1007-00007 · Vantage Mobility Systems Corp · Memos & Analysis

data-transfer-impact-assessment-memo.docx DOCUMENT Finance & Banking

6 / 12 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

Date: December 20, 2022

To: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP

From: Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP

Re: Cross-Border Data Transfer Impact Assessment — Potential Migration of VMS Data to Cloudvault Infrastructure, Inc. Dublin Facility

Matter No.: 1007-00007

Client: Vantage Mobility Systems Corp.

This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the named recipients and other authorized personnel at Calderwood & Harkness LLP and Vantage Mobility Systems Corp. Any unauthorized review, use, disclosure, or distribution is strictly prohibited.

I. Executive Summary

The purpose of this memorandum is to assess the cross-border data transfer implications arising from Meridian Telematics Solutions, Inc.'s ("Meridian") disclosure that it may migrate processing of Vantage Mobility Systems Corp. ("VMS") vehicle telemetry data from Cloudvault Infrastructure, Inc.'s ("Cloudvault") Columbus, Ohio data center (located at 7400 Crossroads Boulevard, Columbus, OH 43219) to Cloudvault's proposed Dublin, Ireland facility (located at Unit 12, Parkwest Business Campus, Dublin 12, Ireland). This issue was newly raised by Whitfield, Barrow & Crane LLP ("WBC"), counterparty's counsel, in DPA v3.1, which was returned to us on December 16, 2022. The Dublin migration issue was introduced as one of two new issues alongside the four previously unresolved issues that had been the focus of our negotiations since early November.

Specifically, Catherine Ng of WBC flagged in her cover correspondence that Meridian's sub-processor, Cloudvault, is evaluating opening an EU-based data center and that Meridian may elect to route some or all VMS data processing through that facility. Ms. Ng did not provide a specific timeline for when the Dublin facility would become operational, nor did she articulate a business justification for the proposed migration. The new language inserted in DPA v3.1, Section 7.3, would broadly authorize Meridian to process VMS data at "any facility operated by an Approved Sub-Processor," without geographic limitation, which represents a material departure from the location-specific processing commitments contained in DPA v3.0.

Our key conclusion is as follows: while no EU data subjects are currently in scope — all approximately 800,000 opted-in vehicles are registered in North America — hosting VMS data on EU infrastructure could trigger obligations under Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and introduces regulatory complexity that must be addressed in the Data Processing Agreement ("DPA"). Specifically, the processing of VMS data at Cloudvault's Dublin facility could bring the arrangement within the territorial scope of the GDPR under Article 3(1), expose VMS data to the supervisory jurisdiction of the Irish Data Protection Commission ("DPC"), and necessitate the implementation of cross-border data transfer mechanisms under GDPR Chapter V. These obligations exist independent of whether any data subjects are located in the European Union.

We recommend that the DPA include provisions: (i) restricting any international data transfer without VMS's prior written consent; (ii) requiring a documented Transfer Impact Assessment before any migration of VMS data to a non-U.S. facility; and (iii) specifying the legal mechanisms — including, at a minimum, the European Commission's Standard Contractual Clauses ("SCCs") — that must be in place before any cross-border transfer occurs. These recommendations are detailed in Part VII of this memorandum and should be incorporated into VMS's negotiating position for the next round of DPA discussions with WBC.

II. Background

A. The Data-Sharing Partnership and DPA Negotiations

VMS and Meridian executed a non-binding Letter of Intent ("LOI") on August 5, 2022, establishing the framework for a connected-vehicle data-sharing partnership. Under the proposed partnership, Meridian would serve as a data processor, receiving and processing up to fourteen (14) categories of vehicle telemetry and in-cabin sensor data from VMS's proprietary VantageLink platform. The VantageLink platform currently covers approximately 800,000 opted-in vehicles across North America, generating approximately 4.2 terabytes per day of raw telemetry data. Meridian's stated use for this data is to develop and refine its predictive maintenance analytics and insurance telematics scoring products, which Meridian markets to fleet operators, auto insurers, and municipal transportation authorities.

Calderwood & Harkness was engaged by VMS on September 14, 2022, to draft and negotiate the DPA governing Meridian's processing of VMS data. The initial engagement scope, as outlined in our engagement letter to VMS General Counsel Thomas Langford, encompassed the drafting and negotiation of the DPA, including all annexes related to data categories, technical and organizational measures, sub-processor approvals, and breach notification protocols. The engagement scope did not initially contemplate cross-border data transfer issues, as no international processing was discussed at the time of engagement.

The negotiation history of the DPA is as follows:

• DPA v1.0 was circulated by Calderwood & Harkness to WBC on September 28, 2022. This initial draft reflected VMS's preferred positions on all material terms, including data retention, sub-processor management, breach notification, liability allocation, and data localization.

• DPA v2.0 was returned by WBC on October 21, 2022, with sixty-three (63) substantive comments. Upon review, Calderwood & Harkness identified eleven (11) material open issues requiring resolution through negotiation.

• A negotiation call was held on November 15, 2022, attended by Sara Hendricks and Alan Burke for Calderwood & Harkness and Catherine Ng and David Whitfield for WBC. During that call, the parties reached agreement on seven (7) of the eleven material open issues, leaving four (4) issues outstanding: (1) data retention periods and deletion obligations; (2) sub-processor approval mechanisms; (3) breach notification timelines; and (4) the aggregate liability cap applicable to data protection claims.

• DPA v3.0 was circulated by Calderwood & Harkness on December 2, 2022, incorporating the agreed positions from the November 15 call and presenting VMS's revised proposals on the four remaining open issues.

• DPA v3.1 was returned by WBC on December 16, 2022. In addition to revised positions on the four remaining open issues, WBC introduced two entirely new issues: (1) the international data transfer restriction at issue in this memorandum, and (2) a reconfiguration of sub-processor audit rights. Both new issues were accompanied by specific redline language inserted into Sections 7.3 and 8.4 of the DPA, respectively. Ms. Ng's cover email noted that these new issues arose from "recent developments in Meridian's infrastructure planning" and stated that Meridian wished to "preserve operational flexibility" in selecting data processing locations for its sub-processors.

The introduction of new issues at this stage of the negotiation is noteworthy. Prior rounds focused on narrowing the four outstanding disputes, and the parties appeared to be converging toward resolution. The Dublin facility issue, in particular, raises concerns that were not foreseeable from the earlier DPA drafts, in which Cloudvault's Columbus, Ohio facility was explicitly designated as the sole approved processing location.

B. Cloudvault Infrastructure, Inc. as Proposed Sub-Processor

Cloudvault Infrastructure, Inc. is a Nevada corporation headquartered at 200 Mill Street, Suite 100, Reno, NV 89501. Cloudvault provides cloud infrastructure and data processing services to enterprise clients, with a particular focus on the automotive and transportation sectors through its "AutoCloud" platform. Cloudvault currently operates two data centers in the United States:

(i) its headquarters facility in Reno, Nevada; and

(ii) its primary processing facility at 7400 Crossroads Boulevard, Columbus, OH 43219.

Meridian's existing master services agreement with Cloudvault (the "Cloudvault MSA") was executed on March 1, 2021, and governs Meridian's use of Cloudvault's infrastructure services. We have not been provided with a copy of the Cloudvault MSA or its associated data processing terms; however, WBC has represented that the Cloudvault MSA includes data security and confidentiality provisions consistent with industry standards.

Meridian proposed using Cloudvault's AutoCloud platform to host and process VMS data in its initial technical architecture submission dated September 12, 2022. DPA v1.0 and all subsequent drafts have identified Cloudvault as an approved sub-processor, with data processing to occur at the Columbus, OH facility. The designation of the Columbus facility was incorporated into Annex A (Approved Sub-Processors and Processing Locations) of each DPA draft through v3.0.

The proposed Dublin facility at Unit 12, Parkwest Business Campus, Dublin 12, Ireland, is a planned future site. Based on available information — including WBC's representations and publicly available corporate filings — Cloudvault has not yet commenced operations at the Dublin location. Ms. Ng's December 16 email indicated that the Dublin facility is "under evaluation" and that Cloudvault "anticipates operational readiness in mid-2023," though no firm date was provided and no independent confirmation of this timeline has been obtained. It is unclear whether Cloudvault has executed a lease for the Dublin premises, obtained necessary Irish regulatory approvals, or begun installation of physical infrastructure.

C. Nature of Data at Issue

The data at issue in the VMS-Meridian partnership encompasses fourteen (14) categories of vehicle telemetry and in-cabin sensor data, as defined in Annex C (Data Categories) of the DPA:

1. GPS/geolocation data

2. Vehicle speed

3. Acceleration/deceleration data

4. Braking events

5. Tire pressure

6. Engine diagnostic codes (OBD-II)

7. Fuel consumption

8. In-cabin temperature

9. In-cabin humidity

10. Seat occupancy

11. Seatbelt status

12. Ambient noise levels

13. Windshield wiper activation

14. Headlight/taillight status

Of particular significance, VMS has classified two of these categories — GPS/geolocation data (Category 1) and seat occupancy data (Category 10) — as "Sensitive Vehicle Data" under VMS's internal data governance policy (the "VMS Data Governance Framework," Version 4.2, effective January 1, 2022). This classification reflects VMS's determination that, when combined with vehicle identification numbers ("VINs"), these data categories can be linked to identifiable natural persons, specifically vehicle owners and lessees. GPS/geolocation data reveals the precise location and movement patterns of vehicles and, by extension, their drivers. Seat occupancy data, while facially less revealing, can in combination with other data points provide information about the number and positioning of vehicle occupants at specific times and locations.

The total data subject population encompasses approximately 800,000 opted-in vehicles. Of these, approximately 112,000 vehicles (representing 14% of the total population) are registered in the State of California, triggering the applicability of the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"). The remaining vehicles are distributed across other U.S. states and Canadian provinces. Critically, all data subjects are currently located in North America. No EU-based data subjects are included in the opted-in vehicle population, and VMS has not extended its VantageLink platform or Connected Insights program to the European market.

The data volume is substantial: approximately 4.2 terabytes per day of raw telemetry data are generated by the opted-in vehicle fleet. This volume and the granularity of the data — particularly the GPS/geolocation data, which provides continuous location tracking — significantly increase the re-identification risk associated with this dataset, even when VINs or other direct identifiers are removed or pseudonymized.

D. Current Data Transfer Architecture

Under the existing DPA draft (v3.0, carried forward in v3.1 except as modified by WBC's new redlines), the data transfer architecture is structured as follows:

(i) Raw telemetry data is transmitted from VMS's VantageLink platform to Meridian's data operations center, located at 8900 Research Park Drive, Building C, Austin, TX 78759, via encrypted API connections.

(ii) Meridian's Austin facility performs initial data ingestion, quality assurance, and preprocessing operations.

(iii) Preprocessed data is then transferred to and hosted on Cloudvault's AutoCloud platform at the Columbus, OH data center (7400 Crossroads Boulevard, Columbus, OH 43219) for further processing, analytics, and storage.

All processing under this architecture occurs within the United States. No cross-border data transfer mechanism has been included in any DPA draft to date — from v1.0 through v3.0 — because no international transfer was contemplated. The DPA's technical architecture annex (Annex D) specifies the Columbus, OH facility as the sole Cloudvault processing location, and the security requirements in Annex B (Technical and Organizational Measures) are calibrated to U.S.-based processing.

The potential migration of VMS data processing to Dublin would represent a fundamental alteration of this architecture, introducing a cross-border data flow that implicates an entirely different regulatory regime and necessitates transfer mechanisms that are not currently addressed in the DPA.

III. Legal Analysis: GDPR Applicability

A. Territorial Scope of the GDPR (Article 3)

The threshold question in assessing the impact of the proposed Dublin migration is whether the GDPR would apply to the processing of VMS data at Cloudvault's Dublin facility. The GDPR's territorial scope is defined by Article 3, which establishes two independent bases for applicability.

