PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
This memorandum is a privileged and confidential attorney work product prepared by Calderwood & Harkness LLP in connection with the representation of Vantage Mobility Systems Corp. It is protected from disclosure by the attorney-client privilege, the work product doctrine, and all other applicable protections. Any unauthorized review, use, disclosure, or distribution is strictly prohibited.
MEMORANDUM
Calderwood & Harkness LLP 1 Liberty Plaza, 38th Floor New York, NY 10006
TO: Rachel Bernstein, Partner, Privacy & Data Security Kevin Ostrowski, Partner, Privacy & Data Security
FROM: Alan Burke, Senior Associate, Privacy & Data Security
DATE: February 3, 2023
RE: Dormancy Status Report — Matter No. 1007-00007; Data Processing Agreement between Vantage Mobility Systems Corp. and Meridian Telematics Solutions, Inc.
I. Purpose and Summary
The purpose of this memorandum is to memorialize the dormant status of Matter No. 1007-00007, to document the current state of all outstanding work product, to summarize the financial status of the engagement through the date of dormancy, and to identify material considerations that will bear on any potential reactivation of the matter. This memorandum is intended to serve as a comprehensive reference document so that any attorney resuming work on this matter — whether a member of the current engagement team or otherwise — will have a complete understanding of the posture of the engagement, the negotiation history, and the outstanding substantive and commercial issues.
The engagement was opened on September 14, 2022, for the purpose of drafting and negotiating a Data Processing Agreement (the "DPA") to govern Meridian Telematics Solutions, Inc.'s ("Meridian" or "MTS") processing of connected-vehicle telemetry data generated by Vantage Mobility Systems Corp.'s ("VMS") proprietary VantageLink platform. The engagement arose in connection with a contemplated multi-year commercial partnership between VMS and Meridian under which Meridian would receive and process up to fourteen categories of vehicle telemetry and in-cabin sensor data to develop analytics and machine-learning products for the automotive industry.
Calderwood & Harkness prepared an initial draft DPA, transmitted it to Meridian's counsel, and engaged in multiple rounds of negotiation over the ensuing four months. Substantial progress was made, but significant open issues remained unresolved. On January 10, 2023, Meridian informed VMS that it intended to rescope the partnership, reducing the number of data categories from fourteen to six and eliminating real-time data streaming. This rescoping introduced material uncertainty regarding the commercial terms that would underpin the DPA and, consequently, regarding the appropriate scope and substance of the DPA itself.
On January 18, 2023, VMS General Counsel Thomas Langford instructed Calderwood & Harkness via email to pause all DPA negotiations pending finalization of a revised commercial term sheet between VMS and Meridian. On January 25, 2023, a formal hold notification was transmitted by Calderwood & Harkness to Whitfield, Barrow & Crane LLP ("WBC"), counsel for Meridian, confirming the pause in negotiations and the preservation of all existing draft positions and open issues.
As of the date of this memorandum, the DPA remains in draft at version 3.1 (dated December 16, 2022, as returned by WBC), with six material open issues unresolved. No revised commercial term sheet has been executed between the parties. The matter is accordingly designated dormant, and a 90-day status check-in with VMS is recommended.
II. Engagement Background
A. The Client and the Commercial Partnership
The Client. Vantage Mobility Systems Corp. ("VMS") is a Delaware corporation headquartered at 4700 Automation Boulevard, Suite 300, Auburn Hills, Michigan 48326. VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms for the automotive industry. Its flagship product is the VantageLink system, a comprehensive connected-vehicle hardware and software solution that collects, transmits, and manages vehicle telemetry data. As of the date of the engagement, VantageLink is installed in approximately 2.4 million connected vehicles across North America, spanning passenger vehicles, light commercial vehicles, and select fleet applications.
VMS is a portfolio company of Northgate Capital Partners LLC ("Northgate"), a Michigan limited liability company headquartered at 600 Woodward Avenue, 22nd Floor, Detroit, Michigan 48226. Northgate acquired a controlling 72% equity stake in VMS in November 2019 through Northgate Fund II, L.P. Northgate is a middle-market private equity firm focused on industrial technology and mobility-sector investments, managing approximately $2.8 billion in committed capital across three funds. The Managing Director overseeing the VMS investment is Erik Johansson. VMS's financial performance has been strong since Northgate's acquisition; VMS reported revenues of approximately $385 million for fiscal year 2021 and employs approximately 1,200 individuals.
As a Northgate portfolio company, VMS is subject to Northgate's standardized portfolio billing guidelines for outside counsel engagements. These guidelines include, among other provisions, a voluntary fee reduction applicable to all law firm billings. The specific application of these guidelines to this engagement is described in Section VI below.
The Counterparty. Meridian Telematics Solutions, Inc. ("Meridian" or "MTS") is a Delaware corporation headquartered at 1250 Embarcadero Way, Suite 400, Palo Alto, California 94303. Meridian maintains a data operations center at 8900 Research Park Drive, Building C, Austin, Texas 78759, which serves as its primary facility for data ingestion, processing, and analytics operations. Meridian provides cloud-based analytics and machine-learning services to automotive original equipment manufacturers ("OEMs") and Tier 1 automotive suppliers, leveraging vehicle telemetry and sensor data to develop predictive maintenance models, driver behavior analytics, and fleet optimization tools.
Meridian employs approximately 340 individuals and reported annual recurring revenue ("ARR") of approximately $78 million as of the second quarter of 2022. Key personnel at Meridian relevant to this engagement include: Priya Ramanathan, Chief Executive Officer; Julian Voss, Chief Technology Officer; and Lena Torrance, Head of Data Governance. Ms. Torrance served as Meridian's primary technical and governance contact during the DPA negotiation and participated in the November 15, 2022 negotiation call referenced in Section III below.
B. Commercial Partnership Terms (Pre-Rescoping)
VMS and Meridian executed a non-binding Letter of Intent (the "LOI") on August 5, 2022, setting forth the principal terms of a contemplated commercial partnership under which Meridian would receive and process vehicle telemetry and in-cabin sensor data from VMS's VantageLink platform. The LOI was negotiated directly between VMS's commercial team, led by Marcus Chen, Vice President of Connected Services, and Meridian's executive leadership. Calderwood & Harkness was not involved in the negotiation or drafting of the LOI.
