Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the applicability of three key privacy and data protection statutes to the proposed data-sharing arrangement between Vantage Mobility Systems Corp. ("VMS") and Meridian Telematics Solutions, Inc. ("Meridian"), under which Meridian would receive and process connected-vehicle telemetry and in-cabin sensor data generated by VMS's VantageLink platform. Thi

II. Background and Factual Context A. The Parties Vantage Mobility Systems Corp. VMS is a Delaware corporation headquartered at 4700 Automation Boulevard, Suite 300, Auburn Hills, Michigan 48326. VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms to automotive original equipment manufacturers ("OEMs") and aftermarket distributors. VMS's flagship product is the Va

13. Windshield wiper activation

14. Headlight/taillight status The data would be collected from approximately 800,000 active VantageLink-equipped vehicles whose owners and lessees have opted into VMS's Connected Insights data-sharing program. The estimated data volume to be transmitted to Meridian is approximately 4.2 terabytes per day. The principal commercial terms outlined in the LOI are as follows: Meridian would pay VMS an annual license fee o

III. Michigan Identity Theft Protection Act (MCL §§ 445.61 *et seq.*) A. Statutory Overview The Michigan Identity Theft Protection Act was enacted to protect Michigan residents from identity theft and to establish a framework for the responsible handling of personal identifying information by persons and agencies that own, license, or maintain such information. The statute's key operative provisions are found in MCL

1. Does VMS Data Constitute "Personal Identifying Information" Under the Michigan ITPA?. The threshold question is whether the data that VMS proposes to transfer to Meridian constitutes "personal identifying information" within the meaning of the Michigan ITPA. We address this question with respect to the specific data categories at issue. VINs Alone. Vehicle identification numbers are not explicitly enumerated in th

2. VMS's Obligations as Data Owner/Licensor. VMS, as the entity that owns and licenses the connected-vehicle data generated by the VantageLink platform, bears primary obligations under the Michigan ITPA. These obligations include: Security Measures. VMS is required to implement and maintain reasonable security measures to protect personal identifying information from unauthorized access, acquisition, destruction, use

3. Flow-Down Requirements to Meridian as Data Processor. As noted above, the Michigan ITPA does not contain an express statutory requirement for contractual flow-down provisions governing the relationship between a data owner and a third-party processor. The statute places the burden of compliance on the entity that owns or licenses the data, without prescribing specific contractual mechanisms for managing downstream

1. Reasonable Security Measures. A contractual requirement for Meridian to implement and maintain reasonable security measures — consistent with the standards applicable under the Michigan ITPA — to protect VMS personal identifying information from unauthorized access, acquisition, destruction, use, modification, or disclosure. The DPA should specify minimum security requirements, including encryption standards, acce

2. Breach Notification. A breach notification provision requiring Meridian to notify VMS of any actual or reasonably suspected security breach affecting personal identifying information of Michigan residents within a timeframe sufficient for VMS to meet its "without unreasonable delay" statutory obligation. This provision supports VMS's proposed 24-hour notification window in the DPA. Meridian's proposed 72-hour noti

3. Indemnification. An indemnification provision requiring Meridian to indemnify, defend, and hold harmless VMS from and against any costs, damages, penalties, fines, and expenses (including reasonable attorneys' fees) arising from Meridian's failure to comply with Michigan ITPA requirements or with the Michigan ITPA-related provisions of the DPA.

4. Representations and Warranties. Representations from Meridian regarding its understanding of and compliance with applicable Michigan data protection law, including the Michigan ITPA, and an acknowledgment that Meridian will process VMS data in a manner consistent with VMS's obligations under the statute.

IV. California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 *et seq.*) A. Statutory Overview The California Consumer Privacy Act ("CCPA"), which took effect on January 1, 2020, and its successor amendments enacted through the California Privacy Rights Act ("CPRA"), which take effect on January 1, 2023 (with a look-back period to January 1, 2022), together establish the most compreh

1. Does VMS Qualify as a "Business" Under CCPA/CPRA?. The CCPA/CPRA applies to "businesses," which are defined as for-profit legal entities that do business in the State of California and that satisfy one or more of the statute's threshold requirements. Cal. Civ. Code § 1798.140(d). We analyze each element below. For-Profit Entity. VMS is a for-profit Delaware corporation. This element is satisfied. Does Business in

2. Does the VMS Data Constitute "Personal Information" Under CCPA/CPRA?. The CCPA/CPRA defines "personal information" in expansive terms as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v). This definition encompasses not only traditional ide