Article 3(1) — Establishment-Based Applicability. GDPR Article 3(1) provides that the Regulation applies to "the processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether the processing takes place in the Union or not." The Court of Justice of the European Union ("CJEU") has interpreted the concept of "establishment" broadly. In Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság (Case C-230/14, October 1, 2015), the CJEU held that the concept of "establishment" extends to "any real and effective activity — even a minimal one — exercised through stable arrangements," and that the legal form of such arrangements is not determinative. The European Data Protection Board ("EDPB") has further elaborated on this standard in its Guidelines 3/2018 on the territorial scope of the GDPR, adopted on November 12, 2019.

If Cloudvault operates a data center in Dublin and processes VMS data at that facility, this would constitute processing "in the context of the activities of an establishment" of a processor (Cloudvault) in the European Union. Cloudvault's Dublin facility, once operational, would likely qualify as an "establishment" under the GDPR's broad definition, as it would involve the exercise of real and effective data processing activities through a stable physical arrangement in Ireland. The fact that the processing is performed on behalf of a non-EU controller (VMS) and concerns non-EU data subjects does not, under Article 3(1), preclude GDPR applicability. Article 3(1) focuses on the location of the establishment performing the processing, not on the nationality or location of the data subjects.

We acknowledge that there is some interpretive uncertainty regarding whether the processing of exclusively non-EU personal data at an EU establishment triggers the full scope of GDPR obligations. The EDPB's guidelines do not specifically address this scenario, and no CJEU case law directly resolves this question. However, the text of Article 3(1) contains no limitation based on the origin or subject of the data — it applies to "the processing of personal data in the context of the activities of an establishment" in the EU without qualification. Given the CJEU's tendency to interpret GDPR's territorial provisions expansively, and given the regulatory posture of the Irish DPC, we believe that the risk of GDPR applicability in this scenario is meaningful and should be treated as a material consideration in the DPA negotiations.

Article 3(2) — Targeting-Based Applicability. GDPR Article 3(2) applies the Regulation to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities relate to: (a) the offering of goods or services, irrespective of whether payment is required, to such data subjects in the EU; or (b) the monitoring of their behavior as far as their behavior takes place within the EU.

Article 3(2) does not directly apply to the VMS-Meridian arrangement as currently structured. VMS is not offering goods or services to persons in the EU through the VantageLink platform or the Connected Insights program — both are currently limited to the North American market. Similarly, VMS is not monitoring the behavior of EU-based individuals; all telemetry data originates from vehicles operated in North America.

However, this analysis is not static. If any VMS vehicles were to be operated by EU residents who are temporarily present in North America (for example, EU nationals on extended work assignments who lease or purchase VMS-equipped vehicles), the data collected from those vehicles could constitute the processing of personal data of data subjects who are "in the EU" for purposes of GDPR Article 3(2)(b), depending on the interpretation of the phrase "data subjects who are in the Union." More significantly, if VMS were to extend its Connected Insights program to EU markets — a possibility that VMS has discussed internally, though no formal decision has been made — Article 3(2)(a) would be directly engaged, and the Dublin processing location would become a significant regulatory asset and liability simultaneously.

Key Risk Assessment. GDPR applicability is inherently fact-specific and evolving. The CJEU's broad interpretation of "establishment" and the EDPB's expansive approach to territorial scope suggest that the mere use of EU-based infrastructure for processing, even of non-EU data, could attract scrutiny from EU data protection authorities. We assess the risk that the GDPR would apply to the processing of VMS data at Cloudvault's Dublin facility as medium-high, reflecting the uncertainty in the legal analysis tempered by the absence of EU data subjects and the absence of any EU-directed commercial activity by VMS.

B. Personal Data Classification Under GDPR

If the GDPR is determined to apply, the next question is whether the VMS data constitutes "personal data" within the meaning of GDPR Article 4(1). Under that provision, "personal data" means "any information relating to an identified or identifiable natural person ('data subject')," and an "identifiable natural person" is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

VIN-linked GPS/geolocation data and seat occupancy data — VMS's two "Sensitive Vehicle Data" categories — are almost certainly "personal data" under the GDPR to the extent they can be used, directly or indirectly, to identify vehicle owners, lessees, or habitual drivers. VINs are unique identifiers linked to vehicle registration records, which in turn are linked to the names and addresses of registered owners. GPS/geolocation data reveals the precise location and movement patterns of vehicles and, by extension, their associated individuals. The Article 29 Working Party (the EDPB's predecessor) addressed location data specifically in its Opinion 13/2011 on Geolocation services on smart mobile devices, concluding that location data associated with an identifiable individual constitutes personal data. Although that opinion addressed mobile devices rather than vehicles, the underlying principle is directly applicable.

Even the data categories that VMS has not classified as "Sensitive Vehicle Data" — such as vehicle speed, braking events, fuel consumption, and engine diagnostic codes — could constitute personal data under the GDPR if they are linked to VINs or other identifiers traceable to natural persons. The GDPR's definition of "personal data" is deliberately broad, and the CJEU has consistently reinforced this breadth. In Breyer v. Bundesrepublik Deutschland (Case C-582/14, October 19, 2016), the CJEU held that even dynamic IP addresses can constitute personal data where the controller has the legal means to obtain additional information enabling identification. By analogy, vehicle telemetry data linked to VINs — where VINs are traceable to registered owners through publicly accessible or commercially available databases — falls within the GDPR's definition of personal data.

The volume of data at issue (approximately 4.2 TB/day from 800,000 vehicles) and its granularity further increase the re-identification risk. Even if VINs were stripped or pseudonymized prior to transfer, the combination of GPS/geolocation data, vehicle speed, braking patterns, and other telemetry data points could enable re-identification of individual vehicles and, by extension, their associated owners or drivers through triangulation and pattern analysis.

C. Impact of No Current EU Data Subjects

We acknowledge that no data subjects are currently located in the European Union. All 800,000 opted-in vehicles are registered in North America, and VMS's VantageLink platform and Connected Insights program are not offered in the EU market. This is an important factual consideration that mitigates the probability that certain GDPR provisions — particularly those relating to data subject rights under Articles 12 through 23 — would be practically enforced with respect to VMS data.

However, GDPR obligations can be triggered by the location of processing under Article 3(1), not solely by the location of data subjects. As discussed in Section III.A above, the processing of personal data at a processor's EU establishment brings that processing within the GDPR's territorial scope regardless of where the data subjects are located. The absence of EU data subjects reduces the practical risk of data subject complaints or access requests, but it does not eliminate the regulatory risk. The Irish DPC could, on its own initiative, investigate the processing activities occurring at the Dublin facility, request information regarding the categories of data being processed, and assess compliance with GDPR requirements — including requirements related to lawful basis, data minimization, storage limitation, integrity and confidentiality, and accountability.

Additionally, migration of VMS data to Dublin introduces the data to a jurisdiction with its own independent regulatory authority. Even if the GDPR were determined not to apply to this specific processing arrangement (a position we do not recommend relying upon), the Irish Data Protection Commission exercises supervisory authority over data processing activities within its territory and could assert jurisdiction over the processing of VMS data at the Dublin facility. The DPC has been among the most active data protection authorities in Europe, with a demonstrated willingness to investigate and sanction data processing activities by technology companies with establishments in Ireland.

Finally, the current absence of EU data subjects is not a permanent condition. If VMS expands its Connected Insights program to the EU market, or if any data subjects relocate to the EU, the GDPR analysis would shift further and more decisively toward full applicability under both Article 3(1) and Article 3(2). Any DPA provisions addressing this issue should be drafted to account for this possibility.

IV. Legal Analysis: Cross-Border Data Transfer Mechanisms

A. GDPR Chapter V — Transfers to Third Countries

If VMS data is processed at Cloudvault's Dublin facility, the cross-border data transfer provisions of GDPR Chapter V (Articles 44 through 50) become relevant in two respects. First, if VMS data is transmitted from the United States to the Dublin facility for processing, this constitutes an importation of data into the EU. Second, and more critically, if processed data or analytics outputs are transferred from the Dublin facility back to Meridian's Austin, TX operations center or to VMS in Auburn Hills, Michigan, this constitutes a transfer of personal data from the EU to a "third country" — the United States being a third country from the EU perspective.

Under Article 44 of the GDPR, any transfer of personal data that is undergoing processing or is intended for processing after transfer to a third country may take place only if the conditions laid down in Chapter V are complied with by the controller and processor. These conditions are cumulative with the other provisions of the GDPR — compliance with Chapter V does not substitute for compliance with the GDPR's substantive requirements.

The EU-U.S. Data Privacy Framework ("DPF") — the successor to the invalidated EU-U.S. Privacy Shield — was announced in principle in March 2022 and advanced by Executive Order 14086, signed by President Biden on October 7, 2022. Executive Order 14086 introduced new safeguards limiting U.S. Signals intelligence activities and establishing a redress mechanism for EU individuals through a Data Protection Review Court. However, as of the date of this memorandum, the European Commission has not yet adopted a final adequacy decision with respect to the DPF. The Commission issued a draft adequacy decision on December 13, 2022, and the decision is expected to be finalized in early-to-mid 2023 following review by the EDPB and the European Parliament. The DPF may ultimately provide an adequacy-based mechanism for EU-U.S. data transfers, but its durability is uncertain given the history of successful legal challenges to prior adequacy frameworks. The CJEU's invalidation of the EU-U.S. Privacy Shield in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II," July 16, 2020) underscores the fragility of adequacy decisions predicated on U.S. surveillance law, and privacy advocacy organizations have already signaled their intent to challenge the DPF before the CJEU.

In the absence of a valid adequacy decision, transfers of personal data to the United States must rely on one of the "appropriate safeguards" enumerated in Article 46 of the GDPR. The most commonly used safeguard is the Standard Contractual Clauses approved by the European Commission.

B. Standard Contractual Clauses (SCCs)

The European Commission adopted new Standard Contractual Clauses on June 4, 2021, pursuant to Commission Implementing Decision (EU) 2021/914. The new SCCs replace the prior sets of clauses adopted under Directive 95/46/EC and reflect the requirements established by the CJEU in Schrems II. The new SCCs are structured in a modular format, with four modules corresponding to different data transfer scenarios:

• Module 1: Controller-to-Controller transfers

• Module 2: Controller-to-Processor transfers

• Module 3: Processor-to-Sub-Processor transfers

• Module 4: Processor-to-Controller transfers

For the VMS-Meridian-Cloudvault arrangement, the most directly relevant module is Module 3 (Processor-to-Sub-Processor). This module would apply if Meridian, acting as Processor on behalf of VMS, transfers VMS data to Cloudvault, acting as Sub-Processor, at the Dublin facility, and the data is subsequently accessed from or transferred back to U.S.-based operations. Under this module, the data exporter is the processor (Meridian) and the data importer is the sub-processor (Cloudvault's Dublin facility).

The SCCs under Module 3 would need to be incorporated into or appended to the Meridian-Cloudvault sub-processing agreement. The SCCs impose specific obligations on both the data exporter and the data importer, including obligations related to purpose limitation, data security, onward transfers, data subject rights, and cooperation with supervisory authorities. Importantly, the SCCs also include provisions granting third-party beneficiary rights to data subjects, which in this context would extend to the identifiable vehicle owners and lessees whose data is being processed.

VMS, as the Controller, would need to be a party to or a named third-party beneficiary of the SCCs to ensure adequate protections and enforcement rights. Although Module 3 is structured as a Processor-to-Sub-Processor arrangement, Clause 8.8 of Module 3 requires the sub-processor to provide the same level of protection as the processor provides under its agreement with the controller, and the controller retains ultimate accountability for GDPR compliance. We recommend that the DPA include a provision requiring Meridian to ensure that any SCCs entered into with Cloudvault explicitly identify VMS as a third-party beneficiary with direct enforcement rights.