Under the LOI, Meridian would receive and process up to fourteen (14) categories of vehicle telemetry and in-cabin sensor data, as follows:
1. GPS/geolocation data
2. Vehicle speed
3. Acceleration/deceleration
4. Braking events
5. Tire pressure
6. Engine diagnostic codes (OBD-II and proprietary)
7. Fuel consumption
8. In-cabin temperature
9. In-cabin humidity
10. Seat occupancy
11. Seatbelt status
12. Ambient noise levels
13. Windshield wiper activation
14. Headlight/taillight status
Of these fourteen categories, two — GPS/geolocation data and seat occupancy data — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy (the "VMS Data Governance Policy," version 4.2, effective March 2022). The Sensitive Vehicle Data designation is triggered because these two categories, when combined with vehicle identification numbers ("VINs") or other persistent vehicle identifiers, are linkable to identifiable individuals (i.e., vehicle owners and operators). This classification carries heightened processing, storage, and access-control requirements under VMS's internal policies and informed several of the more protective provisions in the DPA as initially drafted by Calderwood & Harkness.
The data to be shared with Meridian would be sourced from approximately 800,000 opted-in vehicles (out of VMS's total install base of approximately 2.4 million vehicles) participating in VMS's "Connected Insights" voluntary data-sharing program. Under the Connected Insights program, vehicle owners affirmatively consent to the collection and sharing of specified categories of telemetry data for analytics and product-improvement purposes, subject to VMS's consumer-facing privacy notice and the terms of the Connected Insights program agreement. The estimated daily data volume, based on pre-engagement estimates provided by VMS's engineering team, was approximately 4.2 terabytes of raw telemetry data per day.
The principal commercial terms set forth in the LOI were as follows:
• Annual License Fee: $6.5 million per year, payable quarterly in installments of $1.625 million per quarter.
• Royalty: 3.5% royalty on Meridian's gross revenues from derivative analytics products sold to third parties that incorporate or are derived from VMS-sourced data.
• Term: Three (3) years, with two (2) optional one-year renewal periods exercisable by mutual written agreement.
• Total Base-Term Contract Value: $19.5 million over the initial three-year term (excluding royalties and any renewal-period fees).
It is important to note that the LOI was expressly non-binding with respect to the commercial terms and was subject to, among other things, the negotiation and execution of definitive agreements, including the DPA that is the subject of this engagement. The LOI contained customary exclusivity and confidentiality provisions that were binding.
C. Engagement Scope and Team
Calderwood & Harkness was retained by VMS to draft and negotiate the DPA governing Meridian's processing of VMS vehicle data in connection with the LOI partnership. The scope of the engagement encompassed the drafting of the initial DPA (including all annexes), the negotiation of the DPA with Meridian's outside counsel, and the provision of related regulatory compliance analysis as necessary to ensure that the DPA adequately addressed applicable data protection and privacy law requirements. The engagement did not encompass negotiation of the underlying commercial terms (which were handled directly between the parties' respective commercial teams) or the preparation of the master services agreement or other definitive commercial agreements.
The Calderwood & Harkness engagement team was composed as follows:
• Rachel Bernstein — Responsible Partner, Privacy & Data Security Practice Group. Ms. Bernstein provided strategic direction on the DPA structure and led the November 15, 2022 negotiation call with WBC. Ms. Bernstein also served as the primary relationship partner for VMS.
• Kevin Ostrowski — Billing Partner, Privacy & Data Security Practice Group. Mr. Ostrowski provided substantive oversight on select regulatory compliance issues, particularly the CCPA/CPRA analysis, and served as the billing partner for the engagement.
• Alan Burke — Lead Associate (Senior Associate), Privacy & Data Security Practice Group. Mr. Burke was responsible for the day-to-day management of the engagement, including the initial drafting of the DPA and all annexes, the preparation of internal memoranda and issues lists, and the coordination of the negotiation process with WBC. Mr. Burke is the author of this memorandum.
• Sara Hendricks — Working Associate, Privacy & Data Security Practice Group. Ms. Hendricks provided research and drafting support, including contributions to the regulatory applicability memorandum, the sub-processor risk analysis memorandum, and the cross-border data transfer impact assessment memorandum.
Meridian was represented by Whitfield, Barrow & Crane LLP ("WBC"), with offices at 555 California Street, Suite 3200, San Francisco, California 94104. The WBC team consisted of Catherine Ng, Partner, who served as lead counsel and primary negotiation counterpart to Rachel Bernstein, and Derek Yamada, Associate, who was responsible for the preparation of WBC's redline comments and drafting contributions.
The primary VMS client contacts for the engagement were:
• Diana Kowalski — Chief Privacy Officer, VMS. Ms. Kowalski served as the primary substantive contact for data protection and privacy matters and provided VMS's internal policy guidance on data classification, consent frameworks, and regulatory compliance.
• Thomas Langford — General Counsel, VMS. Mr. Langford provided legal oversight of the engagement, approved all draft positions before external transmission, and ultimately issued the instruction to pause negotiations.
• Marcus Chen — Vice President, Connected Services, VMS. Mr. Chen served as the commercial lead for the VMS–Meridian partnership and was the primary VMS contact on commercial terms and rescoping discussions.
III. Chronological Summary of Engagement Activity
The following is a chronological summary of material events and milestones during the active period of the engagement, from opening through dormancy designation:
September 14, 2022. The engagement was formally opened. Calderwood & Harkness's conflicts department cleared the engagement, and Matter No. 1007-00007 was assigned. An engagement letter was executed by Thomas Langford on behalf of VMS. Calderwood & Harkness commenced work on the initial draft of the DPA.
September 28, 2022. DPA version 1.0 was circulated to VMS for internal review. The initial draft consisted of forty-seven (47) pages, including the body of the DPA and three annexes: Annex A (Data Categories and Processing Description), Annex B (Technical and Organizational Measures), and Annex C (Approved Sub-Processors). Annex C identified a single approved sub-processor, Cloudvault Infrastructure, Inc. ("Cloudvault"), which provides cloud infrastructure and data hosting services used by Meridian for its analytics platform. The DPA was structured as a controller-to-processor agreement, with VMS designated as the data controller and Meridian as the data processor for purposes of the vehicle telemetry data at issue.
