``` MIME-Version: 1.0 Message-ID: In-Reply-To: References: Date: Wed, 18 Jan 2023 14:15:00 -0500 From: Rachel Bernstein To: Thomas Langford Cc: Diana Kowalski , Kevin Ostrowski , Alan Burke , Sara Hendricks Subject: RE: VMS-Meridian DPA — Instruction to Pause Negotiations Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit
Thomas,
Thank you for the detailed update. We understand the instruction and will immediately pause all work on the DPA negotiations under Matter 1007-00007, effective today.
We will send a formal hold notification to Catherine Ng at Whitfield, Barrow & Crane LLP advising that VMS has instructed a pause in negotiations and that no further drafts or comments should be expected at this time.
For the record, I want to summarize the current status of the DPA so we have a clean baseline when the matter resumes:
The DPA currently stands at version 3.1, the most recent draft having been returned by WBC on December 16, 2022. There are six (6) open issues remaining between the parties:
1. Data retention period — VMS's position of 90-day rolling deletion versus Meridian's request for 18-month retention for model-training purposes.
2. Sub-processor approval rights — VMS's prior written consent requirement versus Meridian's proposed general authorization model with a 30-day objection window.
3. Breach notification timeline — VMS's 24-hour notification requirement versus Meridian's proposed 72-hour standard.
4. Liability cap — VMS's position of uncapped liability for data breaches and unauthorized processing versus Meridian's proposed cap of $15 million.
5. International data transfer restrictions — newly raised by WBC in v3.1, relating to potential future migration of data processing to Cloudvault Infrastructure, Inc.'s Dublin, Ireland facility.
6. Sub-processor audit rights — also newly raised in v3.1, concerning the scope, frequency, and cost-sharing of audits (Meridian proposed annual audits only with 30 calendar days' notice and a $25,000 cost-sharing cap per audit).
All existing draft positions and open issues will be preserved in the file.
On a forward-looking basis, I want to flag a few points for your consideration as the revised commercial discussions progress:
The existing DPA draft (v3.1) was structured around the original fourteen-category data scope, including the real-time streaming component and Sensitive Vehicle Data classifications. If the revised partnership scope is finalized as you have described — six categories, no real-time streaming, no Sensitive Vehicle Data — the draft will require substantial revision. Much of the protective architecture we built into the current draft was driven by the inclusion of GPS/geolocation and seat occupancy data, and the corresponding regulatory exposure.
That said, the elimination of those data categories from scope may meaningfully simplify the regulatory compliance picture, particularly with respect to CCPA/CPRA considerations tied to identifiable personal information and the Michigan Identity Theft Protection Act analysis we had been working through. We would need to reassess once the final scope is confirmed, but the reduction in regulatory complexity could be significant.
The revised scope may also affect several of the open negotiation points noted above. For example, VMS's positions on data retention and the liability cap may warrant recalibration given the materially different risk profile of non-sensitive, non-real-time data. What was appropriate for a fourteen-category scope that included geolocation and real-time streaming may be more aggressive than necessary for the narrower arrangement, and some flexibility on those points could facilitate faster resolution when negotiations resume.
I would recommend a check-in call once VMS has further clarity on the revised commercial term sheet. At that point we can evaluate together whether it makes more sense to amend the existing v3.1 draft or prepare a new DPA from scratch — there are good arguments either way, and the answer will depend in part on how substantially the commercial terms shift.
In the meantime, we will keep the matter open but inactive on our end. Unless we hear from you or Diana sooner, we will reach out in approximately 90 days for a status check-in.
Thank you both for the heads-up, and please do not hesitate to reach out at any time if questions come up in the interim.
Best regards,
Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP 1 Liberty Plaza, 38th Floor New York, NY 10006 T: (212) 558-3400 rbernstein@calderwoodharkness.com
-------- Original Message -------- From: Thomas Langford To: Rachel Bernstein Cc: Diana Kowalski ; Kevin Ostrowski ; Alan Burke Date: Wednesday, January 18, 2023 10:42 AM EST Subject: VMS-Meridian DPA — Instruction to Pause Negotiations
Rachel,
I am writing to instruct Calderwood & Harkness to pause all work on the DPA negotiations with Meridian Telematics Solutions, Inc., pending further notice from VMS.
By way of background: on January 10, 2023, Meridian's CEO, Priya Ramanathan, informed our VP of Connected Services, Marcus Chen, that Meridian intends to rescope the connected-vehicle data-sharing partnership. The rescoping eliminates the real-time data streaming component entirely. In addition, the data categories to be shared have been reduced from the original fourteen (14) to six (6). The six retained categories are:
1. Vehicle speed 2. Braking events 3. Tire pressure 4. Engine diagnostic codes 5. Fuel consumption 6. Headlight/taillight status
Notably, the rescoped categories do not include GPS/geolocation or seat occupancy data. In other words, none of the data categories classified as "Sensitive Vehicle Data" under VMS's internal data governance policy remain in scope.
These changes fundamentally alter the risk profile and data protection requirements of the arrangement. The commercial terms will also need to be renegotiated — the parties have not yet finalized a revised commercial term sheet. Until that revised commercial framework is settled, there is no basis on which to continue negotiating the DPA in its current form.
Accordingly, please consider this a formal instruction to pause all DPA drafting, negotiation, and related work on Matter 1007-00007, effective immediately. I would ask that C&H send a formal hold notification to Whitfield, Barrow & Crane LLP (Meridian's counsel) advising of the pause. We will reach out when a revised term sheet is in place and the team can evaluate next steps, including whether to revise the existing draft or start fresh.
Thank you to you and the team for the strong work to date on this matter. Diana and I remain available if you have any questions.
Best regards,
Thomas Langford General Counsel Vantage Mobility Systems Corp. 4700 Automation Boulevard, Suite 300 Auburn Hills, MI 48326 tlangford@vantagemobility.com ```