About time a lawsuit like this be done, this one filed on 3/13/24

Filed: March 13, 2024, Case : ◆§ 9:24-cv-80281

Onstar Lawsuit

A Florida resident claims in a proposed class action lawsuit that General Motors (GM) and OnStar illegally reported his driving behavior data to co-defendant LexisNexis without consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 28-page lawsuit says that after the plaintiff bought a new Cadillac XT6 from a Florida dealership in 2021, he downloaded the myCadillac app and opted not to enroll in OnStar Smart Driver, an optional feature that provides customers with certain GM vehicles insights into their driving behavior.

According to OnStar’s Smart Driver FAQs, the company claims it does not collect information about driving behavior unless a customer enrolls in the service and provides their explicit consent, the case relays. The plaintiff contends that he never enrolled in OnStar Smart Driver, which an OnStar representative has confirmed, and never gave the company permission to track or share his driving data. What’s more, the plaintiff’s online GM profile states that his vehicle is “not connected” to an OnStar account, the suit shares.

However, after several insurance providers denied the plaintiff’s attempts to purchase car insurance in December 2023, Liberty Mutual informed the man that his rejection was due to negative driving information in his LexisNexis report, the complaint says.

The plaintiff’s LexisNexis report, which he subsequently requested and received a few weeks later, had 258 recorded driving events allegedly sent through OnStar, each of which included details like when a trip started and ended, if any acceleration, hard brake or high-speed events occurred, and the distance traveled, the complaint contends.

The filing says that although this information harmed the plaintiff’s ability to purchase car insurance and caused his rates to nearly double, the data metrics included in his consumer report are “so decontextualized” that they fail to provide an accurate representation of his driving abilities.

“For example, ‘Record 5’ identifies two ‘Acceleration Events’ and one ‘Hard Brake Event[].’ The report does not define what either of these mean nor how they are calculated. Furthermore, the report does not explain how or why [the plaintiff] might have experienced these events. Stating these events, by themselves, says nothing of the other driving conditions and factors [the plaintiff] may have experienced.”

In the following weeks, the plaintiff contacted LexisNexis, GM, OnStar and Cadillac, but none could clarify how his driving data had been shared without his knowledge or consent, the complaint claims.

The plaintiff alleges GM and OnStar has misled consumers about their data-sharing policies, and that they began sharing his data when he downloaded the myCadillac app.

Per the filing, OnStar and GM have sent driving data about “millions” of consumers to LexisNexis without consent, in violation of Florida law.

“Furthermore, all [of the defendants] should have realized that sharing and publishing this information, without any context, inaccurately portrays consumers’ driving experience,” the case says, claiming that LexisNexis’s failure to ensure the “maximum possible accuracy” of the consumer data it reports is illegal under the federal Fair Credit Reporting Act.

The lawsuit looks to represent anyone who had their car’s driving data—also referred to as telematics—collected and shared with LexisNexis without their consent within the past four years.

Only time will tell if GM is totally quitting spying or playing a game of just about Smartdriver

GM stops sharing driver data with brokers amid backlash

After public outcry, General Motors has decided to stop sharing driving data from its connected cars with data brokers.
Last week, news broke that customers enrolled in GM's OnStar Smart Driver app have had their data shared with LexisNexis and Verisk.

Those data brokers in turn shared the information with insurance companies, resulting in some drivers finding it much harder or more expensive to obtain insurance. To make matters much worse, customers allege they never signed up for OnStar Smart Driver in the first place, claiming the choice was made for them by salespeople during the car-buying process.

Now, in what feels like an all-too-rare win for privacy in the 21st century, that data-sharing deal is no more.

"As of March 20th, OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk.

Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies," GM told us in a statement.

More detail :

General Motors said Friday it is severing ties with two data brokers following a lawsuit that connected the automaker to sharing driver data that resulted in higher auto insurance rates for that plaintiff.

In a lawsuit filed March 13, Romeo Chicco of Florida claims GM, its connected-services subsidiary OnStar and data and analytics company LexisNexis Risk Solutions violated privacy and consumer protection laws.

Chicco alleges GM captured and shared his driving data which included information about his speeding, braking and acceleration with LexisNexis, which then shared it with insurers. The complaint, filed in the U.S. District Court Southern District of Florida, seeks class-action status.

Chicco's lawsuit accuses the parties of gathering, "erroneous reports of derogatory and negative driving information made without Plaintiff’s knowing consent. Additionally, this illegal transfer and publication of data constitutes an invasion of privacy" and the defendants' collective action caused Chicco "significant emotional distress."

The lawsuit could be the first of many, legal experts said.
"Sharing data without consent is bad," said David Vladeck, former director of the Federal Trade Commission's Bureau of Consumer Protection during President Barack Obama's first term and a law professor at Georgetown University.
"There will be cases coming down the pike. This is a serious breach by the car companies. It’s a breach of confidentiality and there are financial consequences.”

A 'standard rotten thing'

GM said it shares limited data with insurers through a third party, which is collected through the OnStar Smart Driver program, after a customer consents to it three times. That OnStar program is optional. It monitors driving habits to help reduce wear-and-tear on the car and improve driving safety and customers can unroll at any time.

On Friday, GM spokesman Kevin Kelly declined to comment on the lawsuit, but he sent the Detroit Free Press the following statement: "As of March 20th, OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk. Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies."