October 7, 2022. Following VMS's internal review and the incorporation of comments from Diana Kowalski and Thomas Langford, DPA version 1.0 was transmitted to WBC via a formal cover letter from Rachel Bernstein to Catherine Ng. The cover letter noted that the draft reflected VMS's positions on all material terms and invited WBC to provide a comprehensive redline response.
October 21, 2022. WBC returned a redlined version of the DPA, designated as DPA version 2.0. The WBC redline contained sixty-three (63) substantive comments and proposed revisions spanning the body of the agreement and all three annexes. The scope and volume of WBC's redline indicated that the parties' positions on a number of fundamental issues — including data retention, sub-processor governance, breach notification, and liability allocation — were materially divergent.
October 18, 2022. A regulatory applicability memorandum was prepared by the Calderwood & Harkness engagement team, analyzing the applicability of the Michigan Identity Theft Protection Act (MCL 445.61 et seq.), the California Consumer Privacy Act and California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq., as amended), and the federal Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) to the data processing contemplated by the DPA. The memorandum included specific recommendations for DPA provisions to ensure compliance with each applicable statute. This memorandum was circulated internally to the engagement team and shared with Diana Kowalski for VMS's reference. A more detailed summary of the regulatory analysis is set forth in Section V below.
November 4, 2022. An internal issues memorandum was circulated to VMS (specifically to Diana Kowalski and Thomas Langford), identifying eleven (11) material open issues arising from WBC's redline of DPA v2.0. The memorandum categorized the open issues by subject matter, assessed the significance of each issue, and recommended negotiation strategies for each. The eleven open issues spanned the following subject areas: data retention, sub-processor approval mechanisms, breach notification timelines, liability caps, data return and destruction protocols, audit and inspection rights, data localization requirements, intellectual property ownership of derivative analytics, purpose limitation language, data minimization standards, and indemnification triggers.
November 10, 2022. A sub-processor risk analysis memorandum was prepared, evaluating the risk profile of Cloudvault Infrastructure, Inc. as the sole proposed sub-processor under the DPA. The analysis assessed Cloudvault's corporate structure, financial stability, data center locations (at that time, Reno, Nevada and Columbus, Ohio), security certifications (SOC 2 Type II, ISO 27001), contractual flow-down provisions, and incident history. The memorandum also included a recommended hybrid approach to sub-processor approval — combining elements of VMS's prior-consent position and Meridian's general-authorization proposal — that was subsequently discussed during the November 15 negotiation call.
November 15, 2022. A negotiation call was held among the following participants: Rachel Bernstein and Alan Burke from Calderwood & Harkness; Catherine Ng and Derek Yamada from WBC; Lena Torrance from Meridian (Head of Data Governance); and Diana Kowalski from VMS (Chief Privacy Officer). During the call, the parties discussed each of the eleven material open issues identified in the November 4 internal issues memorandum. Seven of the eleven issues were resolved during the call or through agreement in principle reached during the discussion. The four issues that remained unresolved after the call were: (1) data retention period, (2) sub-processor approval rights, (3) breach notification timeline, and (4) liability cap. A negotiation call summary memorandum was prepared by Alan Burke immediately following the call and circulated to the engagement team and VMS contacts.
November 22, 2022. Pinehurst Cybersecurity Advisors LLC ("Pinehurst"), an independent cybersecurity consulting firm engaged directly by VMS (outside the scope of the Calderwood & Harkness engagement), delivered its preliminary security assessment findings on Meridian's data processing environment. The Pinehurst assessment was provided to VMS and was referenced in Calderwood & Harkness's internal work product but was not prepared by Calderwood & Harkness and is not Calderwood & Harkness work product. Pinehurst's principal office is located at 1900 Crystal Drive, Suite 710, Arlington, Virginia 22202.
December 2, 2022. DPA version 3.0 was circulated to WBC. This version reflected the agreed resolutions on the seven issues resolved during and following the November 15 negotiation call and incorporated VMS's positions on the four remaining open issues (data retention, sub-processor approval, breach notification, and liability cap). Clean and redlined versions were transmitted to WBC for review.
December 16, 2022. WBC returned DPA version 3.1, containing revised language on the four remaining open issues as well as two newly raised issues that had not been identified in the prior drafts or discussions: (1) international data transfer restrictions, triggered by Meridian's disclosure of a potential future migration of certain data processing operations to Cloudvault's proposed Dublin, Ireland data center; and (2) sub-processor audit rights, relating to VMS's operational ability to conduct on-site audits of Cloudvault and any future sub-processors. The introduction of these two new issues expanded the total number of material open issues from four to six.
December 20, 2022. A cross-border data transfer impact assessment memorandum was prepared by the Calderwood & Harkness engagement team, analyzing the implications of Meridian's potential future migration of data processing to Cloudvault Infrastructure, Inc.'s proposed facility in Dublin, Ireland (located at Unit 12, Parkwest Business Campus, Dublin 12, Ireland). The memorandum assessed the potential applicability of the European Union General Data Protection Regulation ("GDPR") and the implications for data transfer mechanisms, including Standard Contractual Clauses ("SCCs") and supplementary measures. The memorandum recommended specific DPA provisions requiring VMS's prior written consent for any international data transfer and mandatory transfer impact assessments.
January 10, 2023. Meridian CEO Priya Ramanathan informed VMS Vice President Marcus Chen that Meridian was rescoping the contemplated partnership. The rescoping involved two material changes: (a) elimination of real-time data streaming (replacing it with batch data transfers at intervals to be determined), and (b) reduction of the data categories to be shared from fourteen (14) to six (6). The six retained categories under the rescoped partnership would be: vehicle speed, braking events, tire pressure, engine diagnostic codes, fuel consumption, and headlight/taillight status. Critically, the two categories classified as Sensitive Vehicle Data under VMS's internal data governance policy — GPS/geolocation and seat occupancy — would be eliminated from the scope of the partnership.
