1007-00007 · Vantage Mobility Systems Corp · Memos & Analysis

issues-memorandum-dpa-v2-0.docx DOCUMENT Finance & Banking

7 / 12 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

November 4, 2022

TO: Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp.

FROM: Alan Burke, Senior Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP Sara Hendricks, Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP

RE: Analysis of Material Open Issues — Whitfield, Barrow & Crane LLP Redline of Data Processing Agreement v2.0 (Vantage Mobility Systems Corp. / Meridian Telematics Solutions, Inc.)

MATTER NO.: 1007-00007

COPIES: Kevin Ostrowski (for billing file); Thomas Langford, General Counsel, Vantage Mobility Systems Corp.

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes the eleven material open issues arising from the redlined Data Processing Agreement version 2.0 ("DPA v2.0" or the "Redline") returned by Whitfield, Barrow & Crane LLP ("WBC"), outside counsel to Meridian Telematics Solutions, Inc. ("Meridian"), on October 21, 2022. The purpose of this memorandum is to provide Vantage Mobility Systems Corp. ("VMS") and its privacy leadership with a comprehensive assessment of each material issue, together with recommended negotiation positions and areas of potential compromise, in advance of the next round of negotiations with WBC.

By way of background, Calderwood & Harkness transmitted VMS's initial draft Data Processing Agreement version 1.0 ("DPA v1.0") to WBC on October 7, 2022. DPA v1.0 comprises forty-seven pages, including the main body of the agreement and three annexes (Annex A — Description of Processing Activities; Annex B — Technical and Organizational Measures; and Annex C — Approved Sub-Processors). WBC's Redline, received on October 21, contains sixty-three substantive comments and proposed revisions to DPA v1.0.

Of the sixty-three comments, the majority involve stylistic, formatting, or clarifying edits that can be accepted or resolved with minor language adjustments. These include standard definitional harmonization, cross-reference corrections, and certain typographical changes that do not affect the substantive allocation of rights and obligations. We have reviewed each of these non-material comments and will prepare a separate markup for client review reflecting our recommended dispositions. This memorandum does not address those non-material items.

However, eleven of WBC's comments raise material substantive issues that implicate VMS's regulatory compliance posture, risk tolerance, data governance standards, and commercial interests. These eleven issues require client instruction and, in most cases, will require further negotiation with WBC and Meridian before the DPA can be finalized.

This memorandum addresses each of the eleven material issues in order of significance. For each issue, we describe: (a) VMS's position as reflected in DPA v1.0; (b) Meridian's counter-position as set forth in the WBC Redline; (c) the legal and commercial implications of each position; and (d) recommended positions for VMS, including areas of potential compromise.

Note Regarding Pinehurst Cybersecurity Advisors LLC. VMS has separately engaged Pinehurst Cybersecurity Advisors LLC ("Pinehurst"), a Virginia-based cybersecurity consulting firm specializing in connected-vehicle and IoT environments, to conduct an independent security assessment of Meridian's data processing environment, including its infrastructure and sub-processing arrangements. As of the date of this memorandum, Pinehurst's preliminary findings report has not yet been delivered; based on our last communication with Pinehurst's engagement lead, delivery is anticipated within the next two to three weeks. Certain issues identified below — particularly those relating to sub-processor evaluation (Issue 2), audit rights (Issue 5), and the specificity of technical and organizational measures (Issue 8) — may warrant revisiting once Pinehurst's findings are available. We recommend that VMS take steps to expedite delivery of the Pinehurst report, as its findings may materially inform VMS's negotiation posture on these critical items.

Background Context. The DPA governs Meridian's processing of vehicle telemetry and in-cabin sensor data collected from approximately 800,000 opted-in vehicles enrolled in VMS's "Connected Insights" program. The data encompasses fourteen distinct categories of vehicle and environmental data, including but not limited to GPS/geolocation coordinates, seat occupancy sensor readings, tire pressure telemetry, ambient noise levels, windshield wiper activation data, headlight and taillight status, engine performance metrics, braking patterns, steering input data, battery voltage readings, HVAC system usage, fuel consumption data, airbag system status, and infotainment system interaction logs. At current enrollment levels, the Connected Insights program generates approximately 4.2 terabytes of raw telemetry data per day, transmitted from in-vehicle telematics control units to Meridian's processing infrastructure.

Two of the fourteen data categories — GPS/geolocation data and seat occupancy sensor data — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy (Data Governance Policy No. DG-2021-003, effective January 15, 2022, as amended July 1, 2022). This classification is based on the determination by VMS's Data Governance Committee that GPS/geolocation data and seat occupancy data, when combined with vehicle identification numbers ("VINs"), can be linked, directly or indirectly, to identifiable natural persons — specifically, vehicle owners and registered operators. GPS/geolocation data reveals the real-time and historical physical location of the vehicle and, by extension, the vehicle's driver or occupants. Seat occupancy data, when combined with GPS/geolocation and VIN data, can reveal the number and pattern of occupants at specific times and locations, raising additional privacy considerations.

Approximately 112,000 of the 800,000 opted-in vehicles — roughly fourteen percent — are registered in the State of California, which implicates VMS's compliance obligations under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA"). The CCPA/CPRA framework imposes specific requirements on businesses that share or disclose personal information with service providers and contractors, including contractual obligations regarding purpose limitation, data retention, and secondary use. In addition, VMS's obligations under the Michigan Identity Theft Protection Act (MCL 445.61 et seq.) and the federal Drivers' Privacy Protection Act ("DPPA") (18 U.S.C. § 2721 et seq.) are implicated to varying degrees by the issues discussed herein. We address the specific regulatory implications of each issue in the detailed analysis below.

II. Summary Table of Material Open Issues

The following table provides a high-level overview of each of the eleven material open issues, the relevant DPA provision, the positions of each party, and our priority classification. Detailed analysis follows in Part III.

