[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLZKZpHmxQlZbT8W0qW0ifYvQGtGnEetWVvKft5B8sZ4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"654f48d8-7988-4e58-b65c-0ce6c42ce025","gms-220m-settlement-highlights-risks-of-unauthorized-driver-data-collection-and-sale","d3e88284-7923-40fa-a89e-fd5ae770f42d","GM's $220M Settlement Highlights Risks of Unauthorized Driver Data Collection and Sale","General Motors collected granular driver data — including precise location and driving behavior metrics — and sold it to data brokers and insurance companies without meaningful consumer consent. GM compounded the violation by incentivizing dealerships to silently enroll customers and actively misleading drivers about their enrollment status, stripping them of any real opportunity to opt out. This case illustrates how organizations can weaponize consumer data for commercial gain while circumventing the foundational privacy principles of transparency, consent, and purpose limitation. The $220 million price tag demonstrates that regulators are increasingly willing to impose significant financial consequences for data monetization schemes that bypass consumer rights. Any organization that collects, processes, or shares personal data must treat consent and disclosure as legal obligations, not optional courtesies.","**Immediate actions:**\n- Audit all active data-sharing agreements with third-party brokers and insurers to confirm valid, informed consumer consent exists for each data stream.\n- Suspend any enrollment workflows that do not include an explicit, unambiguous opt-in step before personal data is collected or transmitted.\n\n**Policy and governance improvements:**\n- Establish a formal Data Protection Impact Assessment (DPIA) process that must be completed before any new data-collection or data-sharing program is approved.\n- Prohibit incentive structures (e.g., dealer bonuses) that reward enrollment volume without verifying that consent requirements have been met.\n- Define and enforce a data minimization policy that limits collection to only the data strictly necessary for the stated consumer-facing purpose.\n\n**Detection and accountability measures:**\n- Implement continuous logging and monitoring of all data flows leaving the organization to detect unauthorized or undisclosed sharing with third parties.\n- Conduct annual third-party privacy audits that specifically test whether customer-facing consent disclosures match actual data-collection and sharing practices.",[12,13,14,15,16,17,18],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"While a US case, GDPR's principle of processing personal data only with a lawful basis and explicit consent directly mirrors the consent failures GM exhibited; organizations subject to GDPR could face even steeper penalties for the same conduct.","NIS2 mandates incident handling and risk-management measures that cover supply-chain and third-party data relationships; the broker arrangement through which driver data reached insurers represents exactly the kind of third-party risk that these controls are designed to govern.","Although a process flaw rather than a technical one, NIST's requirement to identify and correct systemic deficiencies applies here — GM's dealership enrollment workflows were a known procedural gap that was never remediated.","GM lacked an effective internal response mechanism to detect and halt the unauthorized enrollment and data-sale scheme before it scaled across millions of customers and triggered a multistate investigation.","Dealership staff who enrolled customers without consent either were not trained on privacy obligations or were given commercial incentives that overrode that training — structured awareness programs for all data-handling personnel would have closed this gap.","ISO 27001 requires organizations to assess and address risks arising from their own systems and processes; a formal risk review of the connected-vehicle data pipeline would have surfaced the consent-bypass vulnerability before it became a liability.","Proper identity and consent management for data subjects — ensuring only authorized, consented data flows are permitted — would have prevented the unauthorized sharing of driver profiles with brokers.","published","2026-10-30T17:20:29.614995+00:00","2026-10-30T17:20:29.576+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F30\u002Fgm-cracks-the-petty-cash-box-for-multistate-driver-tracking-settlement\u002F5306721","gm-cracks-the-petty-cash-box-for-multistate-driver-tracking-settlement-6e0c4e","GM cracks the petty cash box for multistate driver tracking settlement",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":58,"name":59,"problem":60},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]