January 18, 2023. Thomas Langford, General Counsel of VMS, sent an email to Rachel Bernstein instructing Calderwood & Harkness to pause all work on the DPA negotiations pending the finalization of a revised commercial term sheet between VMS and Meridian reflecting the rescoped partnership. Mr. Langford indicated that the commercial teams were in active discussions but that no timeline had been established for execution of a revised term sheet. Rachel Bernstein acknowledged the instruction by email on the same date and confirmed that Calderwood & Harkness would suspend all active work on the matter while preserving the engagement in an open but dormant status.
January 25, 2023. Calderwood & Harkness transmitted a formal hold notification letter to Catherine Ng at WBC, confirming the pause in DPA negotiations and the preservation of all existing draft positions, open issues, and agreed-upon resolutions as reflected in DPA v3.1. The letter noted that the hold was at VMS's direction pending finalization of revised commercial terms and that Calderwood & Harkness would notify WBC when negotiations were ready to resume.
February 3, 2023. This memorandum is prepared, and the matter is formally designated dormant in Calderwood & Harkness's matter management system.
IV. Current Status of the DPA — Version 3.1
A. Overview. The DPA is currently at version 3.1, dated December 16, 2022, as returned by Whitfield, Barrow & Crane LLP. This version represents WBC's most recent redline and reflects Meridian's positions on the four previously unresolved issues as well as two newly raised issues. Six material issues remain open and unresolved as of the date that the matter was placed on hold. Each of these issues is described in detail below, including a summary of each party's position, the status of negotiations, and any relevant analysis that has been prepared.
It should be noted that, in addition to the six material open issues, there are a number of less significant drafting points and conforming changes that remain to be finalized in the DPA text. These are not individually catalogued in this memorandum, as they are expected to be resolved through normal drafting cleanup once the material issues are agreed. The six material open issues are the substantive barriers to finalization of the DPA.
B. Open Issue 1: Data Retention Period
DPA Section Reference: Section 7.2 (Retention and Deletion of Processed Data).
VMS Position: VMS has consistently maintained that Meridian should be required to delete all raw vehicle telemetry data within a ninety (90)-day rolling window following the completion of initial processing. Under VMS's proposed language, Meridian would be permitted to retain processed and aggregated outputs (i.e., the analytics products derived from the raw data) for the term of the agreement, but the underlying raw data — which is the data most directly linkable to individual vehicles and their operators — would be subject to the 90-day deletion requirement.
Meridian Position: Meridian has insisted on an eighteen (18)-month retention period for raw data, arguing that its machine-learning model-training processes require access to historical raw data sets over extended periods to achieve statistically meaningful accuracy and to perform longitudinal analysis. Meridian's position is that the 90-day window is operationally infeasible for its intended use of the data and would fundamentally undermine the commercial value of the partnership.
Status: No compromise language has been proposed or agreed. The gap between the parties' positions — 90 days versus 18 months — is significant and has been identified by both sides as a priority issue. DPA v3.1 brackets both positions in Section 7.2, with each party's proposed language set forth in full. During the November 15 negotiation call, the parties discussed but did not resolve potential intermediate positions (e.g., a tiered retention framework under which different categories of data would be subject to different retention periods). This issue will need to be revisited in any reactivation, particularly in light of the rescoping of the partnership (as discussed in Section VIII below).
C. Open Issue 2: Sub-Processor Approval Rights
DPA Section Reference: Section 9.1 (Appointment of Sub-Processors).
VMS Position: VMS has taken the position that Meridian must obtain VMS's prior written consent before appointing any sub-processor to process VMS vehicle data. Under VMS's proposed language, no deemed-consent mechanisms or passive approval processes would be permitted; VMS would retain an affirmative veto right over each sub-processor appointment. This position reflects VMS's concern, informed by the Pinehurst preliminary security assessment, about maintaining robust control over the downstream chain of data processing.
Meridian Position: Meridian has proposed a general authorization model under which Meridian would provide VMS with advance notice of any proposed new or replacement sub-processor, and VMS would have a thirty (30)-day objection window. If VMS did not object within the 30-day period, consent would be deemed granted. Meridian has argued that the prior-written-consent model is commercially impractical given the pace of its infrastructure and vendor management operations and could delay critical technology deployments.
Status: Calderwood & Harkness recommended a hybrid approach in the November 10, 2022 sub-processor risk analysis memorandum. Under the recommended hybrid approach, prior written consent would be required for any sub-processor that would have access to Sensitive Vehicle Data (GPS/geolocation and seat occupancy), while a general authorization model with an objection window would apply to sub-processors handling only non-sensitive categories. This recommendation was discussed during the November 15 negotiation call but was not agreed upon by Meridian, and no final compromise has been reached. Notably, the rescoping of the partnership — which eliminates Sensitive Vehicle Data categories from scope — may alter the practical dynamics of this issue, as there would be no Sensitive Vehicle Data tier to differentiate from non-sensitive processing.
D. Open Issue 3: Breach Notification Timeline
DPA Section Reference: Section 11.3 (Notification of Personal Data Breach).
VMS Position: VMS has insisted on a twenty-four (24)-hour notification timeline, requiring Meridian to notify VMS within 24 hours of Meridian's discovery of any personal data breach affecting VMS vehicle data. VMS's position is driven by its own obligations under its consumer-facing privacy notice (which commits VMS to notifying affected vehicle owners "as promptly as reasonably practicable") and by the Michigan Identity Theft Protection Act's notification requirements.
Meridian Position: Meridian has proposed a seventy-two (72)-hour notification timeline, arguing that this is consistent with the standard established under Article 33 of the GDPR (which requires notification to the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of" a personal data breach). Meridian has contended that a 24-hour requirement is operationally unrealistic and could result in premature or inaccurate notifications that would be counterproductive to effective incident response.
Status: The parties discussed this issue during the November 15, 2022 negotiation call. Neither party has moved from its stated position. The issue remains bracketed in DPA v3.1 at Section 11.3, with both 24-hour and 72-hour formulations presented. Calderwood & Harkness has not prepared a formal recommendation on a compromise position, though one possibility discussed informally was a tiered approach under which 24-hour notification would apply to breaches involving Sensitive Vehicle Data and 72-hour notification would apply to breaches involving only non-sensitive categories. As with Open Issue 2, the elimination of Sensitive Vehicle Data from the rescoped partnership may affect the analysis.