III. Detailed Analysis of Each Material Open Issue

Issue 1: Data Retention Period (DPA v1.0, Section 7.3)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 7.3, provides that all raw vehicle telemetry data transmitted by VMS or collected by Meridian on VMS's behalf is subject to a ninety-day rolling deletion cycle. Specifically, after Meridian has completed its processing of raw telemetry data and delivered the resulting analytics outputs (predictive maintenance insights, driver behavior scores, and fleet optimization analytics) to VMS or to authorized third-party recipients, Meridian is required to irreversibly delete or anonymize all raw data within ninety calendar days of initial receipt. The ninety-day window was designed to provide Meridian with sufficient time to complete its initial processing, quality assurance, and output delivery activities while minimizing the period during which identifiable or re-identifiable raw data remains in Meridian's possession. Section 7.3 expressly prohibits retention of raw data beyond the ninety-day window for any purpose, including — and this language was deliberately included — machine-learning model training, algorithm refinement, or any other form of secondary processing.

This position reflects VMS's data minimization philosophy as codified in VMS's internal Data Governance Policy No. DG-2021-003, which requires that personal data and Sensitive Vehicle Data be retained for the minimum period necessary to accomplish the specified processing purpose and deleted promptly thereafter. The ninety-day period was calibrated in consultation with VMS's Connected Services engineering team as the maximum reasonable processing window for the data volumes involved.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline proposes substantial revisions to Section 7.3. Meridian seeks an eighteen-month retention period for raw data, replacing the ninety-day rolling deletion cycle. In support of this position, WBC's Comment No. 17 states that Meridian requires a longer retention window for three stated purposes: (i) machine-learning model training, which Meridian asserts requires access to large historical datasets to improve the accuracy and reliability of its predictive analytics models; (ii) algorithm validation, which Meridian states involves back-testing model outputs against historical raw data to verify performance; and (iii) longitudinal analysis, including seasonal driving pattern analysis, which Meridian argues requires data spanning at least twelve to eighteen months to capture annual cyclicality in vehicle usage patterns.

WBC's Redline also adds a new sub-clause to Section 7.3 that would permit Meridian to retain "pseudonymized" (but not fully anonymized) data for up to eighteen months after initial processing, subject to "reasonable technical safeguards" — a phrase that is not further defined in the Redline. The distinction between pseudonymized and fully anonymized data is significant, as discussed below.

C. Analysis. The eighteen-month retention window proposed by WBC substantially increases VMS's risk exposure across multiple dimensions.

Re-identification Risk. Even pseudonymized VIN-linked data can, under certain circumstances, be re-identified. Pseudonymization — the processing of personal data such that the data can no longer be attributed to a specific individual without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures — does not eliminate the risk that an attacker or unauthorized party could reverse the pseudonymization process and link the data back to identifiable individuals. In the context of GPS/geolocation data, even rudimentary analysis techniques (e.g., identifying a vehicle's "home" location based on overnight parking patterns) can re-identify a pseudonymized record with high probability. Seat occupancy data compounds this risk by revealing the presence and number of vehicle occupants at specific times and locations. Retaining pseudonymized Sensitive Vehicle Data for eighteen months — rather than ninety days — extends the window during which such data is vulnerable to re-identification by a factor of six.

CCPA/CPRA Implications. Data retention for eighteen months for a secondary purpose (model training and algorithm validation) that differs from the purpose disclosed to consumers at the time of data collection — namely, "Connected Insights" analytics — raises significant concerns under the CPRA's data minimization and purpose limitation principles. Under CPRA Section 1798.100(c), a business's collection, use, retention, and sharing of a consumer's personal information must be "reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed." If VMS's privacy notices to California consumers describe the purpose of data collection as generating predictive maintenance and driver behavior analytics, retaining raw data for eighteen months to facilitate Meridian's model-training activities may be viewed as inconsistent with the disclosed purpose. This could trigger additional disclosure obligations under CPRA Section 1798.100(a) with respect to the approximately 112,000 California data subjects. Moreover, the California Attorney General and, beginning July 1, 2023, the California Privacy Protection Agency may take the position that extended retention for model-training purposes requires a separate, affirmative consumer opt-in.

Michigan Identity Theft Protection Act. While the Michigan Identity Theft Protection Act (MCL 445.61 et seq.) does not prescribe specific data retention limits, the statute requires reasonable security measures for personal information and imposes notification obligations in the event of a breach. Maintaining identifiable or re-identifiable data for extended periods necessarily increases VMS's and Meridian's breach exposure surface — i.e., the volume of data that could be compromised in any single breach event — and consequently increases the potential scope and cost of breach notification obligations.

Drivers' Privacy Protection Act. The DPPA (18 U.S.C. § 2721 et seq.) restricts the disclosure and use of "personal information" obtained in connection with a motor vehicle record, which includes information that identifies an individual in connection with a VIN. To the extent that Meridian retains VIN-linked data — even in pseudonymized form — for model-training purposes, such retention may implicate the DPPA's "permissible use" restrictions, particularly if the model-training purpose is not covered by the enumerated permissible uses set forth in 18 U.S.C. § 2721(b). Unauthorized disclosure or use of DPPA-protected information carries statutory damages of not less than $2,500 per violation (18 U.S.C. § 2724(b)), which, applied to 800,000 vehicles, could result in catastrophic aggregate exposure.

Commercial Context. The commercial partnership Letter of Intent executed by the parties on August 5, 2022 (the "LOI") does not expressly contemplate Meridian retaining VMS raw data for model-training purposes. The LOI describes Meridian's role as a data processor generating analytics outputs for VMS and developing derivative analytics products for third-party sale, subject to a royalty arrangement. Meridian's request to retain raw data for eighteen months for model-training and algorithm validation purposes appears to represent an expansion of scope beyond what was commercially agreed. If Meridian's model-training activities are intended to improve its platform capabilities in ways that benefit Meridian's other customers — potentially including VMS's competitors — this expansion has commercial implications that extend beyond the DPA and into the broader partnership arrangement.

D. Recommendation. We recommend that VMS maintain the ninety-day rolling deletion requirement for raw data, with particular emphasis on Sensitive Vehicle Data categories (GPS/geolocation and seat occupancy). The risk profile of eighteen-month retention of pseudonymized Sensitive Vehicle Data is incompatible with VMS's data governance policy and its CCPA/CPRA compliance posture.

