Texas AG Sues GM Over Alleged Unlawful Collection & Sale of Driver Data, Raising Compliance Concerns

Texas Attorney General Ken Paxton has filed a lawsuit against industry titan General Motors (GM) over the company's alleged unlawful collection and sale of driver data. This action comes as part of a broader data privacy and security initiative launched by Paxton to aggressively enforce Texas privacy laws.

The lawsuit, filed in a state court near Houston, accuses GM and its OnStar subsidiary of systematically gathering driving data from more than 14 million vehicles and the personal information of over 1.8 million Texas consumers - all without their knowledge or consent.

According to the complaint, GM used the array of sophisticated sensors and communications equipment installed in its newer model vehicles to detect and transmit a trove of detailed driving data, including information on seatbelt usage, speed, acceleration, braking, and even radio listening habits. The automaker then allegedly sold this information to third-party companies, which used it to calculate individualized "driving scores" for GM's customers. These scores were subsequently licensed to auto insurers, who the state claims then leveraged them to inform insurance premiums or make decisions about coverage.

"Millions of American drivers wanted to buy a car, not a comprehensive surveillance system that unlawfully records information about every drive they take and sells their data to any company willing to pay for it," Paxton said in announcing the lawsuit.

The Texas case follows Paxton's June 2024 launch of a major data privacy and security initiative, establishing a specialized team focused on aggressive enforcement of the state's privacy protection laws. This team will ensure companies respect Texans' privacy rights and safeguard their personal data, with a particular focus on emerging risks from the tech, AI, and other data-driven industries.

"Any entity abusing or exploiting Texans' sensitive data will be met with the full force of the law," Paxton stated. "With companies able to collect, aggregate, and use sensitive data on an unprecedented scale, we are strengthening our enforcement of privacy laws to protect our citizens."

The implications of the GM lawsuit extend far beyond the automotive sector, raising significant questions about third-party risk management and compliance across multiple industries. By allegedly monetizing driver data without proper consent, the case suggests a potential failure by GM to vet its data-sharing agreements or establish adequate privacy safeguards.

The lawsuit also underscores the growing imperative for automakers to prioritize IT security and data protection as the connected car ecosystem expands. With vehicles now generating vast troves of sensitive driver information, companies must ensure stringent access controls, encryption, and monitoring to prevent unauthorized access or misuse.

Legal experts say the outcome of the Texas case could set an important precedent, potentially forcing the automotive industry to re-evaluate its data-driven business models and establish more robust consumer consent mechanisms. The stakes are high, both for GM and the broader industry.

In a statement, GM acknowledged discussions with the Texas AG's office and claimed to share "the desire to protect consumers' privacy." However, the company did not provide a detailed response to the allegations.

As the legal battle unfolds, the Texas case will be closely watched by privacy advocates, industry stakeholders, and regulators alike, as they assess its potential to reshape automakers' obligations regarding the collection and monetization of driver data.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.