Nebraska AG Sues GM and OnStar for Data Collection and Sale Practices

Earlier this month, the Nebraska Attorney General sued General Motors LLC (“GM”) and OnStar LLC (“OnStar”) for their role in collecting, processing, and selling the data of Nebraska residents without sufficient notice and consent.  The suit alleges that GM collected and sold data regarding the driving habits of their customers, including vehicle speed, driver and passenger seatbelt status, and distance driven in connection with vehicle trips. GM then sold this data to third party companies, where the data was analyzed to produce individual “Driving Scores,” which were sold to car insurance companies for use in assessing providing insurance products to consumers.  The suit claims that an individual’s Driving Score could be used by insurers to increase premiums, cancel coverage, or deny coverage outright.

Moreover, the AG alleges all of this data was sold under the guise of GM obtaining consent from consumers for the collection, use, and sale of data, where in reality the AG argues that enrollment in OnStar (the primary data collection mechanism) was done in a deceptive, unconscionable, and unlawful manner.  In particular, the suit provides that GM presented privacy policies of the OnStar products that were not accurate and also presented consent to these policies as a necessary component of the car buying process.  These claims are brought under the Nebraska Deceptive Practices Act and the Nebraska Consumer Protection Act, with requested relief of civil penalties in the amount of $2000.00 per violation of each Act, return of monies paid by consumers resulting from violations of either Act, and permanent enjoinment of the conduct alleged in the compliant.

While the actions of GM alleged in the complaint are extreme, it does underscore the need to adhere to key privacy best practices, including using clear, plain language in privacy policies to explain data use and avoiding dark patterns in obtaining consumer consent.  A copy of the compliant can be viewed here.