As a potential compromise, VMS could agree to permit Meridian to retain fully anonymized and aggregated data — with irreversible removal of VINs, device identifiers, and any re-identification keys — for a period not exceeding twelve months after the completion of initial processing, solely for the purpose of machine-learning model training and algorithm validation. This compromise would be conditioned on: (a) VMS's prior written approval of the anonymization methodology employed by Meridian, including an assessment of whether the anonymization achieves true irreversibility under applicable standards; (b) an express covenant by Meridian not to attempt re-identification of any anonymized data; (c) annual certification by an authorized officer of Meridian confirming compliance with the anonymization requirements and the covenant against re-identification; and (d) VMS's right to audit compliance with the anonymization requirements (consistent with the audit rights discussed under Issue 5).

This approach preserves VMS's data governance position and regulatory compliance while acknowledging Meridian's legitimate commercial interest in model improvement. The distinction between pseudonymized data (which remains within the scope of data protection regulations and the DPA's protections) and truly anonymized data (which, if properly anonymized, falls outside the scope of most data protection statutes) is critical and should be clearly reflected in the DPA.

We note that the adequacy of any proposed anonymization methodology should ideally be validated by Pinehurst as part of its security assessment. We recommend raising this point with Pinehurst and requesting that their assessment scope include an evaluation of Meridian's anonymization capabilities and processes.

Issue 2: Sub-Processor Approval Rights (DPA v1.0, Section 8)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 8, requires Meridian to obtain the prior written consent of VMS before engaging any sub-processor to perform any portion of the data processing activities contemplated by the DPA. This prior-consent model reflects VMS's determination that, given the sensitivity and volume of the data involved, VMS should retain affirmative control over the identity and qualifications of any entity that processes VMS data.

DPA v1.0 includes Annex C, which identifies Cloudvault Infrastructure, Inc. ("Cloudvault") as the sole approved sub-processor as of the effective date. Cloudvault operates its "AutoCloud" platform, a cloud infrastructure environment designed for automotive and IoT data workloads, with data centers located in Reno, Nevada, and Columbus, Ohio. Meridian's existing master services agreement with Cloudvault was executed on March 1, 2021, and governs the infrastructure services that Cloudvault provides to Meridian for the storage and processing of client data, including VMS data. The Cloudvault MSA is currently in its initial three-year term and is set to expire on February 28, 2024, subject to renewal.

Section 8 also requires that Meridian impose on any approved sub-processor, through a written sub-processing agreement, data protection obligations that are substantively equivalent to those imposed on Meridian under the DPA. Meridian remains fully liable to VMS for the acts and omissions of its sub-processors as if such acts and omissions were Meridian's own.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline proposes replacing the prior-written-consent model with a general authorization model. Under Meridian's proposed approach, VMS would provide blanket consent to Meridian's engagement of sub-processors, subject to the following safeguards:

(a) Meridian would maintain and regularly update a list of all sub-processors, including the identity, location, and processing activities of each sub-processor, and make such list available to VMS upon request;

(b) Meridian would provide VMS with thirty calendar days' prior written notice before engaging any new sub-processor or making a material change to an existing sub-processor's processing activities;

(c) VMS would have the right to object to a proposed new sub-processor within the thirty-day notice window, provided that such objection is based on "reasonable grounds" relating to data protection concerns; and

(d) If VMS objects and the parties are unable to resolve the dispute through good-faith discussions within a timeframe to be agreed, a dispute resolution mechanism (to be defined) would apply.

WBC's Comment No. 22 states that the general authorization model is "consistent with GDPR Article 28(2) and industry practice" and argues that a strict prior-consent model is "operationally impractical" in a high-velocity data processing context where Meridian may need to engage specialized sub-processors on short notice to support data processing activities.

C. Analysis. Justification for Tight Control. Given the sensitivity of the GPS/geolocation and seat occupancy data, the volume of data involved (approximately 4.2 terabytes per day from 800,000 vehicles), and the regulatory obligations that attach to this data under CCPA/CPRA, DPPA, and Michigan law, VMS has a strong justification for maintaining tight control over the identity and qualifications of entities that access or process VMS data. Each new sub-processor introduces an additional vector for potential data breach, unauthorized access, or non-compliant processing, and VMS — as the data controller — bears the regulatory and reputational consequences of any sub-processor failure.

Burden Shifting. The general authorization model proposed by WBC effectively shifts the default from "consent required" (processor must obtain affirmative approval) to "consent presumed unless objection raised" (controller must monitor, evaluate, and affirmatively object). This places the burden on VMS to continuously monitor Meridian's sub-processor list, evaluate each proposed sub-processor within a thirty-day window, and raise timely objections — a burden that, in practice, requires VMS to maintain ongoing due diligence capabilities. While this model is common in many commercial data processing arrangements, it is less appropriate where the data involved is of the sensitivity and volume at issue here.

Operational Considerations. We acknowledge that a strict prior-written-consent model can, in certain circumstances, create operational friction. If Meridian needs to migrate data to a new infrastructure provider on short notice (e.g., due to a service outage or capacity constraint at Cloudvault), the requirement to obtain VMS's prior written consent could delay Meridian's ability to respond. However, this risk can be mitigated through advance planning and by maintaining a pre-approved roster of contingency sub-processors.

Cloudvault Assessment. As noted above, Cloudvault's specific suitability as a sub-processor has not yet been independently verified. Pinehurst's pending security assessment is expected to include an evaluation of Cloudvault's security posture, including its physical and logical access controls, encryption practices, incident response capabilities, and data isolation measures. Until the Pinehurst report is received, VMS's approval of Cloudvault as the sole sub-processor should be regarded as provisional.

Flow-Down Obligations. Regardless of the approval model ultimately adopted, the DPA must require Meridian to impose substantially identical data protection obligations on all sub-processors through written sub-processing agreements. Both parties appear to agree on this point in principle. The key question is not whether sub-processors must comply with equivalent obligations, but rather who controls the decision of whether to engage a particular sub-processor in the first instance.

D. Recommendation. We recommend a hybrid approach that differentiates between sub-processors that will access or process Sensitive Vehicle Data and those that will not:

(a) Sensitive Vehicle Data Sub-Processors. Maintain the prior-written-consent requirement for any sub-processor that will access, store, or process Sensitive Vehicle Data (i.e., GPS/geolocation data and seat occupancy data, whether alone or in combination with VINs or other identifiers). This ensures that VMS retains affirmative control over the most sensitive categories of data.

