General Motors said Friday it is severing ties with two data brokers following a lawsuit that connected the automaker to sharing driver data that resulted in higher auto insurance rates for that plaintiff.
In a lawsuit filed March 13, Romeo Chicco of Florida claims GM, its connected-services subsidiary OnStar and data and analytics company LexisNexis Risk Solutions violated privacy and consumer protection laws.
Chicco alleges GM captured and shared his driving data — which included information about his speeding, braking and acceleration — with LexisNexis, which then shared it with insurers. The complaint, filed in the U.S. District Court Southern District of Florida, seeks class-action status.
Chicco's lawsuit accuses the parties of gathering, "erroneous reports of derogatory and negative driving information made without Plaintiff’s knowing consent. Additionally, this illegal transfer and publication of data constitutes an invasion of privacy" and the defendants' collective action caused Chicco "significant emotional distress."
The lawsuit could be the first of many, legal experts said.
"Sharing data without consent is bad," said David Vladeck, former director of the Federal Trade Commission's Bureau of Consumer Protection during President Barack Obama's first term and a law professor at Georgetown University. "There will be cases coming down the pike. This is a serious breach by the car companies. It’s a breach of confidentiality and there are financial consequences.”
A 'standard rotten thing'
GM said it shares limited data with insurers through a third party, which is collected through the OnStar Smart Driver program, after a customer consents to it three times. That OnStar program is optional. It monitors driving habits to help reduce wear-and-tear on the car and improve driving safety and customers can unenroll at any time.
On Friday, GM spokesman Kevin Kelly declined to comment on the lawsuit, but he sent the Detroit Free Press the following statement: "As of March 20th, OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk.Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies."
Kelly declined to provide any further information as to how long GM has done business with LexisNexis and Verisk, which is also a data analytics firm that collects and shares data to help businesses manage risk, or why GM severed ties at this time.
The practice of using data for purposes that are not made clear in the consent, is widespread across many industries, said Erik Gordon, a professor at the Ross School of Business at the University of Michigan — and a lawyer.
"It’s not just car companies. The fine print of disclosing data is used by cable companies, almost any app you download, loyalty programs by retailers. …. What the core of the plaintiff’s complaint is, is that the law allows data gathers, date resellers and data brokers to do things using fine print, in language that isn’t clear to the data-givers," Gordon said.
He believes this case will be settled, but if it proceeds to trial and the plaintiff wins, "there will be a rash of lawsuits" against automakers and others.
"What GM is doing here is the standard rotten thing that most companies do and that the government should step in and protect us against," said Gordon.
'Little to no oversight'
In December, Sen. Edward Markey, D-Mass., asked the Federal Trade Commission to investigate the data privacy practices of 14 automakers. "Automakers are collecting large amounts of data on drivers, passengers, and even people outside the vehicle, with little to no oversight," Markey said.
Chicco's lawyer, Ryan McBride of San Diego-based Kazerouni Law Group, declined to comment on the lawsuit or make Chicco available.
LexisNexis Risk Solutions' website said the company analyzes data that it sells to insurers and others to help them manage risk. It did not respond to a request for a comment.
Verisk did not immediately respond with a comment to GM severing ties with it.
The lawsuit follows a recent investigation by The New York Timesthat found many automakers have been sharing customers' driving information with the insurance industry, leading to higher rates for some drivers.
A decline of OnStar services
The 36-page lawsuit stated that on Nov. 16, 2021, Chicco bought a new 2021 Cadillac XT6 SUV in Delray Beach, Florida, and that the purchase agreement made no mention of OnStar, LexisNexis, data-sharing, or anything privacy-related.
Chicco downloaded the MyCadillac App to his cellphone, the lawsuit stated. Days later, Chicco received an email offering him a Cadillac Connected Services trial and OnStar Safety and Security Coverage. It instructed him to hit the blue OnStar button to activate the services, which he never did because he said he did not want them.
The lawsuit said the email did not mention OnStar's Smart Driver program — for which, according to www.onstar.com, "there is no charge for customers to enroll." It is available as part of "Connected Access."
OnStar states: "With customer consent, we share select OnStar Smart Driver insights about driving behavior with LexisNexis and Verisk, third-party telematics exchange companies that work with some insurance carriers" and, it adds, "insights about driving behavior are only shared with an insurance carrier with your explicit consent."
A record of 258 driving trips
The lawsuit contends that Chicco never enrolled in any OnStar services and he never consented for his driving data to be shared.
Yet in December 2023, he called Liberty Mutual to ask why he was rejected for insurance. An agent said it was because of information in Chicco's LexisNexis report. Chicco got a copy of his LexisNexis report and it contained details of about 258 trips he had taken in his Cadillac in recent months, the lawsuit stated. It included the "acceleration events, hard brake events, high speed events," the lawsuit stated.
"Notably absent from the consumer report is any context related to these driving events," the complaint said.
Chicco said he called GM and LexisNexis several times to find out why his data had been collected without his consent, the lawsuit said. Eventually, he was told that his data came through OnStar because he had enrolled in OnStar’s Smart Driver program and he had an OnStar account. Chicco said he never enrolled in OnStar nor consented to sharing his driving data.
The complaint said no one at OnStar or GM could tell him why OnStar distributed his driving data without his consent.
GM should just stop selling data
It is unclear how much money GM makes from selling data. It is not broken out in the company's annual earnings filing with the Securities and Exchange Commission. But Gordon said it's likely a small percentage of GM's total multibillions in revenue, which might not be worth continuing to do it, he said.
"You make $5 million on it, but get $30 million in bad publicity and now we have a legal settlement," Gordon said. "There’s a near-term solution that says just drop it."
But with a proliferation of electric vehicles on the horizon, the connectivity of cars will increase and offer more opportunities for automakers to add revenue through data sharing, Gordon said. For example, selling a driver's GPS location to retailers who can then ping a driver to stop at their store, he said. The key will be to get drivers' clear and informed consent.
"For years, the trucking companies knew where all their trucks were and they knew when the truck was moving, how fast it was going and if it got off the freeway," Gordon said. "That information has been valuable for safety purposes and efficiency. But the difference is the drivers knew. This plaintiff said he didn’t know and most of us have no idea..”
'Your car isn't spying on you'
Georgetown's Vladeck agreed and added that what a person is doing while driving would be considered "sensitive data" by the Federal Trade Commission.
"If car companies are collecting the data to make the car safer, that’s one thing. But if they are doing it to monetize it and it leaves General Motors to go somewhere else, that’s a serious concern," Vladeck said.
In December, the Alliance for Automotive Innovation issued a statement titled, "No, your car isn’t spying … it’s keeping you safe." It said carmakers collect telematic driving data mostly to support the proper functions of the vehicle, including onboard computers for safety.
The alliance's memo did not address the sale of data, only that automakers are complying with privacy principles that are enforceable by the FTC.
"Yes, some of these policies might be a little confusing, accounting for incidental collection and inferences drawn from, for example, where the vehicle may have traveled," the alliance's memo states. "Blame the lawyers, but that’s to ensure manufacturer compliance with notice obligations in the growing patchwork of state privacy laws on health information, biometrics, and others. (Again, a single federal standard is urgent.)”
More:Analysts: And just like that, the pressure on GM CEO Mary Barra to execute, just escalated
More:Biden adopts new emissions rules for US cars, gives automakers a break in early years
Free Press staff writer Todd Spangler contributed to this report.
Contact Jamie L. LaReau:jlareau@freepress.com. Follow her on Twitter@jlareauan. Read more onGeneral Motorsand sign up for ourautos newsletter.Become a subscriber.
