Customer Accuses GM of Sharing Data Without Consent, Increasing Insurance Costs

A recent lawsuit in the United States could set a historic precedent that could eventually define how car manufacturers handle data and, equally important, how they communicate their practices to customers.

Florida-based Romeo Chicco has filed a lawsuit against General Motors, OnStar, and third-party data broker LexisNexis Risk Solutions, accusing all three companies of sharing his data without consent. The data was transmitted to insurance companies, with the driver eventually facing higher insurance costs.

GM can collect driving data in cars with OnStar, and Chicco claims the carmaker did this without his consent. The driving data, which can include information that could impact insurance quotas, such as aggressive driving behavior (hard braking and sudden acceleration), was then shared with insurance companies.

Chicco claims he never agreed with the practice, so the three companies violated his privacy. The plaintiff seeks class-action certification.

General Motors, OnStar, and LexisNexis Risk Solutions have already denied the claims, explaining that Chicco was presented with the privacy policy and agreed with the data sharing. GM said Chicco received a welcome mail with the service terms and conditions and the privacy statement on November 18, 2021, when registered for the service. The document included the privacy practice, including how GM could share information with third-party companies, such as insurance firms whose quotas are based on driving behavior data collected from cars.

Chicco has been using OnStar services until January 11, 2024, after previously agreeing with the privacy policy received by mail three years earlier.

GM says that while the data was shared with third-party companies, the process happened with Chicco's consent.

The case is of particular importance for a different reason than the obvious one. While the driver claims the data sharing happened without his consent, GM's records clearly show that his customer received the privacy policy when registering for OnStar.

The bigger problem is how the privacy practices are buried in the contract.

Privacy policies have long been a controversial topic in the software world, as users tend to click the "accept" button without first reading the lengthy documents. Companies use an approach often described as "unethical," hiding key tidbits in long documents that are a nightmare to read before agreeing. Reading the fine print takes time and sometimes involves knowing specific terms to understand how the data would be shared with third-party companies.

While courts have previously sided with customers in similar cases, throwing out contracts because they were considered unreasonable, GM's legal dispute could lead to carmakers being required to simplify their privacy statements and inform customers about its practices more clearly.

Chicco explains in his complaint that OnStar's privacy statement is "neatly hidden on their website" and how the data is used is "ambiguous at best." Eventually, the plaintiff claims that this "scheme is deceptive, unfair, and misleading to consumers."

Chicco does have a point here. The method is definitely unfair, but who's at fault for a customer being provided with a privacy statement and accepting its terms without reading them?

Finding the OnStar privacy statement takes only a few seconds. I found it almost instantly by typing "OnStar privacy statement" on Google, with the first result pointing me to the document where General Motors explains what data it collects, how it uses It, and how it shares the information.

The carmaker explains that it shares driver data with the GM family of companies, emergency service providers, third-party business relationships, service providers, business transfers, and where required or permitted by law.

Insurance companies are included in the "third-party business relationships" group. GM says it shares data " where you have elected to receive a service from them and/or authorized them to request data from GM [..] for example, usage-based insurance providers."

As for the data collected from the vehicle, the American carmaker says it collects "information about the use of your vehicle, including operational and safety related information." This can be anything that happens behind the wheel while you drive the car, including crash avoidance alerts, speed, impact data, braking and cornering events, stability control or anti-lock events, and seatbelt settings.

Using all these data, usage-based insurance companies can provide a quota to customers. Insurance companies could increase the final costs if the data suggests aggressive driving behavior, such as hard braking and frequent crash avoidance alerts.

Chicco seeks a jury trial, actual, statutory, and putative damages, as well as an order to prevent "further data collection and/or sharing to third parties without their consent." In return, General Motors says the court should be thrown out, requesting payment of their costs and expenses. No hearings have been scheduled, but I'll continue to monitor the case, especially because the ruling could define how carmakers, not just GM, handle users' privacy.