E. Open Issue 4: Liability Cap
DPA Section Reference: Section 14.2 (Limitation of Liability for Data Protection Obligations).
VMS Position: VMS has taken the position that Meridian's liability for data breaches and unauthorized processing should be uncapped. VMS's rationale is that capping liability for data protection failures creates a moral hazard and is inconsistent with VMS's fiduciary obligations to its vehicle owners and with the potential scale of harm from a large-scale breach affecting data from up to 800,000 vehicles.
Meridian Position: Meridian has proposed that its aggregate liability for all claims arising under the DPA be capped at fifteen million dollars ($15,000,000), representing approximately 2.31 times the annual license fee of $6.5 million. Meridian has argued that uncapped liability is inconsistent with market norms for data processing agreements of this scale and that the proposed cap is commercially reasonable in light of the total contract value.
Status: No compromise has been proposed by either party. This remains one of the most significant commercial gaps between the parties and is closely interrelated with the underlying commercial terms. The cap amount of $15 million was calibrated by Meridian against the original $6.5 million annual license fee; if the rescoped partnership results in a reduced license fee, the cap amount would presumably need to be re-benchmarked. Calderwood & Harkness has informally discussed with VMS the possibility of a tiered liability framework (e.g., uncapped liability for willful misconduct or gross negligence, with a cap applying to other breaches), but no formal recommendation has been issued and no compromise language has been drafted.
F. Open Issue 5: International Data Transfer Restrictions
DPA Section Reference: Section 12 (International Data Transfers) — newly added in DPA v3.1.
This issue was first raised by WBC in DPA v3.1 and was not present in any prior draft of the DPA. The issue was triggered by Meridian's disclosure, during the course of the December 2022 negotiation exchanges, that Cloudvault Infrastructure, Inc. was evaluating the establishment of a new data center facility in Dublin, Ireland (Unit 12, Parkwest Business Campus, Dublin 12, Ireland), and that Meridian might, at some point in the future, migrate a portion of its data processing operations to that facility. Cloudvault's current U.S.-based data centers — located at 200 Mill Street, Suite 100, Reno, Nevada 89501 and 7400 Crossroads Boulevard, Columbus, Ohio 43219 — are acceptable to VMS and are listed as approved facilities in Annex B of the DPA.
VMS Position (as set forth in Calderwood & Harkness's December 20, 2022 memorandum): VMS's position, as recommended by Calderwood & Harkness in the cross-border data transfer impact assessment memorandum, is that the DPA should require VMS's prior written consent for any transfer of VMS vehicle data to a data processing facility located outside the United States, and that any such transfer should be subject to a mandatory transfer impact assessment to evaluate the adequacy of legal protections in the receiving jurisdiction and the sufficiency of supplementary technical and organizational measures. The memorandum noted that, although no EU data subjects are currently in scope (the data is derived from vehicles registered in the United States), hosting VMS data on infrastructure located within the European Union could trigger obligations under the GDPR if any data accessible at the Dublin facility were to be linked to individuals located in the EU.
Meridian Position (as set forth in DPA v3.1): WBC's proposed language in DPA v3.1 would permit Meridian to transfer VMS data to any Cloudvault facility worldwide, provided that such facility meets the security standards set forth in Annex B (Technical and Organizational Measures), without requiring VMS's prior written consent. WBC's position is that the security-based standard provides adequate protection and that a prior-consent requirement would impose unnecessary administrative burden and delay.
Status: This issue is fully open. No compromise language has been discussed. Calderwood & Harkness's December 20, 2022 memorandum provides a detailed analysis of the regulatory implications and recommended DPA provisions. This issue is not expected to be significantly affected by the rescoping of the partnership, as it relates to infrastructure and data center location decisions rather than the categories of data being processed.
G. Open Issue 6: Sub-Processor Audit Rights
DPA Section Reference: Section 9.4 (Audit and Inspection Rights) — newly revised by WBC in DPA v3.1.
This issue is distinct from the sub-processor approval rights issue addressed in Open Issue 2 above. While Open Issue 2 concerns the mechanism by which VMS consents to the appointment of sub-processors, Open Issue 6 concerns VMS's operational ability to verify, through on-site audits and inspections, that appointed sub-processors are in compliance with the technical and organizational measures and data protection obligations set forth in the DPA.
VMS Position (from DPA v1.0 through v3.0): VMS's original language, carried through all drafts from v1.0 through v3.0, provided VMS with unlimited on-site audit rights with respect to Meridian and any sub-processor, subject only to a requirement that VMS provide ten (10) business days' advance notice before conducting an audit. Under VMS's proposed language, there was no limit on the frequency of audits, no cost-sharing obligation, and no restriction on the scope of the audit beyond the requirement that it be related to Meridian's compliance with the DPA.
Meridian Position (as set forth in DPA v3.1): WBC's revised language in DPA v3.1 would limit VMS to one (1) audit per calendar year, would require thirty (30) calendar days' advance written notice (as compared to the 10-business-day standard in VMS's drafts), and would impose a cost-sharing cap of twenty-five thousand dollars ($25,000) per audit, above which VMS would bear the cost of the audit. Meridian has argued that unlimited audit rights impose an unreasonable operational burden, particularly given that Cloudvault, as a major cloud infrastructure provider, provides annual SOC 2 Type II audit reports that should provide VMS with adequate assurance of sub-processor compliance.
Status: This issue is fully open. No compromise has been proposed. Calderwood & Harkness has not yet prepared a formal analysis of this issue or a recommended compromise position, as the issue was newly raised in DPA v3.1 (received December 16, 2022) and the engagement was placed on hold before a substantive response could be developed.
V. Regulatory Compliance Work Product
A. Applicable Statutes Analyzed
The regulatory applicability memorandum prepared on October 18, 2022, analyzed the applicability of the following statutes to the data processing contemplated by the DPA:
1. Michigan Identity Theft Protection Act (MCL 445.61 et seq.) — Applicable as the governing law of the DPA is Michigan and VMS is a Michigan-headquartered entity. The Act imposes obligations with respect to the security of personal information, breach notification, and third-party service provider oversight.