3. Significance of 112,000 California-Registered Vehicles. Approximately 112,000 of the 800,000 opted-in vehicles — representing approximately 14% of the total data subject population — are registered in California. This represents a substantial population of California consumers whose personal information would be shared with Meridian under the proposed arrangement. It is important to note that the CCPA/CPRA does no

1. Service Provider vs. Third Party vs. Contractor Classification. The classification of Meridian under the CCPA/CPRA — as a "service provider," a "contractor," or a "third party" — is a threshold question with far-reaching consequences for the structuring of the proposed arrangement and the DPA. Service Provider Status. Under Cal. Civ. Code § 1798.140(ag), a "service provider" is a legal entity that processes person

2. Sub-Processor Flow-Down (Cloudvault). The CCPA/CPRA requires service providers to notify the business of any sub-processor engagements and to ensure that sub-processors are contractually bound to the same restrictions that apply to the service provider. Cal. Civ. Code § 1798.140(ag)(2). Meridian's proposed use of Cloudvault as a sub-processor for hosting and processing VMS data on the AutoCloud platform triggers t

1. Contractual Provisions Required by Cal. Civ. Code § 1798.100(d). The CCPA/CPRA mandates that the written contract between a business and a service provider or contractor include specific provisions. The DPA must contain each of the following: Prohibition on Selling or Sharing. The DPA must prohibit Meridian from selling or sharing personal information received from VMS. This prohibition must be absolute and unqual

2. Sensitive Personal Information Handling. As noted in Section IV.B.2 above, GPS/geolocation data constitutes "sensitive personal information" under the CPRA. Cal. Civ. Code § 1798.140(ae)(1)(A). The classification of GPS/geolocation data as sensitive personal information triggers additional obligations that must be addressed in the DPA. Under the CPRA, consumers have the right to limit a business's use and disclosu

3. Consumer Rights Facilitation. The CCPA/CPRA grants California consumers a range of rights with respect to their personal information, including the right to access, the right to deletion, the right to correction, and the right to opt out of sales or sharing. VMS, as the business that collected the personal information, bears primary responsibility for receiving and responding to consumer rights requests. However,

4. De-identification and Aggregation Standards. As discussed in Section IV.C.1 above, the preservation of Meridian's service provider status under the CCPA/CPRA depends on ensuring that derivative analytics products developed by Meridian do not incorporate personal information in identifiable form. The DPA should require that Meridian use only de-identified or aggregated data — not personal information — in the devel

V. Federal Drivers' Privacy Protection Act (18 U.S.C. §§ 2721 *et seq.*) A. Statutory Overview The Drivers' Privacy Protection Act ("DPPA") was enacted by Congress in 1994 to restrict the disclosure of personal information obtained by state Departments of Motor Vehicles ("DMVs") in connection with motor vehicle records. The DPPA was adopted in response to growing concerns about the use and misuse of DMV-held personal

1. Does VMS Data Derive from Motor Vehicle Records?. The threshold applicability question under the DPPA is whether the personal information that VMS proposes to share with Meridian was "obtained" from a "motor vehicle record" within the meaning of the statute. This question requires careful examination of the data provenance of VMS's owner/lessee identification information. Direct Data Collection. VMS collects vehic

2. Permissible Use Analysis. If the DPPA is determined to apply to any portion of the VMS data shared with Meridian, VMS's disclosure of VIN-linked personal information to Meridian must fall within one or more of the permissible uses enumerated in 18 U.S.C. § 2721(b). Three permissible uses are potentially applicable:

§ 2721(b)(1): Motor Vehicle or Driver Safety. This permissible use authorizes the disclosure of personal information for use "in connection with matters of motor vehicle or driver safety." If the analytics services provided by Meridian are framed as contributing to motor vehicle or driver safety — for example, through the development of safety-related insights, crash prevention algorithms, or driving behavior risk mo

§ 2721(b)(12): Bulk Distribution with Consent. This permissible use authorizes the disclosure of personal information for bulk distribution for surveys, marketing, or solicitations, if the state has obtained the express consent of the person to whom such personal information pertains. This provision may be applicable in states where the vehicle owner/lessee has provided express consent through the Connected Insights

§ 2721(b)(13): Individual Authorization. This permissible use authorizes the disclosure of personal information for "any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety." Additionally, the DPPA permits disclosure where the individual to whom the information pertains has provided express consent. The Connect

3. DPPA Penalties. The DPPA provides for both criminal and civil penalties for violations. Criminal Penalties. Under 18 U.S.C. § 2723, a person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a purpose not permitted by the statute is subject to a criminal fine. If the violation is committed with the intent to make a profit, the court may impose a fine of up to $5,000 per