Contract analysis

I. Executive Summary The purpose of this memorandum is to assess the cross-border data transfer implications arising from Meridian Telematics Solutions, Inc.'s ("Meridian") disclosure that it may migrate processing of Vantage Mobility Systems Corp. ("VMS") vehicle telemetry data from Cloudvault Infrastructure, Inc.'s ("Cloudvault") Columbus, Ohio data center (located at 7400 Crossroads Boulevard, Columbus, OH 43219)

II. Background A. The Data-Sharing Partnership and DPA Negotiations VMS and Meridian executed a non-binding Letter of Intent ("LOI") on August 5, 2022, establishing the framework for a connected-vehicle data-sharing partnership. Under the proposed partnership, Meridian would serve as a data processor, receiving and processing up to fourteen (14) categories of vehicle telemetry and in-cabin sensor data from VMS's prop

3. Acceleration/deceleration data

6. Engine diagnostic codes (OBD-II)

13. Windshield wiper activation

14. Headlight/taillight status Of particular significance, VMS has classified two of these categories — GPS/geolocation data (Category 1) and seat occupancy data (Category 10) — as "Sensitive Vehicle Data" under VMS's internal data governance policy (the "VMS Data Governance Framework," Version 4.2, effective January 1, 2022). This classification reflects VMS's determination that, when combined with vehicle identific

III. Legal Analysis: GDPR Applicability A. Territorial Scope of the GDPR (Article 3) The threshold question in assessing the impact of the proposed Dublin migration is whether the GDPR would apply to the processing of VMS data at Cloudvault's Dublin facility. The GDPR's territorial scope is defined by Article 3, which establishes two independent bases for applicability.

Article 3(1) — Establishment-Based Applicability. GDPR Article 3(1) provides that the Regulation applies to "the processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether the processing takes place in the Union or not." The Court of Justice of the European Union ("CJEU") has interpreted the concept of "establishment" broadly. In W

Article 3(2) — Targeting-Based Applicability. GDPR Article 3(2) applies the Regulation to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities relate to: (a) the offering of goods or services, irrespective of whether payment is required, to such data subjects in the EU; or (b) the monitoring of their behavior as far

Article 3(2) does not directly apply to the VMS-Meridian arrangement as currently structured. VMS is not offering goods or services to persons in the EU through the VantageLink platform or the Connected Insights program — both are currently limited to the North American market. Similarly, VMS is not monitoring the behavior of EU-based individuals; all telemetry data originates from vehicles operated in North America.

IV. Legal Analysis: Cross-Border Data Transfer Mechanisms A. GDPR Chapter V — Transfers to Third Countries If VMS data is processed at Cloudvault's Dublin facility, the cross-border data transfer provisions of GDPR Chapter V (Articles 44 through 50) become relevant in two respects. First, if VMS data is transmitted from the United States to the Dublin facility for processing, this constitutes an importation of data i

V. Legal Analysis: Interaction with U.S. Privacy Frameworks A. Michigan Identity Theft Protection Act (MCL 445.61 et seq.) The Michigan Identity Theft Protection Act ("ITPA") requires persons and entities that own or license data containing "personal information" of Michigan residents to implement and maintain reasonable security measures to protect that information against unauthorized access, use, or disclosure. Th

VI. Risk Assessment Summary A. Risk Matrix Based on the legal analysis set forth in Parts III through V of this memorandum, we have identified the following principal risks associated with the potential migration of VMS data processing to Cloudvault's Dublin facility: Risk 1 — GDPR Applicability (Medium-High). As discussed in Part III.A, the processing of VMS data at a Cloudvault establishment in Dublin could bring t

VII. Recommendations for DPA Provisions Based on the foregoing analysis, we recommend that the following provisions be incorporated into VMS's revised DPA proposal. These provisions are designed to protect VMS's interests while preserving a reasonable path for future international processing if VMS determines, upon informed assessment, that such processing is appropriate. A. International Data Transfer Restriction We