(b) Non-Sensitive Data Sub-Processors. For sub-processors that will process only non-sensitive data categories (i.e., the twelve categories other than GPS/geolocation and seat occupancy), accept the general authorization model with a thirty-day objection window, subject to the following conditions:

(i) Meridian must furnish VMS with adequate due diligence information about the proposed sub-processor, including the sub-processor's identity, jurisdiction of incorporation and principal operations, relevant certifications (e.g., SOC 2, ISO 27001), a description of the processing activities to be performed, the data categories involved, and a summary of the sub-processor's security posture;

(ii) VMS's objection may be based on "reasonable data protection grounds," a standard that is broader than WBC's proposed "reasonable grounds" formulation and that expressly encompasses concerns relating to the sub-processor's security posture, jurisdiction, regulatory compliance history, and data governance practices — not limited to material security deficiencies;

(iii) If VMS objects and the parties cannot resolve the dispute within fifteen business days through good-faith escalation to senior representatives, VMS retains the right to terminate the DPA for convenience without penalty or early termination fee; and

(iv) Meridian must, in all cases, execute a written sub-processing agreement with each sub-processor imposing data protection obligations substantively equivalent to those imposed on Meridian under the DPA, and must provide copies of such sub-processing agreements to VMS upon request.

We further recommend that VMS's final position on the approval of Cloudvault as a sub-processor be reserved pending receipt and review of the Pinehurst security assessment. In the interim, the DPA should reflect Cloudvault's approval as provisional and subject to confirmation following the completion of VMS's independent security evaluation.

Issue 3: Breach Notification Timeline (DPA v1.0, Section 10.1)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 10.1, requires Meridian to notify VMS within twenty-four hours of Meridian "becoming aware" of any personal data breach. The term "personal data breach" is defined broadly in Section 1.12 of DPA v1.0 to include any unauthorized access to, acquisition of, disclosure of, use of, or loss of personal data, including Sensitive Vehicle Data, whether or not such incident results in actual harm to any data subject. The twenty-four-hour notification window was designed to ensure that VMS receives prompt notification of any security incident affecting VMS data, enabling VMS to initiate its own incident response procedures, assess regulatory notification obligations, and take steps to mitigate potential harm to data subjects.

Section 10.1 further requires that the initial notification include, at minimum: the nature and category of the breach, the data categories and approximate number of data records affected, the identity of any sub-processor involved, the measures taken or proposed to address the breach, and a contact person at Meridian for further inquiries. Meridian is required to cooperate fully with VMS's investigation and remediation efforts.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline proposes extending the notification window from twenty-four hours to seventy-two hours. WBC's Comment No. 31 offers three justifications for this change:

(a) GDPR Alignment. WBC states that a seventy-two-hour notification period is consistent with the standard established by Article 33 of the General Data Protection Regulation ("GDPR"), which requires a controller to notify its supervisory authority of a personal data breach within seventy-two hours of becoming aware of it.

(b) Quality of Information. WBC argues that twenty-four hours is insufficient for Meridian to conduct a meaningful preliminary assessment of the breach before notifying VMS, and that requiring notification before Meridian has a basic understanding of the scope and nature of the incident could result in the delivery of inaccurate or incomplete information that undermines effective incident response.

(c) Premature Notification Risks. WBC contends that premature notification without adequate information could "trigger unnecessary alarm and misdirected response efforts," consuming VMS's incident response resources on false positives or incidents that turn out to be less significant than initially feared.

C. Analysis. GDPR Article 33 Distinction. WBC's reliance on the GDPR seventy-two-hour standard is somewhat misleading. GDPR Article 33(1) establishes the seventy-two-hour window for notification by a controller to a supervisory authority — i.e., one leg of the notification chain. GDPR Article 33(2), which governs processor-to-controller notification, requires the processor to notify the controller "without undue delay" after becoming aware of a personal data breach, without specifying a fixed time period. In practice, many GDPR-compliant data processing agreements use time frames ranging from twenty-four to forty-eight hours for processor-to-controller notification, precisely because the controller needs sufficient time after receiving the processor's notification to prepare its own seventy-two-hour notification to the supervisory authority. If Meridian takes the full seventy-two hours to notify VMS, VMS may have as little as zero hours to prepare and submit its own regulatory notifications — an untenable position.

U.S. Regulatory Landscape. No U.S. federal statute prescribes a specific processor-to-controller notification period. However, state breach notification laws — including Michigan's Identity Theft Protection Act — impose notification obligations on covered entities that begin to run upon discovery or awareness of a breach. Michigan's statute requires notification to affected individuals "without unreasonable delay," though it permits delay for law enforcement purposes. The California breach notification statute (Cal. Civ. Code § 1798.82) requires notification "in the most expedient time possible and without unreasonable delay." VMS's ability to comply with these state-law obligations depends on receiving prompt notification from Meridian; a seventy-two-hour delay in processor notification could consume a significant portion of VMS's available response time before the state notification clock has even begun to run from VMS's perspective.

Data Sensitivity and Volume. The potential consequences of a breach involving GPS/geolocation data and seat occupancy data linked to VINs for up to 800,000 vehicles are substantial. GPS/geolocation data can reveal the real-time or historical location of identifiable individuals, creating risks of physical safety, stalking, and surveillance harm that escalate with each hour of delay. Rapid notification is essential to enable VMS to implement containment measures, notify affected individuals if warranted, and engage with law enforcement if the breach involves criminal activity.

Industry Practice. Practice in the automotive and connected-vehicle sector varies, but several major OEM data processing agreements known to us impose twenty-four-hour notification requirements on processors. The twenty-four-hour standard is not unusual in arrangements involving high-volume, high-sensitivity data processing.

D. Recommendation. We recommend maintaining the twenty-four-hour notification requirement, but we suggest proposing a two-tier notification approach that may address Meridian's legitimate concern about the quality of information available in the first twenty-four hours:

(a) Initial Notification (24 Hours). Meridian must provide initial notification to VMS within twenty-four hours of becoming aware of any personal data breach. The initial notification must include, at minimum: (i) a description of the nature and known or suspected scope of the breach; (ii) the categories of data affected (and specifically whether Sensitive Vehicle Data is involved); (iii) an approximation of the number of data records affected; (iv) a summary of initial remedial actions taken or proposed; and (v) the identity and contact information of Meridian's designated incident response lead.

