GM cuts ties with some third-party data brokers after NYT report

Two weeks ago, the New York Times reported on automakers selling privately-owned vehicle driving data with third-party data firms, which then sell that data to insurance companies. This has resulted in car owners seeing major insurance premium increases or being unable to get insurance despite being involved in no accidents. While several car companies sell such data after owners of certain models opt into services that "score" their driving activity, the Times investigation pointed to GM sharing data without such consent.

The NYT now reports GM has cut ties with LexisNexis, a spokesperson writing in an e-mailed statement to the paper, "Customer trust is a priority for us, and we are actively evaluating our privacy processes and policies."

This could partly be due to a Florida resident breaking the seal on lawsuits. Romeo Chicco found out about the data sharing when seven auto insurers rejected him for policies on his 2021 Cadillac XT6. When he finally found an insurer to agree, his rate had doubled. After being told to check his LexisNexis report, he discovered records on nearly 260 trips over a period of six months, each trip identifying events like hard braking and hard acceleration that insurers were using to deem Chicco less safe than he's previously been given credit for. Meanwhile, in New York, a Chevrolet Bolt driver had his insurance rates rise 21% because of a 130-page LexisNexis dossier with data on 640 trips that his Bolt had uploaded to GM servers.

Although GM is not alone in selling data to third parties, the NYT investigation showed other carmakers doing so in more limited and situational contexts. Subaru's Starlink service has a feature that allows customers to enable insurance tracking, but only if they explicitly request that it be used to generate insurance quotes. Otherwise, it shares only odometer data with third-party providers. Acura, Honda, Hyundai, Kia and Mitsubishi all offer an optional driver score feature that includes data collection and transmission to insurance databases, NYT reports, but all require the customer to opt in. 

That said,, it's possible that the fact-finding phase of Chicco's suit will dig up a heap of aggrieved owners of vehicles from those other automakers or more. We're interested to see how this suit goes, though, especially if it makes it to Washington. The state has strong privacy laws, but last year, after some Ford owners sued the automaker over storing and holding onto cellphone data, an appeals court dismissed the case. The panel of judges wrote that the Washington Privacy Act requires "an injury to 'his or her business, his or her person, or his or her reputation'" in order to mandate some sort of redress. Would classification as a less-safe driver or do higher insurance rates count as injury?