Additionally, Module 2 (Controller-to-Processor) may be relevant if VMS data flows directly from VMS's U.S.-based VantageLink platform to the Dublin facility, bypassing Meridian's Austin data operations center. While this data flow is not currently contemplated, it could arise if the technical architecture evolves, and the DPA should account for this possibility.

C. Supplementary Measures (Post-Schrems II Requirements)

The CJEU's Schrems II decision established that the use of SCCs alone does not automatically satisfy the GDPR's requirements for cross-border data transfers. The Court held that data exporters must assess, on a case-by-case basis, whether the law of the third country of destination ensures an "essentially equivalent" level of protection to that guaranteed within the EU. If the assessment reveals that the third country's legal framework undermines the protections provided by the SCCs, the data exporter must implement "supplementary measures" to fill the gap, or refrain from transferring the data.

The EDPB issued its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, adopted in final form on June 18, 2021. These recommendations provide a structured methodology for conducting Transfer Impact Assessments ("TIAs") and identifying appropriate supplementary measures.

A TIA for the proposed Dublin-to-U.S. transfer of VMS data would need to evaluate, at minimum, the following elements of the U.S. legal framework:

(i) FISA Section 702 (50 U.S.C. § 1881a): Authorizes the U.S. government to target non-U.S. persons located outside the United States for the acquisition of foreign intelligence information, including communications data held by U.S.-based electronic communications service providers. Because Cloudvault is a U.S. company, it could potentially be subject to FISA Section 702 orders, though the applicability of Section 702 to cloud infrastructure providers (as opposed to electronic communications service providers) is subject to ongoing legal debate.

(ii) Executive Order 12333: Authorizes the collection of signals intelligence by U.S. Intelligence agencies, including the collection of data in transit outside the United States. Data transmitted between the Dublin facility and U.S.-based operations could potentially be intercepted under EO 12333 authorities.

(iii) Executive Order 14086 (October 7, 2022): Introduces new safeguards for signals intelligence activities, including principles of necessity and proportionality, and establishes a two-tier redress mechanism (Civil Liberties Protection Officer review followed by the Data Protection Review Court). While EO 14086 represents a significant improvement over the prior legal framework, it has not yet been tested in practice, and its effectiveness as a safeguard remains to be determined.

Supplementary technical measures that could be implemented to mitigate the risks identified in a TIA include:

• Encryption of VMS data in transit and at rest, with encryption keys held exclusively by the data exporter (VMS or Meridian) and not accessible to Cloudvault or any U.S. government authority

• Pseudonymization of VMS data prior to transfer, such that the data processed in Dublin cannot be attributed to identifiable individuals without the use of additional information held separately by VMS

• Access controls limiting U.S.-based Cloudvault personnel's access to VMS data stored at the Dublin facility

• Technical logs and monitoring to detect and record any access to VMS data at the Dublin facility

Supplementary organizational measures would include data access policies restricting personnel access on a need-to-know basis, staff training on data protection obligations, transparency reporting regarding government access requests, and contractual commitments by Cloudvault not to provide VMS data to any government authority without prior notification to VMS (to the extent not prohibited by law).

D. Data Localization Considerations

Even absent strict GDPR applicability, moving VMS data to Dublin creates jurisdictional exposure that warrants careful consideration. The Irish Data Protection Commission exercises supervisory authority over data processing activities occurring within Ireland, and the mere presence of data processing operations at a Dublin facility subjects those operations to potential DPC oversight — including requests for information, inspections, and enforcement actions under the Irish Data Protection Act 2018 (which gives domestic effect to the GDPR).

The Irish DPC has been notably active in enforcing the GDPR against technology companies with establishments in Ireland. As the lead supervisory authority for many multinational technology companies under the GDPR's one-stop-shop mechanism (Article 56), the DPC has initiated and concluded enforcement actions resulting in significant fines, including record-setting penalties imposed on major U.S. technology companies for violations related to data transfers, transparency, and data subject rights. While VMS's situation is distinguishable — VMS is not a technology company with an Irish establishment — the processing of VMS data by Cloudvault at a Dublin facility could draw the arrangement into the DPC's sphere of attention, particularly if the DPC conducts sector-specific audits of data centers operating in its jurisdiction.

Data localization commitments in the DPA — restricting all VMS data processing to specified U.S. facilities — would eliminate this jurisdictional exposure entirely. Such commitments are a straightforward and effective risk mitigation strategy that avoids the complexity, cost, and uncertainty associated with implementing cross-border transfer mechanisms and managing dual-jurisdiction compliance.

V. Legal Analysis: Interaction with U.S. Privacy Frameworks

A. Michigan Identity Theft Protection Act (MCL 445.61 et seq.)

The Michigan Identity Theft Protection Act ("ITPA") requires persons and entities that own or license data containing "personal information" of Michigan residents to implement and maintain reasonable security measures to protect that information against unauthorized access, use, or disclosure. The ITPA also imposes breach notification obligations, requiring notice to affected individuals and, in certain cases, to the Michigan Attorney General.

VMS is headquartered in Auburn Hills, Michigan, and a substantial portion of the 800,000 opted-in vehicles are likely registered in Michigan. VIN-linked vehicle telemetry data — particularly GPS/geolocation data — may constitute "personal information" under the ITPA to the extent it can be combined with an individual's name or other identifying information to identify a specific Michigan resident.

While the cross-border transfer of VMS data to Dublin does not directly trigger additional ITPA obligations, it could affect VMS's compliance posture with respect to the ITPA's reasonable security requirements. Specifically, transferring data to a facility in another jurisdiction — subject to a different legal regime, different governmental access standards, and potentially different security practices — could be viewed as inconsistent with the "reasonable security measures" standard if the transfer is not accompanied by adequate contractual, technical, and organizational safeguards. In the event of a data breach at the Dublin facility, VMS would need to ensure that its breach notification obligations under Michigan law are fully satisfied, which could be complicated by the involvement of a foreign jurisdiction and the potential for conflicting notification requirements under Irish and EU law.

B. CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.)

Approximately 112,000 of the 800,000 opted-in vehicles are registered in the State of California, representing 14% of the data subject population. The CCPA, as amended by the CPRA (effective January 1, 2023), applies to businesses that collect personal information of California consumers and meet specified revenue or data processing thresholds. VMS meets these thresholds and is subject to CCPA/CPRA obligations with respect to the personal information of California-registered vehicle owners and lessees.

The CCPA/CPRA does not specifically restrict international transfers of personal information. Unlike the GDPR, which imposes detailed requirements on cross-border data transfers, the CCPA/CPRA framework is primarily concerned with the purposes for which personal information is used and the rights of consumers to access, delete, correct, and opt out of the sale or sharing of their personal information. However, the CCPA/CPRA does impose substantive requirements on contracts with service providers and contractors. Under CCPA/CPRA regulations, contracts with service providers must:

(i) identify the specific business purpose for which the personal information is provided;

(ii) prohibit the service provider from retaining, using, or disclosing the personal information for any purpose other than the specified business purpose or as otherwise permitted by the CCPA/CPRA;

(iii) prohibit the service provider from selling or sharing the personal information; and

(iv) require the service provider to notify the business if it can no longer meet its obligations under the CCPA/CPRA.

Any migration of VMS data to Dublin must be covered by contractual provisions satisfying these requirements. Additionally, VMS must ensure that consumer rights under the CCPA/CPRA — including the right to access, the right to deletion, and the right to opt out of the sale or sharing of personal information — remain fully enforceable despite the international processing location. This requires clear contractual mechanisms for processing consumer requests and ensuring that data held at the Dublin facility can be promptly identified, retrieved, modified, or deleted in response to verified consumer requests.

The CPRA's enhanced contractor obligations, which became operative on January 1, 2023, introduce additional requirements for monitoring and auditing service providers and contractors to ensure compliance with contractual data protection obligations. These obligations are relevant to the sub-processor chain extending from VMS through Meridian to Cloudvault, and would need to be addressed in any amendment to the DPA authorizing international processing.

C. DPPA (18 U.S.C. § 2721 et seq.)

The Driver's Privacy Protection Act ("DPPA") restricts the disclosure and use of personal information obtained from state motor vehicle records. The DPPA applies to motor vehicle departments and to any person who knowingly obtains or discloses personal information from a motor vehicle record for an unauthorized purpose.

To the extent that VMS data includes VIN-linked information traceable to state department of motor vehicle records, the DPPA's restrictions on disclosure apply regardless of where processing occurs. The DPPA does not contain an express provision addressing international transfers of protected information, but the statute's broad prohibition on unauthorized disclosure applies to any person who obtains or discloses the information, without geographic limitation. An international transfer of VIN-linked data to a Dublin facility does not create a DPPA exemption; rather, it complicates enforcement of the DPPA's protections, as data held in a foreign jurisdiction may be more difficult to recover or control in the event of unauthorized access or disclosure.

The DPA should include provisions ensuring that VMS data subject to DPPA restrictions is clearly identified and that Meridian and Cloudvault are contractually prohibited from using or disclosing such data for any purpose other than the authorized business purposes specified in the DPA.

VI. Risk Assessment Summary

A. Risk Matrix

Based on the legal analysis set forth in Parts III through V of this memorandum, we have identified the following principal risks associated with the potential migration of VMS data processing to Cloudvault's Dublin facility:

Risk 1 — GDPR Applicability (Medium-High). As discussed in Part III.A, the processing of VMS data at a Cloudvault establishment in Dublin could bring the arrangement within the territorial scope of the GDPR under Article 3(1). The consequence of GDPR applicability would be substantial: VMS, Meridian, and Cloudvault would be subject to the full range of GDPR compliance obligations, including the requirement to establish a lawful basis for processing under Article 6, the obligation to honor data subject rights under Articles 12 through 23, potential obligations to appoint a Data Protection Officer under Article 37, the requirement to notify the supervisory authority of personal data breaches within 72 hours under Article 33, and exposure to administrative fines of up to 4% of annual worldwide turnover or €20 million, whichever is greater, under Article 83. The likelihood of GDPR applicability is assessed as medium-high based on the broad interpretation of "establishment" under Article 3(1) and the absence of legal authority definitively excluding this scenario.

Risk 2 — Irish DPC Supervision (Medium). Even if GDPR applicability is uncertain, the presence of data processing operations at the Dublin facility subjects those operations to the supervisory authority of the Irish DPC. The DPC has demonstrated a willingness to exercise its enforcement powers actively, as evidenced by its high-profile enforcement actions against major technology companies in recent years. The likelihood of DPC scrutiny of VMS data processing specifically is moderate — the DPC's enforcement priorities tend to focus on larger-scale consumer data processing by technology companies — but the risk cannot be discounted, particularly if the DPC conducts sector-wide audits of data center operations in its jurisdiction.

Risk 3 — Transfer Mechanism Fragility (Medium). The SCCs adopted under Commission Implementing Decision (EU) 2021/914 are the primary available mechanism for legitimizing cross-border data transfers from the EU to the United States in the absence of a valid adequacy decision. However, the post-Schrems II landscape remains characterized by legal and regulatory uncertainty. The EU-U.S. Data Privacy Framework, if adopted, may provide an adequacy-based alternative, but its longevity is uncertain in light of anticipated legal challenges. Reliance on SCCs alone requires the completion of a Transfer Impact Assessment and the implementation of supplementary measures, adding complexity and ongoing compliance obligations.

Risk 4 — Operational Complexity (Medium). Managing compliance across two jurisdictions — the United States and the European Union — significantly increases VMS's and Meridian's operational burden. Dual-jurisdiction compliance requires the implementation of separate and potentially conflicting data protection requirements, the engagement of EU-qualified legal counsel, the potential appointment of a Data Protection Officer, the development of breach notification protocols satisfying both U.S. and EU requirements, and the ongoing monitoring of regulatory developments in both jurisdictions. These costs and complexities are difficult to quantify but are material.