(b) Detailed Supplemental Report (72 Hours). Meridian must provide a comprehensive supplemental report within seventy-two hours of becoming aware of the breach, including: (i) a more detailed root cause analysis; (ii) a full scope assessment, including affected systems, sub-processors, and data subjects; (iii) a detailed remediation plan with timelines; (iv) an assessment of the risk of harm to affected data subjects; and (v) any additional information reasonably necessary for VMS to evaluate its own regulatory notification obligations.

The DPA should include an express provision that the initial notification obligation shall not be delayed pending completion of a full investigation. This provision is critical to prevent Meridian from invoking the "quality of information" concern as a basis for delaying initial notification beyond the twenty-four-hour window.

We believe this two-tier approach preserves VMS's ability to initiate timely incident response and regulatory notification while acknowledging Meridian's practical concern that a comprehensive root cause analysis and full scope assessment cannot reasonably be completed within twenty-four hours. This structure is consistent with emerging best practices in processor-to-controller breach notification frameworks and should be defensible to WBC.

Issue 4: Liability Cap for Data Breaches and Unauthorized Processing (DPA v1.0, Section 12)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 12, provides that Meridian's liability in connection with data breaches and any unauthorized processing of VMS data, including Sensitive Vehicle Data, is uncapped. This means that there is no contractual ceiling on the aggregate amount of damages that VMS may recover from Meridian for losses arising from such incidents. VMS's rationale for this position is straightforward: given the potential magnitude of regulatory fines, class-action litigation exposure, reputational harm, customer churn, regulatory remediation costs, and the sheer volume and sensitivity of the data involved, capping Meridian's liability would inappropriately shift risk from the processor — who has operational control over the data processing environment — to the controller, who bears the external-facing regulatory and reputational consequences of any breach.

Section 12 does not address the broader liability framework for non-data-protection claims under the DPA (e.g., breach of commercial terms), which is governed by the master services agreement being negotiated in parallel.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline proposes a liability cap of fifteen million dollars ($15,000,000) for all claims arising under the DPA, inclusive of claims for data breaches and unauthorized processing. WBC's Comment No. 37 characterizes the fifteen-million-dollar cap as "generous" relative to market norms, noting that the cap represents approximately 2.31 times the annual license fee of $6.5 million that Meridian pays to VMS for access to VMS's Connected Insights data. WBC further argues that unlimited liability provisions are "commercially unreasonable" for a company of Meridian's size and may be uninsurable, creating a situation where the unlimited liability provision provides an illusory remedy because Meridian could not satisfy an uncapped judgment.

C. Analysis. Magnitude of Potential Exposure. The fifteen-million-dollar cap must be evaluated against VMS's potential exposure in the event of a breach involving GPS/geolocation and seat occupancy data linked to VINs for up to 800,000 vehicles. A non-exhaustive summary of potential exposure categories includes:

• CCPA/CPRA statutory damages: Up to $7,500 per intentional violation for the approximately 112,000 California data subjects, potentially resulting in aggregate statutory damages exposure in excess of $840 million in a worst-case scenario. Even in a scenario involving a fraction of affected California consumers, the potential exposure far exceeds $15 million.

• DPPA statutory damages: Minimum of $2,500 per violation under 18 U.S.C. § 2724(b), which could be multiplied across the 800,000-vehicle population if VIN-linked data is improperly disclosed or used.

• Regulatory enforcement actions: The California Attorney General and, beginning July 1, 2023, the California Privacy Protection Agency have authority to impose administrative fines for CCPA/CPRA violations. State attorneys general in other jurisdictions where vehicles are registered may also take action.

• Class-action litigation: Consumer class actions alleging invasion of privacy, negligence, or violations of state consumer protection statutes are a realistic possibility in the event of a breach involving location data.

• Reputational harm and customer attrition: VMS's Connected Insights program depends on consumer trust and opt-in participation. A significant data breach could lead to a material decline in opt-in rates, undermining the commercial viability of the program.

• Incident response and remediation costs: Forensic investigation, legal counsel, notification costs, credit monitoring, call center operations, and public relations efforts can be substantial.

Against this backdrop, a fifteen-million-dollar cap is plainly inadequate to protect VMS's interests.

Meridian's Perspective. At the same time, we recognize that Meridian is a company with approximately $78 million in annual recurring revenue and approximately 340 employees. An uncapped liability provision, in the abstract, exposes Meridian to the theoretical risk of a judgment that exceeds its ability to pay — which, as WBC notes, could render the provision effectively illusory. Moreover, unlimited-liability provisions may be uninsurable or may be excluded from the scope of Meridian's commercial general liability and cyber-liability insurance policies, which is a legitimate commercial concern. From a negotiation dynamics perspective, Meridian's counsel will likely take a firm position on some form of liability limitation, and an outright refusal to discuss any form of cap may impede progress on other issues.

Contract Value Context. The total base-term contract value is $19.5 million ($6.5 million annual license fee × three-year base term), plus royalties on derivative analytics products sold to third parties (at a rate of 3.5%) and potential renewal-term fees. A fifteen-million-dollar cap would represent approximately 77% of the base-term value — or approximately 2.31 times a single year's fee, as WBC notes. While multiples of annual fees are a common benchmark in commercial contracts, such benchmarks are not well-suited to data processing arrangements where the potential downside exposure bears no relation to the fee structure.

PE Sponsor Considerations. We note that Northgate Capital Partners holds a 72% equity stake in VMS and manages approximately $2.8 billion in assets under management. Northgate may have portfolio-level views on acceptable risk allocation in data processing arrangements that should inform VMS's negotiation posture. We recommend that Thomas Langford consult with Northgate's portfolio operations team on this issue if he has not already done so.

D. Recommendation. We recommend that VMS resist a flat cap and instead propose a tiered liability structure that differentiates based on the nature and cause of the loss:

(a) Tier 1 — Uncapped Liability. Claims arising from: (i) unauthorized processing of VMS data (i.e., processing for purposes not authorized by the DPA); (ii) willful misconduct or gross negligence by Meridian or its personnel; (iii) data breaches caused by Meridian's failure to implement and maintain the technical and organizational measures specified in Annex B; and (iv) breaches of Meridian's confidentiality obligations. These categories represent scenarios where Meridian has failed to discharge fundamental obligations within its control, and VMS should not bear the risk of such failures.