2. California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq., as amended by Proposition 24, effective January 1, 2023) — Applicable to the extent that vehicle telemetry data constitutes "personal information" of California residents and VMS or Meridian meets the jurisdictional thresholds under the CCPA/CPRA.
3. Federal Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) — Applicable to the extent that any of the data categories processed under the DPA constitute "personal information" derived from motor vehicle records, as defined under the DPPA.
The governing law of the DPA is Michigan. The DPA was drafted subject to Michigan law, and the parties have not disputed the choice of law. However, the multistate nature of the data subject population (i.e., vehicle owners in multiple U.S. states) and the California presence of a significant portion of that population necessitated analysis of California law as well.
B. Key Regulatory Findings
The regulatory applicability memorandum reached the following principal conclusions:
CCPA/CPRA Applicability. Approximately 112,000 of the 800,000 opted-in vehicles participating in VMS's Connected Insights program are registered in California, representing approximately 14% of the total data subject population. Given this concentration of California consumers and VMS's annual revenues (approximately $385 million for FY2021, well above the CCPA/CPRA jurisdictional revenue threshold), the CCPA/CPRA was determined to be applicable to VMS's sharing of vehicle telemetry data with Meridian. The memorandum analyzed the classification of Meridian under the CCPA/CPRA framework — specifically, whether Meridian would be characterized as a "service provider" or a "third party" for purposes of the Act — and recommended DPA provisions to ensure that the arrangement qualified as a service provider relationship, including purpose limitation, re-identification prohibition, and contractual certification provisions consistent with CCPA/CPRA regulatory requirements.
Personal Information Classification. VIN-linked GPS/geolocation data and seat occupancy data were analyzed as likely constituting "personal information" under each of the three applicable statutes. GPS/geolocation data, when linked to a specific vehicle through a VIN, enables the identification and tracking of the vehicle's owner or operator and was determined to fall squarely within the definition of personal information under the CCPA/CPRA, the Michigan Identity Theft Protection Act, and the DPPA. Seat occupancy data, while less obviously identifiable on its own, was analyzed as potentially constituting personal information when combined with VINs and GPS/geolocation data, as the combination could reveal information about the habits, routines, and personal life of the vehicle's owner or operator.
GDPR Applicability. GDPR applicability was determined to be limited to the potential Cloudvault Dublin migration scenario. As of the date of the memorandum, no EU data subjects were in scope — all data was derived from vehicles registered in the United States, and all data processing occurred at Cloudvault's U.S.-based data centers. However, the December 20, 2022 cross-border data transfer impact assessment memorandum provided a more detailed analysis of the GDPR implications that could arise if Meridian were to migrate processing to Cloudvault's proposed Dublin facility. That memorandum is discussed in Section III above and is included in the work product inventory in Section VII below.
DPPA Applicability. The DPPA analysis focused on whether the vehicle telemetry data categories included in the DPA constituted "personal information" derived from "motor vehicle records" as defined in 18 U.S.C. § 2725. The memorandum concluded that the DPPA was likely applicable to the extent that VMS shared VIN-linked data, as VINs are motor vehicle identifiers that could be cross-referenced with state motor vehicle department records. The memorandum recommended DPA provisions ensuring that any disclosure of VIN-linked data complied with the DPPA's permissible-use exceptions.
C. Impact of Rescoping on Regulatory Analysis
The rescoping of the partnership announced by Meridian on January 10, 2023, has potentially significant implications for the regulatory analysis. As noted above, the rescoped partnership would eliminate GPS/geolocation and seat occupancy data from the categories shared with Meridian. The six retained categories — vehicle speed, braking events, tire pressure, engine diagnostic codes, fuel consumption, and headlight/taillight status — are not classified as "Sensitive Vehicle Data" under VMS's internal data governance policy.
The elimination of GPS/geolocation and seat occupancy data from the data-sharing scope may significantly simplify the CCPA/CPRA and DPPA compliance analysis. These two categories were the primary drivers of the "personal information" classification under each applicable statute, as they are the categories most directly linkable to identifiable individuals when combined with VINs or other persistent vehicle identifiers. The remaining six categories are operational and mechanical in nature and are considerably less likely to constitute "personal information" when not combined with location data or other data that could reveal the identity, habits, or routines of a specific individual.
However, a fresh regulatory analysis should be conducted if the matter is reactivated. The key analytical question will be whether the six rescoped data categories, when combined with any vehicle identifiers that Meridian may receive (such as VINs, which may be embedded in the data feed for data integrity and quality assurance purposes), could still trigger statutory obligations under the CCPA/CPRA, the DPPA, or the Michigan Identity Theft Protection Act. Additionally, the Michigan Identity Theft Protection Act applicability should be reassessed specifically for the narrowed data scope, as the Act's definitions and protections may apply differently when the data at issue does not include geolocation or biometric-adjacent categories.
Calderwood & Harkness did not prepare a supplemental regulatory analysis following the January 10, 2023 rescoping announcement, as the engagement was placed on hold eight days later and the revised commercial terms had not been finalized. Any such supplemental analysis should be a priority workstream upon reactivation.
VI. Financial Summary
A. Fees and Hours
The following table summarizes the total hours recorded and gross fees generated by each timekeeper on the engagement from opening through the date of dormancy:
The allocation of hours across timekeepers reflects the typical staffing model for a data processing agreement negotiation of this scope and complexity. The majority of the hours were recorded by the lead associate (Alan Burke), who was responsible for the initial drafting, day-to-day management of the negotiation process, preparation of all internal memoranda and issues lists, and coordination with both the client and opposing counsel. Partner time was focused on strategic direction, relationship management, negotiation calls, and oversight of key deliverables.
B. Northgate Portfolio Billing Guidelines
As noted in Section II above, VMS is a portfolio company of Northgate Capital Partners LLC. Pursuant to Northgate's portfolio billing guidelines — which are applicable to all outside counsel engagements across Northgate's portfolio companies — Calderwood & Harkness applied a voluntary fee reduction of 9.4% to the gross fees generated on this engagement. The Northgate portfolio billing guidelines were provided to Calderwood & Harkness at the outset of the engagement and are incorporated by reference in the engagement letter.