Risk 5 — Conflict with VMS Data Governance Policy (Low-Medium). VMS's internal Data Governance Framework (Version 4.2) classifies GPS/geolocation and seat occupancy data as "Sensitive Vehicle Data" and imposes heightened protection requirements on these data categories. The international transfer of Sensitive Vehicle Data to a facility in Ireland was not contemplated in the current Data Governance Framework, and such a transfer may be inconsistent with VMS's existing data governance commitments and the reasonable expectations of VMS's data subjects. While this is primarily an internal governance issue, it could have reputational and contractual implications if VMS's privacy notices or terms of service contain representations regarding the geographic scope of data processing.

Risk 6 — Sub-Processor Chain Complexity (Medium). Adding an international facility to Cloudvault's processing infrastructure extends the sub-processor chain across jurisdictions, introducing complexities in several areas: audit rights (conducting audits of a facility in Ireland is more logistically challenging and costly than auditing a domestic facility); flow-down obligations (ensuring that GDPR-compliant data protection terms flow through from VMS to Meridian to Cloudvault to the Dublin facility); and incident response (coordinating breach response across time zones and regulatory regimes, with potentially conflicting notification timelines and requirements).

B. Overall Assessment

The potential Dublin migration introduces material regulatory and operational risks that are disproportionate to any identified benefit to VMS. Meridian has not articulated a compelling business justification for routing VMS data through Dublin rather than continuing to process exclusively at the Columbus, OH facility. In her December 16, 2022 correspondence, Catherine Ng characterized the Dublin migration as a matter of "operational flexibility" for Meridian and Cloudvault, but did not identify any specific performance, cost, or reliability benefit that the Dublin facility would provide over the Columbus facility for the processing of VMS data.

The current DPA draft (v3.0, as modified by v3.1) does not address international data transfers and would require substantial amendment to accommodate this scenario. The cost of implementing adequate contractual, technical, and organizational safeguards for an international transfer — including SCCs, supplementary measures, Transfer Impact Assessments, enhanced audit rights, and dual-jurisdiction breach notification protocols — would be significant and ongoing.

We recommend that VMS take the position that international transfer of VMS data is not authorized and should be contractually prohibited absent VMS's prior written consent, subject to the conditions described in Part VII below.

VII. Recommendations for DPA Provisions

Based on the foregoing analysis, we recommend that the following provisions be incorporated into VMS's revised DPA proposal. These provisions are designed to protect VMS's interests while preserving a reasonable path for future international processing if VMS determines, upon informed assessment, that such processing is appropriate.

A. International Data Transfer Restriction

We recommend inserting a provision in the DPA — proposed Section 7.3 (replacing WBC's redlined language) — that expressly prohibits Meridian (and any sub-processor, including Cloudvault) from transferring, accessing, or processing VMS data outside the United States without VMS's prior written consent. The provision should make clear that this prohibition encompasses all forms of data movement, including remote access from outside the United States to data stored at U.S. facilities.

VMS's consent, if given, should be conditioned on satisfaction of all of the following prerequisites:

(i) Completion of a documented Transfer Impact Assessment in accordance with Section [7.4] of the DPA (see Recommendation B below);

(ii) Execution of applicable Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or equivalent legally binding transfer mechanism approved by VMS;

(iii) Implementation of supplementary technical and organizational measures approved by VMS in writing, consistent with EDPB Recommendations 01/2020; and

(iv) Written confirmation by Meridian that the receiving facility meets all security standards specified in Annex B (Technical and Organizational Measures) of the DPA, as verified by an independent third-party audit conducted within the preceding twelve (12) months.

This consent requirement should be non-delegable — VMS should retain sole discretion to grant or withhold consent, and Meridian should not be permitted to argue that consent has been unreasonably withheld.

B. Transfer Impact Assessment Requirement

We recommend the inclusion of a mandatory Transfer Impact Assessment ("TIA") protocol, to be incorporated as proposed Section 7.4 of the DPA. The TIA should be completed by Meridian at its sole expense and submitted to VMS for review and written approval before any proposed international transfer of VMS data. The TIA should not be a one-time exercise; it should be refreshed at least annually, and immediately upon any material change in the legal framework of the destination country.

The TIA should address, at minimum, the following elements:

(i) The legal framework of the destination country with respect to government access to personal data, including surveillance laws, national security authorities, and law enforcement powers — with specific reference to the destination country's intelligence agencies and their legal authorities;

(ii) The specific categories of VMS data proposed to be transferred, including an assessment of the sensitivity and re-identification risk of each category;

(iii) The transfer mechanism to be relied upon (SCCs, adequacy decision, or other legally binding instrument), including an assessment of its legal validity and enforceability in the destination country;

(iv) The supplementary technical and organizational measures proposed to be implemented, with a detailed description of each measure and an assessment of its effectiveness in mitigating the risks identified in the TIA;

(v) An assessment of the likelihood that the destination country's laws would prevent Meridian, Cloudvault, or any other sub-processor from complying with the data protection obligations set forth in the DPA; and

(vi) A recommendation regarding whether the proposed transfer should proceed, including a reasoned analysis of the residual risks and a proposed risk mitigation plan.

VMS should retain the right to reject any proposed transfer if, in its sole discretion, the TIA reveals risks that are not adequately mitigated by the proposed safeguards.

C. Data Localization Commitment

We recommend the inclusion of a data localization clause — proposed Section 7.5 — specifying that all VMS data shall be stored and processed exclusively at the following approved locations:

(i) Cloudvault's Columbus, OH data center at 7400 Crossroads Boulevard, Columbus, OH 43219; and

(ii) Meridian's Austin, TX data operations center at 8900 Research Park Drive, Building C, Austin, TX 78759.

No VMS data shall be transferred to, stored at, accessed from, or processed at any other location without VMS's prior written consent, obtained in accordance with the procedures set forth in Sections 7.3 and 7.4 of the DPA.

Any amendment to the approved processing locations should require a minimum of sixty (60) days' prior written notice from Meridian to VMS, accompanied by a completed TIA and all supporting documentation. VMS should have the right to approve or reject the proposed new location in its sole discretion, and any approval should not take effect until all prerequisites specified in Section 7.3 have been satisfied.

D. Sub-Processor Flow-Down Obligations for International Transfers

The DPA should require Meridian to impose equivalent transfer restrictions on Cloudvault via the Meridian-Cloudvault sub-processing agreement. Specifically, the DPA should require that the Meridian-Cloudvault sub-processing agreement include provisions:

(i) Prohibiting Cloudvault from transferring, accessing, or processing VMS data outside the United States without VMS's prior written consent;

(ii) Requiring Cloudvault to cooperate with and contribute to any Transfer Impact Assessment conducted by Meridian;

(iii) Obligating Cloudvault to implement all supplementary technical and organizational measures specified by VMS; and

(iv) Providing that VMS is a named third-party beneficiary of any SCCs or other transfer mechanisms entered into by Cloudvault, with direct enforcement rights — including the right to audit Cloudvault's compliance with the SCCs and to suspend or terminate the data transfer in the event of non-compliance.

This recommendation connects to the broader open issue of sub-processor approval rights. VMS's current proposal (DPA v3.0, Section 8.1) requires VMS's prior written consent before Meridian may engage or change any sub-processor. Meridian's counter-proposal (DPA v3.1, Section 8.1) would adopt a general authorization model with a 30-day objection window. We recommend that the international transfer provisions reinforce the prior written consent model, at least with respect to any sub-processor that would process VMS data at a non-U.S. facility. The heightened regulatory risk associated with international processing justifies a more restrictive consent framework than may be appropriate for domestic sub-processor changes.

E. Enhanced Audit Rights for International Processing

If any international transfer of VMS data is ultimately approved, we recommend that VMS's audit rights be expanded for the international processing location. The current DPA audit provisions are the subject of an open negotiation:

• VMS's position (DPA v3.0, Section 8.4): Unlimited on-site audits with ten (10) business days' prior written notice, at VMS's expense.

• Meridian's position (DPA v3.1, Section 8.4): Annual audits with thirty (30) calendar days' prior written notice, subject to a $25,000 cost-sharing cap per audit.

For any international processing facility, we recommend the following audit rights as a minimum:

(i) Semi-annual audit rights, with fifteen (15) business days' prior written notice;

(ii) No cost-sharing cap or other financial limitation on audit frequency or scope;

(iii) The right for VMS to designate a qualified third-party auditor — such as Pinehurst Cybersecurity Advisors LLC or an equivalent firm — to conduct the audit on VMS's behalf, at VMS's expense; and

(iv) The right to conduct additional ad hoc audits on reasonable notice in the event of a suspected data breach, security incident, or regulatory investigation involving the international processing facility.

As a cross-reference, Pinehurst Cybersecurity Advisors LLC delivered its preliminary security assessment findings to VMS on November 22, 2022 (the engagement and findings are outside the scope of Calderwood & Harkness's engagement), which assessed Meridian's current U.S.-based processing environment. Any Dublin migration would necessitate a separate and comprehensive security assessment of the Dublin facility, including evaluation of physical security, network architecture, access controls, encryption standards, and incident response capabilities.

F. Breach Notification in International Context

The migration of VMS data processing to Dublin introduces a potential conflict between the breach notification timelines currently being negotiated in the DPA. Under GDPR Article 33, a data controller must notify the competent supervisory authority (here, the Irish DPC) of a personal data breach "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This 72-hour standard aligns with Meridian's proposed breach notification timeline in DPA v3.1 (Section 9.2), which requires notification to VMS within 72 hours of becoming aware of a data breach. However, VMS's preferred position (DPA v3.0, Section 9.2) calls for notification to VMS within 24 hours of discovery.

We recommend that the DPA adopt a dual-notification approach that addresses both the contractual notification to VMS and the regulatory notification to the supervisory authority:

(i) Notification to VMS: Meridian shall notify VMS of any actual or suspected breach of VMS data within twenty-four (24) hours of becoming aware of the breach, consistent with VMS's preferred position. This notification should include, at minimum, the nature of the breach, the categories and approximate number of data subjects affected, the categories and approximate number of data records affected, a description of the likely consequences, and the measures taken or proposed to address the breach.

(ii) Notification to Supervisory Authority: To the extent required by applicable law (including GDPR Article 33), Meridian or Cloudvault shall notify the competent supervisory authority within the timeframe specified by such law — currently 72 hours under the GDPR — provided that VMS shall have the right to review and approve the content of any notification to a supervisory authority before it is submitted.

(iii) Coordination: The DPA should include a coordination mechanism requiring Meridian to consult with VMS on the content and timing of any supervisory authority notification, to the extent legally permissible, and to provide VMS with copies of all correspondence with the supervisory authority.

This dual-notification approach preserves VMS's interest in early notification while acknowledging the mandatory nature of supervisory authority notification timelines under applicable law.

G. Governing Law and Jurisdiction

The DPA is currently governed by the laws of the State of Michigan, as specified in Section 14.1 of all DPA drafts through v3.1. We recommend retaining Michigan law as the governing law for the DPA, while including a provision that acknowledges the potential applicability of mandatory provisions of the GDPR and Irish data protection law (the Data Protection Act 2018) to the extent that VMS data is processed at a facility located in Ireland.