(b) Tier 2 — Capped Liability. Claims arising from data breaches that occur despite Meridian's compliance with the agreed technical and organizational measures in Annex B — i.e., "no-fault" breaches resulting from sophisticated attacks that overcome compliant security measures. For these claims, VMS could agree to a cap of the greater of (x) fifteen million dollars ($15,000,000) or (y) two times the aggregate fees paid or payable under the first twelve months of the partnership term (approximately $13,000,000), resulting in an effective cap of $15 million under current fee levels but providing upward adjustment if fees increase.

As an alternative or additional measure, we recommend requiring Meridian to maintain cyber-liability insurance coverage with minimum limits of not less than ten million dollars ($10,000,000) per occurrence and in the aggregate, with VMS named as an additional insured. Such insurance coverage would partially backstop a negotiated cap and provide Meridian with an insurable mechanism for addressing its exposure concerns. The DPA should require Meridian to provide VMS with evidence of coverage prior to the effective date and upon each policy renewal during the term, and should prohibit Meridian from materially reducing its coverage without VMS's prior written consent.

This tiered approach protects VMS against the most consequential and preventable breach scenarios while providing Meridian with some measure of liability predictability for incidents that are genuinely beyond Meridian's control.

Issue 5: Audit Rights (DPA v1.0, Section 11)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 11, grants VMS or its designated auditor — including third-party auditors such as Pinehurst — the right to conduct on-site audits of Meridian's data processing facilities, including the facilities of any sub-processor processing VMS data. Section 11 provides for unlimited audit frequency, with a minimum of ten business days' prior written notice to Meridian before each audit. Audits are conducted at VMS's expense and may encompass the review of physical and logical security controls, processing records and logs, sub-processor agreements, data flow documentation, incident response plans, employee training records, and general compliance with Meridian's obligations under the DPA. The unlimited audit right was included to ensure that VMS has comprehensive visibility into Meridian's processing environment and can respond promptly to emerging risks.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline proposes significant restrictions on VMS's audit rights. Specifically, Meridian seeks the following modifications:

(a) Audits limited to once per twelve-month period — i.e., one annual audit;

(b) A minimum of thirty calendar days' prior written notice before any audit, replacing the ten-business-day notice period in DPA v1.0;

(c) A requirement that audits be conducted during regular business hours and not unreasonably interfere with Meridian's operations;

(d) A cost-sharing provision under which VMS bears audit costs up to $25,000 per audit, with Meridian bearing any costs in excess of $25,000; and

(e) A provision permitting Meridian to satisfy its audit obligations by providing SOC 2 Type II reports or equivalent third-party certifications in lieu of on-site audits, at Meridian's election.

WBC's Comment No. 35 argues that unlimited audit rights impose an "unreasonable operational burden" on Meridian and are "inconsistent with the confidentiality and security" of Meridian's multi-tenant processing environment, where auditors from one customer could potentially access areas containing another customer's data.

C. Analysis. Practical Value vs. Operational Burden. We acknowledge that unlimited audit rights, while valuable as a contractual tool, may be impractical to exercise at high frequency. The cost and personnel commitment required to conduct comprehensive on-site audits of a sophisticated data processing environment are substantial, and VMS is unlikely to conduct more than one or two audits per year in practice. However, the contractual right to conduct ad hoc audits in response to specific triggering events — such as a security incident, a material change in sub-processors, a regulatory inquiry, or the receipt of adverse findings from Pinehurst — is critically important and should not be surrendered.

Annual Frequency Limitation. Limiting VMS to a single annual audit could leave VMS unable to respond to emerging risks in real time. If, for example, Meridian proposes to engage a new sub-processor to process Sensitive Vehicle Data (and VMS consents to such engagement), VMS should have the right to audit the new sub-processor's environment before or shortly after processing begins — not twelve months later. Similarly, if a security incident occurs at Meridian or Cloudvault, VMS needs the ability to conduct an immediate follow-up audit to assess the adequacy of remediation.

$25,000 Cost Cap. The proposed $25,000 cost cap effectively limits the scope and depth of any single audit. A comprehensive on-site audit of a data processing environment handling 4.2 terabytes per day, conducted by qualified cybersecurity professionals, could reasonably be expected to cost in excess of $25,000. The cost-sharing mechanism as proposed could incentivize Meridian to insist on narrowly scoped reviews, limit auditor access, or challenge the scope of the audit as "exceeding the budget."

SOC 2 Type II Reports. SOC 2 Type II reports are a useful component of a comprehensive compliance monitoring program, but they are not an adequate substitute for on-site audit rights. SOC 2 reports are backward-looking — they attest to the design and operating effectiveness of controls during a defined observation period (typically six to twelve months). They do not capture real-time compliance, emerging vulnerabilities, or changes in the processing environment that postdate the observation period. Moreover, SOC 2 reports are prepared to the scope and criteria selected by the service organization, which may not align with VMS's specific data protection concerns or the requirements of the DPA. Finally, SOC 2 reports do not assess compliance with the specific contractual obligations of the DPA, such as the data retention, purpose limitation, and sub-processor flow-down requirements.

Pinehurst Assessment. The scope and findings of Pinehurst's pending security assessment may inform the appropriate frequency, scope, and methodology of ongoing audits. If Pinehurst identifies material deficiencies in Meridian's security posture, VMS may need to conduct follow-up audits on an accelerated timeline.

D. Recommendation. We recommend the following compromise structure:

(a) Scheduled Annual Audit. One scheduled audit per twelve-month period, with a minimum of twenty business days' prior written notice (splitting the difference between VMS's proposed ten business days and WBC's proposed thirty calendar days). The scheduled audit may be conducted on-site at Meridian's primary processing facility and at any sub-processor facility processing VMS data.

