Insights

On July 8, Nebraska Attorney General Mike Hilgers sued a major automobile manufacturer for allegedly collecting and selling drivers' data without their permission. According to the AG's complaint, the manufacturer pressured drivers into enrolling in optional products and services that collected the drivers' data and sold that data to third parties. Those third parties then sold the data to insurers, which used the data to justify rate increases and coverage cancellations.

The complaint describes how the manufacturer allegedly began selling customers' driving data without their consent. Before 2015, insurers provided the devices that collected the driving data, so the manufacturer needed to contract with those insurers to obtain the data. However, beginning in 2015, the manufacturer began making those devices itself and installing them in almost all of its new vehicles. As a result, the devices, instead of being present only where drivers had agreed to their installation, became nearly universal. The devices collected a broad range of data, including vehicle location, vehicle speed and direction, hard acceleration, hard braking, and whether drivers were wearing seatbelts.

According to the complaint, the manufacturer aggressively marketed the services that would allow the collection of consumer data but did not inform consumers that the data collection would occur. The AG claims that many customers were led to believe that enrolling in the services was necessary for purchasing a vehicle. These customers, according to the complaint, did not have a meaningful opportunity to review the terms of the services, and the terms themselves did not inform consumers of the manufacturer's data collection practices. A customer who tried to decline enrollment would allegedly see a "warning" screen on the salesperson's computer indicating that certain safety features would be deactivated. Customers who declined enrollment would allegedly receive frequent emails encouraging them to enroll. The complaint also claims that dealership employees received bonuses for enrolling customers in the data collection programs.

The AG claims that the manufacturer did not adequately disclose the collection of customers' driving data. According to the complaint, the manufacturer failed to disclose that:

• the manufacturer would collect any personal data, let alone driving data;
• third parties had agreed to create driver risk profiles using the collected data;
• the manufacturer would expressly permit third parties to resell the risk profiles to insurance companies; and
• insurance companies could use the risk profiles to justify increasing premiums or denying coverage.

The complaint alleges that the manufacturer profited from the sale of drivers' data and that it told at least one third party that it had the drivers' permission to sell the data.

The AG seeks injunctive relief along with up to $2,000 per violation of the Nebraska Uniform Deceptive Trade Practices Act or the Nebraska Consumer Protection Act, plus consumer restitution, costs, and attorneys' fees. We will monitor this case as it progresses and report on any significant developments.

Eric D. Mulligan is counsel in the Maryland office of Hudson Cook, LLP. He can be reached at 410.865.5402 or by email at emulligan@hudco.com.