Specifically, we recommend the following provision:

"This Agreement shall be governed by and construed in accordance with the laws of the State of Michigan, without regard to its conflict of laws principles. The parties acknowledge that, to the extent Personal Data is processed at a facility located in the European Union, mandatory provisions of Regulation (EU) 2016/679 (General Data Protection Regulation) and the data protection laws of the applicable EU Member State may apply to such processing. In the event of any conflict between the provisions of this Agreement and mandatory prov

MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
Date: December 20, 2022
To: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP
From: Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
Re: Cross-Border Data Transfer Impact Assessment — Potential Migration of VMS Data to Cloudvault Infrastructure, Inc. Dublin Facility
Matter No.: 1007-00007
Client: Vantage Mobility Systems Corp.
This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of the named recipients and other authorized personnel at Calderwood & Harkness LLP and Vantage Mobility Systems Corp. Any unauthorized review, use, disclosure, or distribution is strictly prohibited.
I. Executive Summary
The purpose of this memorandum is to assess the cross-border data transfer implications arising from Meridian Telematics Solutions, Inc.'s ("Meridian") disclosure that it may migrate processing of Vantage Mobility Systems Corp. ("VMS") vehicle telemetry data from Cloudvault Infrastructure, Inc.'s ("Cloudvault") Columbus, Ohio data center (located at 7400 Crossroads Boulevard, Columbus, OH 43219) to Cloudvault's proposed Dublin, Ireland facility (located at Unit 12, Parkwest Business Campus, Dublin 12, Ireland). This issue was newly raised by Whitfield, Barrow & Crane LLP ("WBC"), counterparty's counsel, in DPA v3.1, which was returned to us on December 16, 2022. The Dublin migration issue was introduced as one of two new issues alongside the four previously unresolved issues that had been the focus of our negotiations since early November.
Specifically, Catherine Ng of WBC flagged in her cover correspondence that Meridian's sub-processor, Cloudvault, is evaluating opening an EU-based data center and that Meridian may elect to route some or all VMS data processing through that facility. Ms. Ng did not provide a specific timeline for when the Dublin facility would become operational, nor did she articulate a business justification for the proposed migration. The new language inserted in DPA v3.1, Section 7.3, would broadly authorize Meridian to process VMS data at "any facility operated by an Approved Sub-Processor," without geographic limitation, which represents a material departure from the location-specific processing commitments contained in DPA v3.0.
Our key conclusion is as follows: while no EU data subjects are currently in scope — all approximately 800,000 opted-in vehicles are registered in North America — hosting VMS data on EU infrastructure could trigger obligations under Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR") and introduces regulatory complexity that must be addressed in the Data Processing Agreement ("DPA"). Specifically, the processing of VMS data at Cloudvault's Dublin facility could bring the arrangement within the territorial scope of the GDPR under Article 3(1), expose VMS data to the supervisory jurisdiction of the Irish Data Protection Commission ("DPC"), and necessitate the implementation of cross-border data transfer mechanisms under GDPR Chapter V. These obligations exist independent of whether any data subjects are located in the European Union.
We recommend that the DPA include provisions: (i) restricting any international data transfer without VMS's prior written consent; (ii) requiring a documented Transfer Impact Assessment before any migration of VMS data to a non-U.S. facility; and (iii) specifying the legal mechanisms — including, at a minimum, the European Commission's Standard Contractual Clauses ("SCCs") — that must be in place before any cross-border transfer occurs. These recommendations are detailed in Part VII of this memorandum and should be incorporated into VMS's negotiating position for the next round of DPA discussions with WBC.
II. Background
A. The Data-Sharing Partnership and DPA Negotiations
VMS and Meridian executed a non-binding Letter of Intent ("LOI") on August 5, 2022, establishing the framework for a connected-vehicle data-sharing partnership. Under the proposed partnership, Meridian would serve as a data processor, receiving and processing up to fourteen (14) categories of vehicle telemetry and in-cabin sensor data from VMS's proprietary VantageLink platform. The VantageLink platform currently covers approximately 800,000 opted-in vehicles across North America, generating approximately 4.2 terabytes per day of raw telemetry data. Meridian's stated use for this data is to develop and refine its predictive maintenance analytics and insurance telematics scoring products, which Meridian markets to fleet operators, auto insurers, and municipal transportation authorities.
Calderwood & Harkness was engaged by VMS on September 14, 2022, to draft and negotiate the DPA governing Meridian's processing of VMS data. The initial engagement scope, as outlined in our engagement letter to VMS General Counsel Thomas Langford, encompassed the drafting and negotiation of the DPA, including all annexes related to data categories, technical and organizational measures, sub-processor approvals, and breach notification protocols. The engagement scope did not initially contemplate cross-border data transfer issues, as no international processing was discussed at the time of engagement.
The negotiation history of the DPA is as follows:
•  DPA v1.0 was circulated by Calderwood & Harkness to WBC on September 28, 2022. This initial draft reflected VMS's preferred positions on all material terms, including data retention, sub-processor management, breach notification, liability allocation, and data localization.
•  DPA v2.0 was returned by WBC on October 21, 2022, with sixty-three (63) substantive comments. Upon review, Calderwood & Harkness identified eleven (11) material open issues requiring resolution through negotiation.
•  A negotiation call was held on November 15, 2022, attended by Sara Hendricks and Alan Burke for Calderwood & Harkness and Catherine Ng and David Whitfield for WBC. During that call, the parties reached agreement on seven (7) of the eleven material open issues, leaving four (4) issues outstanding: (1) data retention periods and deletion obligations; (2) sub-processor approval mechanisms; (3) breach notification timelines; and (4) the aggregate liability cap applicable to data protection claims.
•  DPA v3.0 was circulated by Calderwood & Harkness on December 2, 2022, incorporating the agreed positions from the November 15 call and presenting VMS's revised proposals on the four remaining open issues.
•  DPA v3.1 was returned by WBC on December 16, 2022. In addition to revised positions on the four remaining open issues, WBC introduced two entirely new issues: (1) the international data transfer restriction at issue in this memorandum, and (2) a reconfiguration of sub-processor audit rights. Both new issues were accompanied by specific redline language inserted into Sections 7.3 and 8.4 of the DPA, respectively. Ms. Ng's cover email noted that these new issues arose from "recent developments in Meridian's infrastructure planning" and stated that Meridian wished to "preserve operational flexibility" in selecting data processing locations for its sub-processors.
The introduction of new issues at this stage of the negotiation is noteworthy. Prior rounds focused on narrowing the four outstanding disputes, and the parties appeared to be converging toward resolution. The Dublin facility issue, in particular, raises concerns that were not foreseeable from the earlier DPA drafts, in which Cloudvault's Columbus, Ohio facility was explicitly designated as the sole approved processing location.
B. Cloudvault Infrastructure, Inc. as Proposed Sub-Processor
Cloudvault Infrastructure, Inc. is a Nevada corporation headquartered at 200 Mill Street, Suite 100, Reno, NV 89501. Cloudvault provides cloud infrastructure and data processing services to enterprise clients, with a particular focus on the automotive and transportation sectors through its "AutoCloud" platform. Cloudvault currently operates two data centers in the United States:
(i) its headquarters facility in Reno, Nevada; and
(ii) its primary processing facility at 7400 Crossroads Boulevard, Columbus, OH 43219.
Meridian's existing master services agreement with Cloudvault (the "Cloudvault MSA") was executed on March 1, 2021, and governs Meridian's use of Cloudvault's infrastructure services. We have not been provided with a copy of the Cloudvault MSA or its associated data processing terms; however, WBC has represented that the Cloudvault MSA includes data security and confidentiality provisions consistent with industry standards.
Meridian proposed using Cloudvault's AutoCloud platform to host and process VMS data in its initial technical architecture submission dated September 12, 2022. DPA v1.0 and all subsequent drafts have identified Cloudvault as an approved sub-processor, with data processing to occur at the Columbus, OH facility. The designation of the Columbus facility was incorporated into Annex A (Approved Sub-Processors and Processing Locations) of each DPA draft through v3.0.
The proposed Dublin facility at Unit 12, Parkwest Business Campus, Dublin 12, Ireland, is a planned future site. Based on available information — including WBC's representations and publicly available corporate filings — Cloudvault has not yet commenced operations at the Dublin location. Ms. Ng's December 16 email indicated that the Dublin facility is "under evaluation" and that Cloudvault "anticipates operational readiness in mid-2023," though no firm date was provided and no independent confirmation of this timeline has been obtained. It is unclear whether Cloudvault has executed a lease for the Dublin premises, obtained necessary Irish regulatory approvals, or begun installation of physical infrastructure.
C. Nature of Data at Issue
The data at issue in the VMS-Meridian partnership encompasses fourteen (14) categories of vehicle telemetry and in-cabin sensor data, as defined in Annex C (Data Categories) of the DPA:
1.  GPS/geolocation data
2.  Vehicle speed
3.  Acceleration/deceleration data
4.  Braking events
5.  Tire pressure
6.  Engine diagnostic codes (OBD-II)
7.  Fuel consumption
8.  In-cabin temperature
9.  In-cabin humidity
10.  Seat occupancy
11.  Seatbelt status
12.  Ambient noise levels
13.  Windshield wiper activation
14.  Headlight/taillight status
Of particular significance, VMS has classified two of these categories — GPS/geolocation data (Category 1) and seat occupancy data (Category 10) — as "Sensitive Vehicle Data" under VMS's internal data governance policy (the "VMS Data Governance Framework," Version 4.2, effective January 1, 2022). This classification reflects VMS's determination that, when combined with vehicle identification numbers ("VINs"), these data categories can be linked to identifiable natural persons, specifically vehicle owners and lessees. GPS/geolocation data reveals the precise location and movement patterns of vehicles and, by extension, their drivers. Seat occupancy data, while facially less revealing, can in combination with other data points provide information about the number and positioning of vehicle occupants at specific times and locations.
The total data subject population encompasses approximately 800,000 opted-in vehicles. Of these, approximately 112,000 vehicles (representing 14% of the total population) are registered in the State of California, triggering the applicability of the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"). The remaining vehicles are distributed across other U.S. states and Canadian provinces. Critically, all data subjects are currently located in North America. No EU-based data subjects are included in the opted-in vehicle population, and VMS has not extended its VantageLink platform or Connected Insights program to the European market.
The data volume is substantial: approximately 4.2 terabytes per day of raw telemetry data are generated by the opted-in vehicle fleet. This volume and the granularity of the data — particularly the GPS/geolocation data, which provides continuous location tracking — significantly increase the re-identification risk associated with this dataset, even when VINs or other direct identifiers are removed or pseudonymized.
D. Current Data Transfer Architecture
Under the existing DPA draft (v3.0, carried forward in v3.1 except as modified by WBC's new redlines), the data transfer architecture is structured as follows:
(i) Raw telemetry data is transmitted from VMS's VantageLink platform to Meridian's data operations center, located at 8900 Research Park Drive, Building C, Austin, TX 78759, via encrypted API connections.
(ii) Meridian's Austin facility performs initial data ingestion, quality assurance, and preprocessing operations.
(iii) Preprocessed data is then transferred to and hosted on Cloudvault's AutoCloud platform at the Columbus, OH data center (7400 Crossroads Boulevard, Columbus, OH 43219) for further processing, analytics, and storage.
All processing under this architecture occurs within the United States. No cross-border data transfer mechanism has been included in any DPA draft to date — from v1.0 through v3.0 — because no international transfer was contemplated. The DPA's technical architecture annex (Annex D) specifies the Columbus, OH facility as the sole Cloudvault processing location, and the security requirements in Annex B (Technical and Organizational Measures) are calibrated to U.S.-based processing.
The potential migration of VMS data processing to Dublin would represent a fundamental alteration of this architecture, introducing a cross-border data flow that implicates an entirely different regulatory regime and necessitates transfer mechanisms that are not currently addressed in the DPA.
III. Legal Analysis: GDPR Applicability
A. Territorial Scope of the GDPR (Article 3)
The threshold question in assessing the impact of the proposed Dublin migration is whether the GDPR would apply to the processing of VMS data at Cloudvault's Dublin facility. The GDPR's territorial scope is defined by Article 3, which establishes two independent bases for applicability.