(b) Ad Hoc Audit Right. The right to conduct one additional ad hoc audit per twelve-month period, triggered by any of the following events: (i) a material security incident or personal data breach (whether at Meridian or any sub-processor); (ii) a material change in sub-processors, including the engagement of a new sub-processor to process Sensitive Vehicle Data; (iii) a regulatory inquiry, investigation, or enforcement action directed at VMS or Meridian relating to VMS data; or (iv) Pinehurst findings (or the findings of any subsequent security assessment) identifying material deficiencies in Meridian's security posture. Ad hoc audits require a minimum of ten business days' prior written notice.

(c) Cost Allocation. VMS bears reasonable audit costs. We recommend eliminating the $25,000 cost cap, which arbitrarily constrains audit scope. As an alternative, VMS could agree to bear all direct costs of audits conducted during regular business hours, with Meridian bearing incremental costs only if Meridian requests that audits be conducted outside regular business hours.

(d) SOC 2 Reports as Supplement. Meridian may provide SOC 2 Type II reports (or equivalent third-party certifications) as a supplement to, but not a substitute for, on-site audit rights. SOC 2 reports should be provided to VMS promptly upon receipt and reviewed by VMS as part of its ongoing due diligence, but receipt of a SOC 2 report does not limit or waive VMS's right to conduct on-site audits.

(e) Sub-Processor Audit Rights. Audit rights extend expressly to Cloudvault and any other sub-processor facility processing VMS data, consistent with VMS's responsibility as data controller to oversee the entire processing chain.

(f) Multi-Tenant Protections. We are willing to accept reasonable confidentiality and access-control measures to protect Meridian's other customers' data during on-site audits, provided that such measures do not prevent VMS's auditors from accessing all systems, records, and facilities relevant to VMS data processing.

We recommend revisiting this issue once Pinehurst's findings are available, as the findings may support a more or less expansive audit rights framework depending on the identified risk profile.

Issue 6: Definition of "Personal Data" / Scope of Protected Data (DPA v1.0, Section 1)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 1.8, defines "Personal Data" broadly to encompass any data that, alone or in combination with other information (including VINs, device identifiers, or other vehicle-specific identifiers), can be used to identify, contact, or locate a natural person. The definition expressly includes GPS/geolocation data and seat occupancy data as subcategories of "Sensitive Vehicle Data" when such data is linked or reasonably linkable to VINs or other identifiers that are associated with identified or identifiable natural persons. The definition is intentionally aligned with the broadest applicable statutory definition — specifically, the CCPA/CPRA's definition of "personal information," which encompasses information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."

The rationale for this broad definition is twofold. First, it ensures that the DPA's protections attach to all data that could, under any applicable statute, be classified as personal data or personal information, thereby avoiding a gap between VMS's regulatory obligations and its contractual protections. Second, it reflects VMS's internal data governance policy, which takes a conservative, "protect everything that could be personal" approach to data classification.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline proposes narrowing the definition of "Personal Data" in two significant respects:

(a) "Directly and Currently Linked" Standard. WBC proposes replacing VMS's "linkable" standard with a narrower standard that limits "Personal Data" to data that is "directly and currently linked to an identified individual." Under this formulation, data that is merely "linkable" — i.e., data that could be linked to an individual through the use of additional information but is not currently so linked — would fall outside the scope of the DPA's protections. WBC argues that many of the fourteen data categories (e.g., tire pressure readings, ambient noise levels, windshield wiper activation events, headlight and taillight status) are not personal data even if technically associated with a VIN, because they do not directly identify any individual.

(b) Pseudonymized Data Carve-Out. WBC proposes a carve-out for data that has been "pseudonymized," defined as data processed in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information. Under Meridian's proposal, pseudonymized data would not be treated as "Personal Data" for purposes of the DPA, effectively exempting such data from the DPA's retention, deletion, purpose limitation, and security requirements.

C. Analysis. CCPA/CPRA Alignment. Under the CCPA, as amended by the CPRA, "personal information" is defined as information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v)(1). This definition is intentionally broad and encompasses data that is "linkable," not merely data that is currently linked. Adopting Meridian's narrower "directly and currently linked" standard would create a gap between VMS's CCPA/CPRA obligations (which attach to linkable data) and the DPA's protections (which, under Meridian's proposal, would not). This gap could leave VMS contractually unprotected with respect to data that is nonetheless subject to regulatory requirements.

VMS Internal Data Governance Policy. VMS's Data Governance Policy No. DG-2021-003 classifies GPS/geolocation data and seat occupancy data as "Sensitive Vehicle Data" specifically because of their linkability to VINs. Adopting a DPA definition that excludes linkable data would create an internal inconsistency between VMS's data governance framework and its contractual protections, potentially undermining VMS's ability to demonstrate a coherent and consistent data protection program to regulators and auditors.

DPPA Implications. DPPA protections attach to "personal information" obtained from motor vehicle records, which by definition includes VINs and information associated with VINs. If VINs are transmitted to Meridian alongside telemetry data — which they are, in the current data flow architecture — the DPPA's protections arguably extend to all VIN-associated data, regardless of whether the data is "directly and currently linked" to an identified individual. Narrowing the DPA definition could leave VMS without contractual remedies for DPPA violations involving VIN-associated data that Meridian does not consider "Personal Data" under the narrowed definition.

Pseudonymization vs. Anonymization. Pseudonymization is not anonymization. Pseudonymized data, by definition, can be re-identified with the use of additional information. Under the CCPA/CPRA, pseudonymized data that is "reasonably capable of being associated with" a consumer remains personal information. The GDPR similarly treats pseudonymized data as personal data (Recital 26). Excluding pseudonymized data from the DPA's protections would be inconsistent with both the CCPA/CPRA and the GDPR and would significantly reduce the scope of the DPA's data protection framework at a time when VMS is transmitting VIN-linked telemetry data to Meridian.

Practical Impact on Non-Sensitive Data Categories. We acknowledge Meridian's point that some of the fourteen data categories — such as tire pressure readings, ambient noise levels, and windshield wiper activation events — may appear, in isolation, to lack personal data characteristics. However, when these data elements are transmitted alongside VINs and combined with GPS/geolocation data, they become part of a comprehensive profile of a vehicle's movements, environment, and usage patterns that is clearly "reasonably capable of being associated with" an identifiable individual. The protective scope of the DPA should not depend on whether individual data elements, viewed in isolation, appear personally identifying; it should reflect the reality of how the data is collected, transmitted, and processed as an integrated dataset.