The fee reduction is calculated as follows:
• Gross fees: $157,275.00
• Voluntary reduction (9.4%): $157,275.00 × 0.094 = $14,783.85 (approximately $14,784)
• Adjusted total fees billed through dormancy: approximately $142,500.00
No disbursements or expenses of material amount were incurred during the engagement. Any incidental expenses (e.g., document reproduction, electronic research charges) are included in the standard monthly billing statements and are not separately itemized in this memorandum.
C. Billing and Payment Information
All invoices for the engagement have been directed to:
Vantage Mobility Systems Corp.
Attn: Legal Department
4700 Automation Boulevard, Suite 300 Auburn Hills, MI 48326
Invoices were issued monthly in accordance with Calderwood & Harkness's standard billing cycle and the terms of the engagement letter. Outstanding receivables, if any, as of February 3, 2023, should be confirmed with Calderwood & Harkness's billing department prior to any reactivation of the matter. It is recommended that any outstanding receivables be resolved before substantial new work is commenced.
VII. Work Product Inventory
The following is a complete inventory of all Calderwood & Harkness work product and key correspondence generated or received in connection with this engagement. All items are maintained on Calderwood & Harkness's document management system under Matter No. 1007-00007.
1. Engagement Letter — Dated September 14, 2022. Executed by Thomas Langford on behalf of VMS.
2. DPA v1.0, Initial Draft — Dated September 28, 2022. Forty-seven (47) pages including body and three annexes: Annex A (Data Categories and Processing Description), Annex B (Technical and Organizational Measures), and Annex C (Approved Sub-Processors, listing Cloudvault Infrastructure, Inc.).
3. Transmittal Letter to WBC — Dated October 7, 2022. Cover letter from Rachel Bernstein to Catherine Ng transmitting DPA v1.0 following VMS internal approval.
4. Regulatory Applicability Memorandum — Dated October 18, 2022. Analysis of the applicability of the Michigan Identity Theft Protection Act, CCPA/CPRA, and DPPA to the data processing contemplated by the DPA, with DPA provision recommendations.
5. DPA v2.0, WBC Redline — Received October 21, 2022. WBC's redlined version of DPA v1.0, containing 63 substantive comments and proposed revisions.
6. Internal Issues Memorandum — Dated November 4, 2022. Identified 11 material open issues from WBC's redline of DPA v2.0, with categorization, significance assessment, and negotiation strategy recommendations. Circulated to Diana Kowalski and Thomas Langford at VMS.
7. Sub-Processor Risk Analysis Memorandum — Dated November 10, 2022. Evaluation of Cloudvault Infrastructure, Inc. as proposed sub-processor, including corporate profile, security certifications, incident history, and recommended hybrid sub-processor approval approach.
8. Negotiation Call Summary Memorandum — Dated November 15, 2022. Summary of the negotiation call held among Calderwood & Harkness, WBC, VMS (Diana Kowalski), and Meridian (Lena Torrance). Documents resolutions on 7 of 11 open issues and identifies 4 remaining unresolved issues.
9. DPA v3.0, Revised Draft — Dated December 2, 2022. Incorporating agreed resolutions on 7 issues and VMS's positions on 4 remaining open issues. Circulated to WBC in clean and redlined versions.
10. DPA v3.1, WBC Revised Return — Received December 16, 2022. WBC's revised redline addressing 4 remaining issues and raising 2 new issues (international data transfer restrictions and sub-processor audit rights). This is the most current version of the DPA.
11. Cross-Border Data Transfer Impact Assessment Memorandum — Dated December 20, 2022. Analysis of implications of Meridian's potential future migration to Cloudvault's proposed Dublin, Ireland data center, including GDPR applicability assessment, transfer mechanism evaluation, and recommended DPA provisions.
12. Client Instruction Email from Thomas Langford — Dated January 18, 2023. Email from VMS General Counsel instructing Calderwood & Harkness to pause DPA negotiations pending finalization of revised commercial term sheet.
13. Rachel Bernstein Acknowledgment Email — Dated January 18, 2023. Email from Rachel Bernstein acknowledging Thomas Langford's instruction and confirming the pause.
14. Formal Hold Notification Letter to WBC — Dated January 25, 2023. Letter from Calderwood & Harkness to Catherine Ng at WBC confirming the pause in negotiations and preservation of all draft positions and open issues.
Note: The Pinehurst Cybersecurity Advisors LLC preliminary security assessment (delivered to VMS on November 22, 2022) is VMS's document and was prepared by Pinehurst under a separate engagement with VMS. It is not Calderwood & Harkness work product. However, the Pinehurst assessment is referenced in Calderwood & Harkness's internal work product (specifically, the sub-processor risk analysis memorandum and the negotiation call summary memorandum) and should be requested from VMS if needed upon reactivation.
VIII. Reactivation Considerations
The following considerations are intended to provide a roadmap for the efficient reactivation of this matter if and when VMS instructs Calderwood & Harkness to resume work on the DPA.
A. Revised Commercial Terms
As discussed in Section III above, on January 10, 2023, Meridian CEO Priya Ramanathan informed VMS Vice President Marcus Chen that Meridian intended to rescope the commercial partnership. The rescoping involves two material changes: (a) the elimination of real-time data streaming, to be replaced with batch data transfers at intervals to be determined, and (b) the reduction of data categories to be shared from fourteen (14) to six (6). The six retained categories are:
1. Vehicle speed
2. Braking events
3. Tire pressure
4. Engine diagnostic codes
5. Fuel consumption
6. Headlight/taillight status
The eight categories eliminated from the rescoped partnership include the two Sensitive Vehicle Data categories (GPS/geolocation and seat occupancy) as well as six additional categories (acceleration/deceleration, in-cabin temperature, in-cabin humidity, seatbelt status, ambient noise levels, and windshield wiper activation).
No revised commercial term sheet has been executed between VMS and Meridian as of the date of this memorandum. The financial terms of the partnership — including the annual license fee, the royalty rate, and the contract term — are expected to change as a result of the rescoping, but the parties' commercial teams have not yet finalized revised terms. The DPA negotiation cannot meaningfully resume until the revised commercial terms are known, as several DPA provisions (including the liability cap, certain financial cross-references, and data volume specifications) are dependent on or calibrated against the commercial terms.