Kelly declined to provide any further information as to how long GM has done business with LexisNexis and Verisk, which is also a data analytics firm that collects and shares data to help businesses manage risk, or why GM severed ties at this time.
The practice of using data for purposes that are not made clear in the consent, is widespread across many industries, said Erik Gordon, a professor at the Ross School of Business at the University of Michigan and a lawyer.

"It’s not just car companies. The fine print of disclosing data is used by cable companies, almost any app you download, loyalty programs by retailers.
What the core of the plaintiff’s complaint is, is that the law allows data gathers, date resellers and data brokers to do things using fine print, in language that isn’t clear to the data-givers," Gordon said.

He believes this case will be settled, but if it proceeds to trial and the plaintiff wins, "there will be a rash of lawsuits" against automakers and others.
"What GM is doing here is the standard rotten thing that most companies do and that the government should step in and protect us against," said Gordon.
'Little to no oversight'

In December, Sen. Edward Markey, D-Mass., asked the Federal Trade Commission to investigate the data privacy practices of 14 automakers. "Automakers are collecting large amounts of data on drivers, passengers, and even people outside the vehicle, with little to no oversight," Markey said.
Chicco's lawyer, Ryan McBride of San Diego-based Kazerouni Law Group, declined to comment on the lawsuit or make Chicco available.

LexisNexis Risk Solutions' website said the company analyzes data that it sells to insurers and others to help them manage risk. It did not respond to a request for a comment.
Verisk did not immediately respond with a comment to GM severing ties with it.
The lawsuit follows a recent investigation that found many automakers have been sharing customers' driving information with the insurance industry, leading to higher rates for some drivers.

A decline of OnStar services

The 36-page lawsuit stated that on Nov. 16, 2021, Chicco bought a new 2021 Cadillac XT6 SUV in Delray Beach, Florida, and that the purchase agreement made no mention of OnStar, LexisNexis, data-sharing, or anything privacy-related.
Chicco downloaded the MyCadillac App to his cellphone, the lawsuit stated. Days later, Chicco received an email offering him a Cadillac Connected Services trial and OnStar Safety and Security Coverage. It instructed him to hit the blue OnStar button to activate the services, which he never did because he said he did not want them.

The lawsuit said the email did not mention OnStar's Smart Driver program for which, according to www.onstar.com, "there is no charge for customers to enroll." It is available as part of "Connected Access."
OnStar states: "With customer consent, we share select OnStar Smart Driver insights about driving behavior with LexisNexis and Verisk, third-party telematics exchange companies that work with some insurance carriers" and, it adds, "insights about driving behavior are only shared with an insurance carrier with your explicit consent."

A record of 258 driving trips

The lawsuit contends that Chicco never enrolled in any OnStar services, and he never consented for his driving data to be shared.
Yet in December 2023, he called Liberty Mutual to ask why he was rejected for insurance. An agent said it was because of information in Chicco's LexisNexis report. Chicco got a copy of his LexisNexis report and it contained details of about 258 trips he had taken in his Cadillac in recent months, the lawsuit stated. It included the "acceleration events, hard brake events, high speed events," the lawsuit stated.

"Notably absent from the consumer report is any context related to these driving events," the complaint said.

Chicco said he called GM and LexisNexis several times to find out why his data had been collected without his consent, the lawsuit said. Eventually, he was told that his data came through OnStar because he had enrolled in OnStar’s Smart Driver program and he had an OnStar account. Chicco said he never enrolled in OnStar nor consented to sharing his driving data.
The complaint said no one at OnStar or GM could tell him why OnStar distributed his driving data without his consent.

GM should just stop selling data

It is unclear how much money GM makes from selling data. It is not broken out in the company's annual earnings filing with the Securities and Exchange Commission. But Gordon said it's likely a small percentage of GM's total multibillion in revenue, which might not be worth continuing to do it, he said.
"You make $5 million on it, but get $30 million in bad publicity, and now we have a legal settlement," Gordon said. "There’s a near-term solution that says just drop it."
But with a proliferation of electric vehicles on the horizon, the connectivity of cars will increase and offer more opportunities for automakers to add revenue through data sharing, Gordon said. For example, selling a driver's GPS location to retailers who can then ping a driver to stop at their store, he said. The key will be to get drivers' clear and informed consent.

"For years, the trucking companies knew where all their trucks were and they knew when the truck was moving, how fast it was going and if it got off the freeway," Gordon said. "That information has been valuable for safety purposes and efficiency. But the difference is the drivers knew. This plaintiff said he didn’t know and most of us have no idea.”

'Your car isn't spying on you'

Georgetown's Vladeck agreed and added that what a person is doing while driving would be considered "sensitive data" by the Federal Trade Commission.
"If car companies are collecting the data to make the car safer, that’s one thing. But if they are doing it to monetize it, and it leaves General Motors to go somewhere else, that’s a serious concern," Vladeck said.
In December, the Alliance for Automotive Innovation issued a statement titled, "No, your car isn’t spying, it’s keeping you safe." It said carmakers collect telematics driving data mostly to support the proper functions of the vehicle, including onboard computers for safety.

The alliance's memo did not address the sale of data, only that automakers are complying with privacy principles that are enforceable by the FTC.
"Yes, some of these policies might be a little confusing, accounting for incidental collection and inferences drawn from, for example, where the vehicle may have traveled," the alliance's memo states.
"Blame the lawyers, but that’s to ensure manufacturer compliance with notice obligations in the growing patchwork of state privacy laws on health information, biometrics, and others. (Again, a single federal standard is urgent.)”