Article 3(1) — Establishment-Based Applicability. GDPR Article 3(1) provides that the Regulation applies to "the processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether the processing takes place in the Union or not." The Court of Justice of the European Union ("CJEU") has interpreted the concept of "establishment" broadly. In Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság (Case C-230/14, October 1, 2015), the CJEU held that the concept of "establishment" extends to "any real and effective activity — even a minimal one — exercised through stable arrangements," and that the legal form of such arrangements is not determinative. The European Data Protection Board ("EDPB") has further elaborated on this standard in its Guidelines 3/2018 on the territorial scope of the GDPR, adopted on November 12, 2019.
If Cloudvault operates a data center in Dublin and processes VMS data at that facility, this would constitute processing "in the context of the activities of an establishment" of a processor (Cloudvault) in the European Union. Cloudvault's Dublin facility, once operational, would likely qualify as an "establishment" under the GDPR's broad definition, as it would involve the exercise of real and effective data processing activities through a stable physical arrangement in Ireland. The fact that the processing is performed on behalf of a non-EU controller (VMS) and concerns non-EU data subjects does not, under Article 3(1), preclude GDPR applicability. Article 3(1) focuses on the location of the establishment performing the processing, not on the nationality or location of the data subjects.
We acknowledge that there is some interpretive uncertainty regarding whether the processing of exclusively non-EU personal data at an EU establishment triggers the full scope of GDPR obligations. The EDPB's guidelines do not specifically address this scenario, and no CJEU case law directly resolves this question. However, the text of Article 3(1) contains no limitation based on the origin or subject of the data — it applies to "the processing of personal data in the context of the activities of an establishment" in the EU without qualification. Given the CJEU's tendency to interpret GDPR's territorial provisions expansively, and given the regulatory posture of the Irish DPC, we believe that the risk of GDPR applicability in this scenario is meaningful and should be treated as a material consideration in the DPA negotiations.
Article 3(2) — Targeting-Based Applicability. GDPR Article 3(2) applies the Regulation to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities relate to: (a) the offering of goods or services, irrespective of whether payment is required, to such data subjects in the EU; or (b) the monitoring of their behavior as far as their behavior takes place within the EU.
Article 3(2) does not directly apply to the VMS-Meridian arrangement as currently structured. VMS is not offering goods or services to persons in the EU through the VantageLink platform or the Connected Insights program — both are currently limited to the North American market. Similarly, VMS is not monitoring the behavior of EU-based individuals; all telemetry data originates from vehicles operated in North America.
However, this analysis is not static. If any VMS vehicles were to be operated by EU residents who are temporarily present in North America (for example, EU nationals on extended work assignments who lease or purchase VMS-equipped vehicles), the data collected from those vehicles could constitute the processing of personal data of data subjects who are "in the EU" for purposes of GDPR Article 3(2)(b), depending on the interpretation of the phrase "data subjects who are in the Union." More significantly, if VMS were to extend its Connected Insights program to EU markets — a possibility that VMS has discussed internally, though no formal decision has been made — Article 3(2)(a) would be directly engaged, and the Dublin processing location would become a significant regulatory asset and liability simultaneously.
Key Risk Assessment. GDPR applicability is inherently fact-specific and evolving. The CJEU's broad interpretation of "establishment" and the EDPB's expansive approach to territorial scope suggest that the mere use of EU-based infrastructure for processing, even of non-EU data, could attract scrutiny from EU data protection authorities. We assess the risk that the GDPR would apply to the processing of VMS data at Cloudvault's Dublin facility as medium-high, reflecting the uncertainty in the legal analysis tempered by the absence of EU data subjects and the absence of any EU-directed commercial activity by VMS.
B. Personal Data Classification Under GDPR
If the GDPR is determined to apply, the next question is whether the VMS data constitutes "personal data" within the meaning of GDPR Article 4(1). Under that provision, "personal data" means "any information relating to an identified or identifiable natural person ('data subject')," and an "identifiable natural person" is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
VIN-linked GPS/geolocation data and seat occupancy data — VMS's two "Sensitive Vehicle Data" categories — are almost certainly "personal data" under the GDPR to the extent they can be used, directly or indirectly, to identify vehicle owners, lessees, or habitual drivers. VINs are unique identifiers linked to vehicle registration records, which in turn are linked to the names and addresses of registered owners. GPS/geolocation data reveals the precise location and movement patterns of vehicles and, by extension, their associated individuals. The Article 29 Working Party (the EDPB's predecessor) addressed location data specifically in its Opinion 13/2011 on Geolocation services on smart mobile devices, concluding that location data associated with an identifiable individual constitutes personal data. Although that opinion addressed mobile devices rather than vehicles, the underlying principle is directly applicable.
Even the data categories that VMS has not classified as "Sensitive Vehicle Data" — such as vehicle speed, braking events, fuel consumption, and engine diagnostic codes — could constitute personal data under the GDPR if they are linked to VINs or other identifiers traceable to natural persons. The GDPR's definition of "personal data" is deliberately broad, and the CJEU has consistently reinforced this breadth. In Breyer v. Bundesrepublik Deutschland (Case C-582/14, October 19, 2016), the CJEU held that even dynamic IP addresses can constitute personal data where the controller has the legal means to obtain additional information enabling identification. By analogy, vehicle telemetry data linked to VINs — where VINs are traceable to registered owners through publicly accessible or commercially available databases — falls within the GDPR's definition of personal data.
The volume of data at issue (approximately 4.2 TB/day from 800,000 vehicles) and its granularity further increase the re-identification risk. Even if VINs were stripped or pseudonymized prior to transfer, the combination of GPS/geolocation data, vehicle speed, braking patterns, and other telemetry data points could enable re-identification of individual vehicles and, by extension, their associated owners or drivers through triangulation and pattern analysis.
C. Impact of No Current EU Data Subjects
We acknowledge that no data subjects are currently located in the European Union. All 800,000 opted-in vehicles are registered in North America, and VMS's VantageLink platform and Connected Insights program are not offered in the EU market. This is an important factual consideration that mitigates the probability that certain GDPR provisions — particularly those relating to data subject rights under Articles 12 through 23 — would be practically enforced with respect to VMS data.
However, GDPR obligations can be triggered by the location of processing under Article 3(1), not solely by the location of data subjects. As discussed in Section III.A above, the processing of personal data at a processor's EU establishment brings that processing within the GDPR's territorial scope regardless of where the data subjects are located. The absence of EU data subjects reduces the practical risk of data subject complaints or access requests, but it does not eliminate the regulatory risk. The Irish DPC could, on its own initiative, investigate the processing activities occurring at the Dublin facility, request information regarding the categories of data being processed, and assess compliance with GDPR requirements — including requirements related to lawful basis, data minimization, storage limitation, integrity and confidentiality, and accountability.
Additionally, migration of VMS data to Dublin introduces the data to a jurisdiction with its own independent regulatory authority. Even if the GDPR were determined not to apply to this specific processing arrangement (a position we do not recommend relying upon), the Irish Data Protection Commission exercises supervisory authority over data processing activities within its territory and could assert jurisdiction over the processing of VMS data at the Dublin facility. The DPC has been among the most active data protection authorities in Europe, with a demonstrated willingness to investigate and sanction data processing activities by technology companies with establishments in Ireland.
Finally, the current absence of EU data subjects is not a permanent condition. If VMS expands its Connected Insights program to the EU market, or if any data subjects relocate to the EU, the GDPR analysis would shift further and more decisively toward full applicability under both Article 3(1) and Article 3(2). Any DPA provisions addressing this issue should be drafted to account for this possibility.
IV. Legal Analysis: Cross-Border Data Transfer Mechanisms
A. GDPR Chapter V — Transfers to Third Countries
If VMS data is processed at Cloudvault's Dublin facility, the cross-border data transfer provisions of GDPR Chapter V (Articles 44 through 50) become relevant in two respects. First, if VMS data is transmitted from the United States to the Dublin facility for processing, this constitutes an importation of data into the EU. Second, and more critically, if processed data or analytics outputs are transferred from the Dublin facility back to Meridian's Austin, TX operations center or to VMS in Auburn Hills, Michigan, this constitutes a transfer of personal data from the EU to a "third country" — the United States being a third country from the EU perspective.
Under Article 44 of the GDPR, any transfer of personal data that is undergoing processing or is intended for processing after transfer to a third country may take place only if the conditions laid down in Chapter V are complied with by the controller and processor. These conditions are cumulative with the other provisions of the GDPR — compliance with Chapter V does not substitute for compliance with the GDPR's substantive requirements.
The EU-U.S. Data Privacy Framework ("DPF") — the successor to the invalidated EU-U.S. Privacy Shield — was announced in principle in March 2022 and advanced by Executive Order 14086, signed by President Biden on October 7, 2022. Executive Order 14086 introduced new safeguards limiting U.S. Signals intelligence activities and establishing a redress mechanism for EU individuals through a Data Protection Review Court. However, as of the date of this memorandum, the European Commission has not yet adopted a final adequacy decision with respect to the DPF. The Commission issued a draft adequacy decision on December 13, 2022, and the decision is expected to be finalized in early-to-mid 2023 following review by the EDPB and the European Parliament. The DPF may ultimately provide an adequacy-based mechanism for EU-U.S. data transfers, but its durability is uncertain given the history of successful legal challenges to prior adequacy frameworks. The CJEU's invalidation of the EU-U.S. Privacy Shield in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II," July 16, 2020) underscores the fragility of adequacy decisions predicated on U.S. surveillance law, and privacy advocacy organizations have already signaled their intent to challenge the DPF before the CJEU.
In the absence of a valid adequacy decision, transfers of personal data to the United States must rely on one of the "appropriate safeguards" enumerated in Article 46 of the GDPR. The most commonly used safeguard is the Standard Contractual Clauses approved by the European Commission.
B. Standard Contractual Clauses (SCCs)
The European Commission adopted new Standard Contractual Clauses on June 4, 2021, pursuant to Commission Implementing Decision (EU) 2021/914. The new SCCs replace the prior sets of clauses adopted under Directive 95/46/EC and reflect the requirements established by the CJEU in Schrems II. The new SCCs are structured in a modular format, with four modules corresponding to different data transfer scenarios:
•  Module 1: Controller-to-Controller transfers
•  Module 2: Controller-to-Processor transfers
•  Module 3: Processor-to-Sub-Processor transfers
•  Module 4: Processor-to-Controller transfers
For the VMS-Meridian-Cloudvault arrangement, the most directly relevant module is Module 3 (Processor-to-Sub-Processor). This module would apply if Meridian, acting as Processor on behalf of VMS, transfers VMS data to Cloudvault, acting as Sub-Processor, at the Dublin facility, and the data is subsequently accessed from or transferred back to U.S.-based operations. Under this module, the data exporter is the processor (Meridian) and the data importer is the sub-processor (Cloudvault's Dublin facility).
The SCCs under Module 3 would need to be incorporated into or appended to the Meridian-Cloudvault sub-processing agreement. The SCCs impose specific obligations on both the data exporter and the data importer, including obligations related to purpose limitation, data security, onward transfers, data subject rights, and cooperation with supervisory authorities. Importantly, the SCCs also include provisions granting third-party beneficiary rights to data subjects, which in this context would extend to the identifiable vehicle owners and lessees whose data is being processed.
VMS, as the Controller, would need to be a party to or a named third-party beneficiary of the SCCs to ensure adequate protections and enforcement rights. Although Module 3 is structured as a Processor-to-Sub-Processor arrangement, Clause 8.8 of Module 3 requires the sub-processor to provide the same level of protection as the processor provides under its agreement with the controller, and the controller retains ultimate accountability for GDPR compliance. We recommend that the DPA include a provision requiring Meridian to ensure that any SCCs entered into with Cloudvault explicitly identify VMS as a third-party beneficiary with direct enforcement rights.