B. Substantive Redrafting Required
The existing DPA (v3.1) was drafted for the original fourteen-category, real-time processing scope and will require substantial revision if the rescoped partnership is finalized. The following specific redrafting tasks are anticipated:
• Annex A (Data Categories and Processing Description): This annex must be entirely rewritten to reflect only the six rescoped categories. The processing description, purpose statements, and data flow diagrams in Annex A were drafted based on the original fourteen-category scope and the real-time streaming architecture. The batch processing model will require different technical descriptions and may involve different processing purposes.
• Annex B (Technical and Organizational Measures): This annex may need revision, as the elimination of real-time streaming significantly reduces the complexity of the processing infrastructure, the attack surface, and the corresponding security requirements. The TOM requirements that were specifically calibrated to the protection of Sensitive Vehicle Data (e.g., enhanced encryption, access controls, and pseudonymization for GPS/geolocation and seat occupancy data) can likely be simplified or removed.
• Sensitive Vehicle Data Provisions: The DPA body contains multiple provisions that impose heightened protections specifically applicable to the processing of Sensitive Vehicle Data. If the rescoped partnership eliminates all Sensitive Vehicle Data categories, these provisions can be removed or simplified, which would reduce the overall complexity of the agreement.
• Data Volume and Processing Capacity Specifications: The estimated daily data volume of approximately 4.2 terabytes per day was based on fourteen categories from approximately 800,000 vehicles. The rescoped volume — six categories, with batch rather than real-time transmission — may be significantly lower. The data volume specifications in the DPA and annexes will need to be recalibrated based on revised engineering estimates from VMS.
• Commercial Cross-References: The DPA contains provisions that reference or are calibrated against specific commercial terms, including the annual license fee, the contract term, and the royalty structure. If these commercial terms change as a result of the rescoping, the corresponding DPA provisions will need to be updated.
C. Open Issues That May Be Affected by Rescoping
The rescoping of the partnership may materially affect the dynamics and resolution of several of the six open issues identified in Section IV above:
Data Retention Period (Open Issue 1). The elimination of Sensitive Vehicle Data categories from scope may alter the risk calculus underlying VMS's insistence on a 90-day retention period. VMS's position was driven in significant part by the sensitivity of GPS/geolocation and seat occupancy data and the risk of harm from prolonged retention of such data. With only non-sensitive operational and mechanical data categories in scope, VMS may have greater flexibility to agree to a longer retention period, or the parties may find it easier to agree on a compromise position. Conversely, VMS may maintain its position as a matter of general data governance principle. This should be discussed with Diana Kowalski and Thomas Langford upon reactivation.
Breach Notification Timeline (Open Issue 3). With no Sensitive Vehicle Data in scope, the potential severity of a data breach may be reduced, and VMS may have greater flexibility on the 24-hour versus 72-hour notification question. The 24-hour requirement was driven in part by the sensitivity of the data at issue; if the rescoped data categories are less likely to constitute personal information or to cause identifiable harm to individuals, the urgency of notification may be perceived differently by VMS's privacy team.
Liability Cap (Open Issue 4). The $15 million cap proposed by Meridian was calibrated against the original $6.5 million annual license fee. If the commercial terms change as a result of the rescoping (e.g., a reduced license fee reflecting the reduced data scope), this issue will need to be re-benchmarked. The ratio of cap to annual fee (2.31×) may serve as a starting point for discussion, but the absolute dollar amount and the appropriate multiplier will need to be negotiated in the context of the revised commercial terms.
International Data Transfer Restrictions and Sub-Processor Issues (Open Issues 5 and 6). These issues are less likely to be affected by the rescoping, as they relate to Meridian's infrastructure decisions and Cloudvault's data center locations rather than to the categories of data being processed. The potential migration to the Cloudvault Dublin facility and the sub-processor audit rights question will persist regardless of the data scope. These issues should be addressed in any reactivation regardless of the rescoped terms.
D. Regulatory Considerations
As discussed in Section V.C above, the elimination of GPS/geolocation and seat occupancy data from the scope of the partnership may simplify compliance with the CCPA/CPRA and the DPPA, as the remaining six categories are less likely to be linkable to identifiable individuals. However, a supplemental regulatory analysis should be conducted if the matter is reactivated. The analysis should address, at a minimum:
• Whether the six rescoped data categories, when combined with any vehicle identifiers (e.g., VINs) that Meridian may continue to receive, could constitute "personal information" under the CCPA/CPRA, the DPPA, or the Michigan Identity Theft Protection Act.
• Whether VMS's obligations under its consumer-facing privacy notice and the Connected Insights program agreement need to be updated to reflect the narrowed data-sharing scope.
• Whether any new state privacy laws that may have been enacted or become effective since the date of the October 18, 2022 regulatory applicability memorandum need to be considered (e.g., new state consumer privacy statutes that have been enacted in other states where opted-in vehicles are registered).
• Whether Michigan Identity Theft Protection Act applicability should be reassessed for the narrowed data scope.
IX. File Retention and Administrative Matters
A. File Retention
All electronic work product, correspondence, and draft documents generated or received in connection with Matter No. 1007-00007 are maintained on Calderwood & Harkness's document management system (Tidewater Systems) under the matter number. All documents are indexed and organized by date and document type. The work product inventory set forth in Section VII above provides a complete listing of all material documents in the file.
Physical files, if any, are to be retained in accordance with Calderwood & Harkness's standard file retention policy for dormant matters. Under the current policy, dormant matter files are retained for a minimum of seven (7) years from the date of dormancy designation, subject to any longer retention period required by applicable law or ethical rules. The file should not be destroyed or transferred to off-site storage without prior consultation with the responsible partner (Rachel Bernstein).
B. Recommended Status Check-In
It is recommended that the engagement team conduct a 90-day status check-in with VMS to determine whether the revised commercial term sheet between VMS and Meridian has been finalized and whether the DPA engagement should be reactivated, formally closed, or maintained in dormant status for an additional period. The proposed check-in date is on or about May 4, 2023.