purpose, and be recorded. Anyone buying data from third parties needs to check how it was collected, because liability does not stop with the original collector. Sales incentives that reward the number of sign-ups are turning out to be a legal risk.

Read the original on New York Attorney General

Related service: myDATA integrations

Related stories