Additionally, Module 2 (Controller-to-Processor) may be relevant if VMS data flows directly from VMS's U.S.-based VantageLink platform to the Dublin facility, bypassing Meridian's Austin data operations center. While this data flow is not currently contemplated, it could arise if the technical architecture evolves, and the DPA should account for this possibility.
C. Supplementary Measures (Post-Schrems II Requirements)
The CJEU's Schrems II decision established that the use of SCCs alone does not automatically satisfy the GDPR's requirements for cross-border data transfers. The Court held that data exporters must assess, on a case-by-case basis, whether the law of the third country of destination ensures an "essentially equivalent" level of protection to that guaranteed within the EU. If the assessment reveals that the third country's legal framework undermines the protections provided by the SCCs, the data exporter must implement "supplementary measures" to fill the gap, or refrain from transferring the data.
The EDPB issued its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, adopted in final form on June 18, 2021. These recommendations provide a structured methodology for conducting Transfer Impact Assessments ("TIAs") and identifying appropriate supplementary measures.
A TIA for the proposed Dublin-to-U.S. transfer of VMS data would need to evaluate, at minimum, the following elements of the U.S. legal framework:
(i) FISA Section 702 (50 U.S.C. § 1881a): Authorizes the U.S. government to target non-U.S. persons located outside the United States for the acquisition of foreign intelligence information, including communications data held by U.S.-based electronic communications service providers. Because Cloudvault is a U.S. company, it could potentially be subject to FISA Section 702 orders, though the applicability of Section 702 to cloud infrastructure providers (as opposed to electronic communications service providers) is subject to ongoing legal debate.
(ii) Executive Order 12333: Authorizes the collection of signals intelligence by U.S. Intelligence agencies, including the collection of data in transit outside the United States. Data transmitted between the Dublin facility and U.S.-based operations could potentially be intercepted under EO 12333 authorities.
(iii) Executive Order 14086 (October 7, 2022): Introduces new safeguards for signals intelligence activities, including principles of necessity and proportionality, and establishes a two-tier redress mechanism (Civil Liberties Protection Officer review followed by the Data Protection Review Court). While EO 14086 represents a significant improvement over the prior legal framework, it has not yet been tested in practice, and its effectiveness as a safeguard remains to be determined.
Supplementary technical measures that could be implemented to mitigate the risks identified in a TIA include:
•  Encryption of VMS data in transit and at rest, with encryption keys held exclusively by the data exporter (VMS or Meridian) and not accessible to Cloudvault or any U.S. government authority
•  Pseudonymization of VMS data prior to transfer, such that the data processed in Dublin cannot be attributed to identifiable individuals without the use of additional information held separately by VMS
•  Access controls limiting U.S.-based Cloudvault personnel's access to VMS data stored at the Dublin facility
•  Technical logs and monitoring to detect and record any access to VMS data at the Dublin facility
Supplementary organizational measures would include data access policies restricting personnel access on a need-to-know basis, staff training on data protection obligations, transparency reporting regarding government access requests, and contractual commitments by Cloudvault not to provide VMS data to any government authority without prior notification to VMS (to the extent not prohibited by law).
D. Data Localization Considerations
Even absent strict GDPR applicability, moving VMS data to Dublin creates jurisdictional exposure that warrants careful consideration. The Irish Data Protection Commission exercises supervisory authority over data processing activities occurring within Ireland, and the mere presence of data processing operations at a Dublin facility subjects those operations to potential DPC oversight — including requests for information, inspections, and enforcement actions under the Irish Data Protection Act 2018 (which gives domestic effect to the GDPR).
The Irish DPC has been notably active in enforcing the GDPR against technology companies with establishments in Ireland. As the lead supervisory authority for many multinational technology companies under the GDPR's one-stop-shop mechanism (Article 56), the DPC has initiated and concluded enforcement actions resulting in significant fines, including record-setting penalties imposed on major U.S. technology companies for violations related to data transfers, transparency, and data subject rights. While VMS's situation is distinguishable — VMS is not a technology company with an Irish establishment — the processing of VMS data by Cloudvault at a Dublin facility could draw the arrangement into the DPC's sphere of attention, particularly if the DPC conducts sector-specific audits of data centers operating in its jurisdiction.
Data localization commitments in the DPA — restricting all VMS data processing to specified U.S. facilities — would eliminate this jurisdictional exposure entirely. Such commitments are a straightforward and effective risk mitigation strategy that avoids the complexity, cost, and uncertainty associated with implementing cross-border transfer mechanisms and managing dual-jurisdiction compliance.
V. Legal Analysis: Interaction with U.S. Privacy Frameworks
A. Michigan Identity Theft Protection Act (MCL 445.61 et seq.)
The Michigan Identity Theft Protection Act ("ITPA") requires persons and entities that own or license data containing "personal information" of Michigan residents to implement and maintain reasonable security measures to protect that information against unauthorized access, use, or disclosure. The ITPA also imposes breach notification obligations, requiring notice to affected individuals and, in certain cases, to the Michigan Attorney General.
VMS is headquartered in Auburn Hills, Michigan, and a substantial portion of the 800,000 opted-in vehicles are likely registered in Michigan. VIN-linked vehicle telemetry data — particularly GPS/geolocation data — may constitute "personal information" under the ITPA to the extent it can be combined with an individual's name or other identifying information to identify a specific Michigan resident.
While the cross-border transfer of VMS data to Dublin does not directly trigger additional ITPA obligations, it could affect VMS's compliance posture with respect to the ITPA's reasonable security requirements. Specifically, transferring data to a facility in another jurisdiction — subject to a different legal regime, different governmental access standards, and potentially different security practices — could be viewed as inconsistent with the "reasonable security measures" standard if the transfer is not accompanied by adequate contractual, technical, and organizational safeguards. In the event of a data breach at the Dublin facility, VMS would need to ensure that its breach notification obligations under Michigan law are fully satisfied, which could be complicated by the involvement of a foreign jurisdiction and the potential for conflicting notification requirements under Irish and EU law.
B. CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.)
Approximately 112,000 of the 800,000 opted-in vehicles are registered in the State of California, representing 14% of the data subject population. The CCPA, as amended by the CPRA (effective January 1, 2023), applies to businesses that collect personal information of California consumers and meet specified revenue or data processing thresholds. VMS meets these thresholds and is subject to CCPA/CPRA obligations with respect to the personal information of California-registered vehicle owners and lessees.
The CCPA/CPRA does not specifically restrict international transfers of personal information. Unlike the GDPR, which imposes detailed requirements on cross-border data transfers, the CCPA/CPRA framework is primarily concerned with the purposes for which personal information is used and the rights of consumers to access, delete, correct, and opt out of the sale or sharing of their personal information. However, the CCPA/CPRA does impose substantive requirements on contracts with service providers and contractors. Under CCPA/CPRA regulations, contracts with service providers must:
(i) identify the specific business purpose for which the personal information is provided;
(ii) prohibit the service provider from retaining, using, or disclosing the personal information for any purpose other than the specified business purpose or as otherwise permitted by the CCPA/CPRA;
(iii) prohibit the service provider from selling or sharing the personal information; and
(iv) require the service provider to notify the business if it can no longer meet its obligations under the CCPA/CPRA.
Any migration of VMS data to Dublin must be covered by contractual provisions satisfying these requirements. Additionally, VMS must ensure that consumer rights under the CCPA/CPRA — including the right to access, the right to deletion, and the right to opt out of the sale or sharing of personal information — remain fully enforceable despite the international processing location. This requires clear contractual mechanisms for processing consumer requests and ensuring that data held at the Dublin facility can be promptly identified, retrieved, modified, or deleted in response to verified consumer requests.
The CPRA's enhanced contractor obligations, which became operative on January 1, 2023, introduce additional requirements for monitoring and auditing service providers and contractors to ensure compliance with contractual data protection obligations. These obligations are relevant to the sub-processor chain extending from VMS through Meridian to Cloudvault, and would need to be addressed in any amendment to the DPA authorizing international processing.
C. DPPA (18 U.S.C. § 2721 et seq.)
The Driver's Privacy Protection Act ("DPPA") restricts the disclosure and use of personal information obtained from state motor vehicle records. The DPPA applies to motor vehicle departments and to any person who knowingly obtains or discloses personal information from a motor vehicle record for an unauthorized purpose.
To the extent that VMS data includes VIN-linked information traceable to state department of motor vehicle records, the DPPA's restrictions on disclosure apply regardless of where processing occurs. The DPPA does not contain an express provision addressing international transfers of protected information, but the statute's broad prohibition on unauthorized disclosure applies to any person who obtains or discloses the information, without geographic limitation. An international transfer of VIN-linked data to a Dublin facility does not create a DPPA exemption; rather, it complicates enforcement of the DPPA's protections, as data held in a foreign jurisdiction may be more difficult to recover or control in the event of unauthorized access or disclosure.
The DPA should include provisions ensuring that VMS data subject to DPPA restrictions is clearly identified and that Meridian and Cloudvault are contractually prohibited from using or disclosing such data for any purpose other than the authorized business purposes specified in the DPA.
VI. Risk Assessment Summary
A. Risk Matrix
Based on the legal analysis set forth in Parts III through V of this memorandum, we have identified the following principal risks associated with the potential migration of VMS data processing to Cloudvault's Dublin facility:
Risk 1 — GDPR Applicability (Medium-High). As discussed in Part III.A, the processing of VMS data at a Cloudvault establishment in Dublin could bring the arrangement within the territorial scope of the GDPR under Article 3(1). The consequence of GDPR applicability would be substantial: VMS, Meridian, and Cloudvault would be subject to the full range of GDPR compliance obligations, including the requirement to establish a lawful basis for processing under Article 6, the obligation to honor data subject rights under Articles 12 through 23, potential obligations to appoint a Data Protection Officer under Article 37, the requirement to notify the supervisory authority of personal data breaches within 72 hours under Article 33, and exposure to administrative fines of up to 4% of annual worldwide turnover or €20 million, whichever is greater, under Article 83. The likelihood of GDPR applicability is assessed as medium-high based on the broad interpretation of "establishment" under Article 3(1) and the absence of legal authority definitively excluding this scenario.
Risk 2 — Irish DPC Supervision (Medium). Even if GDPR applicability is uncertain, the presence of data processing operations at the Dublin facility subjects those operations to the supervisory authority of the Irish DPC. The DPC has demonstrated a willingness to exercise its enforcement powers actively, as evidenced by its high-profile enforcement actions against major technology companies in recent years. The likelihood of DPC scrutiny of VMS data processing specifically is moderate — the DPC's enforcement priorities tend to focus on larger-scale consumer data processing by technology companies — but the risk cannot be discounted, particularly if the DPC conducts sector-wide audits of data center operations in its jurisdiction.
Risk 3 — Transfer Mechanism Fragility (Medium). The SCCs adopted under Commission Implementing Decision (EU) 2021/914 are the primary available mechanism for legitimizing cross-border data transfers from the EU to the United States in the absence of a valid adequacy decision. However, the post-Schrems II landscape remains characterized by legal and regulatory uncertainty. The EU-U.S. Data Privacy Framework, if adopted, may provide an adequacy-based alternative, but its longevity is uncertain in light of anticipated legal challenges. Reliance on SCCs alone requires the completion of a Transfer Impact Assessment and the implementation of supplementary measures, adding complexity and ongoing compliance obligations.
Risk 4 — Operational Complexity (Medium). Managing compliance across two jurisdictions — the United States and the European Union — significantly increases VMS's and Meridian's operational burden. Dual-jurisdiction compliance requires the implementation of separate and potentially conflicting data protection requirements, the engagement of EU-qualified legal counsel, the potential appointment of a Data Protection Officer, the development of breach notification protocols satisfying both U.S. and EU requirements, and the ongoing monitoring of regulatory developments in both jurisdictions. These costs and complexities are difficult to quantify but are material.
Risk 5 — Conflict with VMS Data Governance Policy (Low-Medium). VMS's internal Data Governance Framework (Version 4.2) classifies GPS/geolocation and seat occupancy data as "Sensitive Vehicle Data" and imposes heightened protection requirements on these data categories. The international transfer of Sensitive Vehicle Data to a facility in Ireland was not contemplated in the current Data Governance Framework, and such a transfer may be inconsistent with VMS's existing data governance commitments and the reasonable expectations of VMS's data subjects. While this is primarily an internal governance issue, it could have reputational and contractual implications if VMS's privacy notices or terms of service contain representations regarding the geographic scope of data processing.
Risk 6 — Sub-Processor Chain Complexity (Medium). Adding an international facility to Cloudvault's processing infrastructure extends the sub-processor chain across jurisdictions, introducing complexities in several areas: audit rights (conducting audits of a facility in Ireland is more logistically challenging and costly than auditing a domestic facility); flow-down obligations (ensuring that GDPR-compliant data protection terms flow through from VMS to Meridian to Cloudvault to the Dublin facility); and incident response (coordinating breach response across time zones and regulatory regimes, with potentially conflicting notification timelines and requirements).
B. Overall Assessment
The potential Dublin migration introduces material regulatory and operational risks that are disproportionate to any identified benefit to VMS. Meridian has not articulated a compelling business justification for routing VMS data through Dublin rather than continuing to process exclusively at the Columbus, OH facility. In her December 16, 2022 correspondence, Catherine Ng characterized the Dublin migration as a matter of "operational flexibility" for Meridian and Cloudvault, but did not identify any specific performance, cost, or reliability benefit that the Dublin facility would provide over the Columbus facility for the processing of VMS data.
The current DPA draft (v3.0, as modified by v3.1) does not address international data transfers and would require substantial amendment to accommodate this scenario. The cost of implementing adequate contractual, technical, and organizational safeguards for an international transfer — including SCCs, supplementary measures, Transfer Impact Assessments, enhanced audit rights, and dual-jurisdiction breach notification protocols — would be significant and ongoing.
We recommend that VMS take the position that international transfer of VMS data is not authorized and should be contractually prohibited absent VMS's prior written consent, subject to the conditions described in Part VII below.
VII. Recommendations for DPA Provisions
Based on the foregoing analysis, we recommend that the following provisions be incorporated into VMS's revised DPA proposal. These provisions are designed to protect VMS's interests while preserving a reasonable path for future international processing if VMS determines, upon informed assessment, that such processing is appropriate.
A. International Data Transfer Restriction
We recommend inserting a provision in the DPA — proposed Section 7.3 (replacing WBC's redlined language) — that expressly prohibits Meridian (and any sub-processor, including Cloudvault) from transferring, accessing, or processing VMS data outside the United States without VMS's prior written consent. The provision should make clear that this prohibition encompasses all forms of data movement, including remote access from outside the United States to data stored at U.S. facilities.
VMS's consent, if given, should be conditioned on satisfaction of all of the following prerequisites:
(i) Completion of a documented Transfer Impact Assessment in accordance with Section [7.4] of the DPA (see Recommendation B below);
(ii) Execution of applicable Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or equivalent legally binding transfer mechanism approved by VMS;
(iii) Implementation of supplementary technical and organizational measures approved by VMS in writing, consistent with EDPB Recommendations 01/2020; and
(iv) Written confirmation by Meridian that the receiving facility meets all security standards specified in Annex B (Technical and Organizational Measures) of the DPA, as verified by an independent third-party audit conducted within the preceding twelve (12) months.
This consent requirement should be non-delegable — VMS should retain sole discretion to grant or withhold consent, and Meridian should not be permitted to argue that consent has been unreasonably withheld.
B. Transfer Impact Assessment Requirement
We recommend the inclusion of a mandatory Transfer Impact Assessment ("TIA") protocol, to be incorporated as proposed Section 7.4 of the DPA. The TIA should be completed by Meridian at its sole expense and submitted to VMS for review and written approval before any proposed international transfer of VMS data. The TIA should not be a one-time exercise; it should be refreshed at least annually, and immediately upon any material change in the legal framework of the destination country.
The TIA should address, at minimum, the following elements:
(i) The legal framework of the destination country with respect to government access to personal data, including surveillance laws, national security authorities, and law enforcement powers — with specific reference to the destination country's intelligence agencies and their legal authorities;
(ii) The specific categories of VMS data proposed to be transferred, including an assessment of the sensitivity and re-identification risk of each category;
(iii) The transfer mechanism to be relied upon (SCCs, adequacy decision, or other legally binding instrument), including an assessment of its legal validity and enforceability in the destination country;
(iv) The supplementary technical and organizational measures proposed to be implemented, with a detailed description of each measure and an assessment of its effectiveness in mitigating the risks identified in the TIA;
(v) An assessment of the likelihood that the destination country's laws would prevent Meridian, Cloudvault, or any other sub-processor from complying with the data protection obligations set forth in the DPA; and
(vi) A recommendation regarding whether the proposed transfer should proceed, including a reasoned analysis of the residual risks and a proposed risk mitigation plan.
VMS should retain the right to reject any proposed transfer if, in its sole discretion, the TIA reveals risks that are not adequately mitigated by the proposed safeguards.
C. Data Localization Commitment
We recommend the inclusion of a data localization clause — proposed Section 7.5 — specifying that all VMS data shall be stored and processed exclusively at the following approved locations:
(i) Cloudvault's Columbus, OH data center at 7400 Crossroads Boulevard, Columbus, OH 43219; and
(ii) Meridian's Austin, TX data operations center at 8900 Research Park Drive, Building C, Austin, TX 78759.
No VMS data shall be transferred to, stored at, accessed from, or processed at any other location without VMS's prior written consent, obtained in accordance with the procedures set forth in Sections 7.3 and 7.4 of the DPA.
Any amendment to the approved processing locations should require a minimum of sixty (60) days' prior written notice from Meridian to VMS, accompanied by a completed TIA and all supporting documentation. VMS should have the right to approve or reject the proposed new location in its sole discretion, and any approval should not take effect until all prerequisites specified in Section 7.3 have been satisfied.
D. Sub-Processor Flow-Down Obligations for International Transfers
The DPA should require Meridian to impose equivalent transfer restrictions on Cloudvault via the Meridian-Cloudvault sub-processing agreement. Specifically, the DPA should require that the Meridian-Cloudvault sub-processing agreement include provisions:
(i) Prohibiting Cloudvault from transferring, accessing, or processing VMS data outside the United States without VMS's prior written consent;
(ii) Requiring Cloudvault to cooperate with and contribute to any Transfer Impact Assessment conducted by Meridian;
(iii) Obligating Cloudvault to implement all supplementary technical and organizational measures specified by VMS; and
(iv) Providing that VMS is a named third-party beneficiary of any SCCs or other transfer mechanisms entered into by Cloudvault, with direct enforcement rights — including the right to audit Cloudvault's compliance with the SCCs and to suspend or terminate the data transfer in the event of non-compliance.
This recommendation connects to the broader open issue of sub-processor approval rights. VMS's current proposal (DPA v3.0, Section 8.1) requires VMS's prior written consent before Meridian may engage or change any sub-processor. Meridian's counter-proposal (DPA v3.1, Section 8.1) would adopt a general authorization model with a 30-day objection window. We recommend that the international transfer provisions reinforce the prior written consent model, at least with respect to any sub-processor that would process VMS data at a non-U.S. facility. The heightened regulatory risk associated with international processing justifies a more restrictive consent framework than may be appropriate for domestic sub-processor changes.
E. Enhanced Audit Rights for International Processing
If any international transfer of VMS data is ultimately approved, we recommend that VMS's audit rights be expanded for the international processing location. The current DPA audit provisions are the subject of an open negotiation:
•  VMS's position (DPA v3.0, Section 8.4): Unlimited on-site audits with ten (10) business days' prior written notice, at VMS's expense.
•  Meridian's position (DPA v3.1, Section 8.4): Annual audits with thirty (30) calendar days' prior written notice, subject to a $25,000 cost-sharing cap per audit.
For any international processing facility, we recommend the following audit rights as a minimum:
(i) Semi-annual audit rights, with fifteen (15) business days' prior written notice;
(ii) No cost-sharing cap or other financial limitation on audit frequency or scope;
(iii) The right for VMS to designate a qualified third-party auditor — such as Pinehurst Cybersecurity Advisors LLC or an equivalent firm — to conduct the audit on VMS's behalf, at VMS's expense; and
(iv) The right to conduct additional ad hoc audits on reasonable notice in the event of a suspected data breach, security incident, or regulatory investigation involving the international processing facility.
As a cross-reference, Pinehurst Cybersecurity Advisors LLC delivered its preliminary security assessment findings to VMS on November 22, 2022 (the engagement and findings are outside the scope of Calderwood & Harkness's engagement), which assessed Meridian's current U.S.-based processing environment. Any Dublin migration would necessitate a separate and comprehensive security assessment of the Dublin facility, including evaluation of physical security, network architecture, access controls, encryption standards, and incident response capabilities.
F. Breach Notification in International Context
The migration of VMS data processing to Dublin introduces a potential conflict between the breach notification timelines currently being negotiated in the DPA. Under GDPR Article 33, a data controller must notify the competent supervisory authority (here, the Irish DPC) of a personal data breach "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This 72-hour standard aligns with Meridian's proposed breach notification timeline in DPA v3.1 (Section 9.2), which requires notification to VMS within 72 hours of becoming aware of a data breach. However, VMS's preferred position (DPA v3.0, Section 9.2) calls for notification to VMS within 24 hours of discovery.
We recommend that the DPA adopt a dual-notification approach that addresses both the contractual notification to VMS and the regulatory notification to the supervisory authority:
(i) Notification to VMS: Meridian shall notify VMS of any actual or suspected breach of VMS data within twenty-four (24) hours of becoming aware of the breach, consistent with VMS's preferred position. This notification should include, at minimum, the nature of the breach, the categories and approximate number of data subjects affected, the categories and approximate number of data records affected, a description of the likely consequences, and the measures taken or proposed to address the breach.
(ii) Notification to Supervisory Authority: To the extent required by applicable law (including GDPR Article 33), Meridian or Cloudvault shall notify the competent supervisory authority within the timeframe specified by such law — currently 72 hours under the GDPR — provided that VMS shall have the right to review and approve the content of any notification to a supervisory authority before it is submitted.
(iii) Coordination: The DPA should include a coordination mechanism requiring Meridian to consult with VMS on the content and timing of any supervisory authority notification, to the extent legally permissible, and to provide VMS with copies of all correspondence with the supervisory authority.
This dual-notification approach preserves VMS's interest in early notification while acknowledging the mandatory nature of supervisory authority notification timelines under applicable law.
G. Governing Law and Jurisdiction
The DPA is currently governed by the laws of the State of Michigan, as specified in Section 14.1 of all DPA drafts through v3.1. We recommend retaining Michigan law as the governing law for the DPA, while including a provision that acknowledges the potential applicability of mandatory provisions of the GDPR and Irish data protection law (the Data Protection Act 2018) to the extent that VMS data is processed at a facility located in Ireland.
Specifically, we recommend the following provision:
"This Agreement shall be governed by and construed in accordance with the laws of the State of Michigan, without regard to its conflict of laws principles. The parties acknowledge that, to the extent Personal Data is processed at a facility located in the European Union, mandatory provisions of Regulation (EU) 2016/679 (General Data Protection Regulation) and the data protection laws of the applicable EU Member State may apply to such processing. In the event of any conflict between the provisions of this Agreement and mandatory prov

MEMORANDUM

Record

Parties

Dates

Amounts