D. Recommendation. We recommend that VMS maintain its broad "linkable" definition of Personal Data, consistent with the CCPA/CPRA standard and VMS's internal data governance policy. We further recommend rejecting the carve-out for pseudonymized data, which is inconsistent with applicable law and would create a significant gap in VMS's contractual protections.

As a potential area of compromise, VMS could agree to classify the fourteen data categories into tiers for purposes of applying differentiated security, access control, and retention obligations:

• Tier 1 — Sensitive Vehicle Data: GPS/geolocation data and seat occupancy data. Subject to the highest level of protection under the DPA, including the strictest retention, access control, encryption, and purpose limitation requirements.

• Tier 2 — Standard Vehicle Data: All remaining twelve data categories (tire pressure, ambient noise levels, windshield wiper activation, headlight/taillight status, engine performance metrics, braking patterns, steering input data, battery voltage readings, HVAC system usage, fuel consumption data, airbag system status, and infotainment system interaction logs). Subject to the standard data protection obligations under the DPA, which may be somewhat less restrictive than Tier 1 obligations in certain respects (e.g., access controls, retention review frequency).

Critically, however, all fourteen data categories would remain within the definition of "Personal Data" for definitional and jurisdictional purposes. The tiered approach addresses Meridian's concern that undifferentiated application of the highest security standards to all data categories may be operationally burdensome, while preserving VMS's position that all VIN-linked telemetry data is personal data and must be subject to the DPA's protections.

Issue 7: Data Return and Destruction Obligations upon Termination (DPA v1.0, Section 14)

A. VMS Position (DPA v1.0)

DPA v1.0, Section 14, provides that upon termination or expiration of the DPA (for any reason), Meridian must, at VMS's election, either: (a) return all VMS data to VMS in a machine-readable format specified by VMS, within thirty calendar days of the effective date of termination or expiration; or (b) irreversibly destroy all VMS data and provide a written certification of destruction, signed by an authorized officer of Meridian, within thirty calendar days. Section 14 expressly prohibits Meridian from retaining any copies, backups, or derivatives of VMS data following the completion of the return or destruction process.

B. Meridian/WBC Position (DPA v2.0 Redline)

WBC's Redline accepts the general framework of Section 14 but proposes three modifications:

(a) Extended Timeline. Meridian proposes a ninety-day period (rather than thirty days) for the completion of data return or destruction activities.

(b) Legal-Hold Exception. Meridian seeks the right to retain VMS data to the extent required by applicable law or regulation — for example, where Meridian is subject to a litigation hold, regulatory preservation obligation, or tax record-keeping requirement. Under Meridian's proposal, any data retained pursuant to this exception would remain subject to the DPA's confidentiality and data protection obligations for as long as it is retained.

(c) Derived Analytics / Model Parameters Exemption. This is the most significant of the three proposed modifications. Meridian proposes exempting "derived analytics" and "model parameters" from the return/destruction obligation, on the basis that these constitute Meridian's proprietary intellectual property and do not constitute "VMS data" within the meaning of the DPA. WBC's Comment No. 43 states that machine-learning model weights, trained parameters, and statistical aggregations generated by Meridian's processing of VMS data are "Meridian's work product, developed using Meridian's proprietary algorithms and infrastructure," and that requiring their deletion would "destroy Meridian's core intellectual property."

C. Analysis. Extended Timeline. A ninety-day return or destruction period is excessive for a sophisticated data processor with established data management capabilities. Meridian processes 4.2 terabytes of data per day; it should have the technical infrastructure and operational processes nec

MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
November 4, 2022
TO: Rachel Bernstein, Partner, Privacy & Data Security Practice, Calderwood & Harkness LLP Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp.
FROM: Alan Burke, Senior Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP Sara Hendricks, Associate, Privacy & Data Security Practice, Calderwood & Harkness LLP
RE: Analysis of Material Open Issues — Whitfield, Barrow & Crane LLP Redline of Data Processing Agreement v2.0 (Vantage Mobility Systems Corp. / Meridian Telematics Solutions, Inc.)
MATTER NO.: 1007-00007
COPIES: Kevin Ostrowski (for billing file); Thomas Langford, General Counsel, Vantage Mobility Systems Corp.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the eleven material open issues arising from the redlined Data Processing Agreement version 2.0 ("DPA v2.0" or the "Redline") returned by Whitfield, Barrow & Crane LLP ("WBC"), outside counsel to Meridian Telematics Solutions, Inc. ("Meridian"), on October 21, 2022. The purpose of this memorandum is to provide Vantage Mobility Systems Corp. ("VMS") and its privacy leadership with a comprehensive assessment of each material issue, together with recommended negotiation positions and areas of potential compromise, in advance of the next round of negotiations with WBC.
By way of background, Calderwood & Harkness transmitted VMS's initial draft Data Processing Agreement version 1.0 ("DPA v1.0") to WBC on October 7, 2022. DPA v1.0 comprises forty-seven pages, including the main body of the agreement and three annexes (Annex A — Description of Processing Activities; Annex B — Technical and Organizational Measures; and Annex C — Approved Sub-Processors). WBC's Redline, received on October 21, contains sixty-three substantive comments and proposed revisions to DPA v1.0.
Of the sixty-three comments, the majority involve stylistic, formatting, or clarifying edits that can be accepted or resolved with minor language adjustments. These include standard definitional harmonization, cross-reference corrections, and certain typographical changes that do not affect the substantive allocation of rights and obligations. We have reviewed each of these non-material comments and will prepare a separate markup for client review reflecting our recommended dispositions. This memorandum does not address those non-material items.
However, eleven of WBC's comments raise material substantive issues that implicate VMS's regulatory compliance posture, risk tolerance, data governance standards, and commercial interests. These eleven issues require client instruction and, in most cases, will require further negotiation with WBC and Meridian before the DPA can be finalized.
This memorandum addresses each of the eleven material issues in order of significance. For each issue, we describe: (a) VMS's position as reflected in DPA v1.0; (b) Meridian's counter-position as set forth in the WBC Redline; (c) the legal and commercial implications of each position; and (d) recommended positions for VMS, including areas of potential compromise.
Note Regarding Pinehurst Cybersecurity Advisors LLC. VMS has separately engaged Pinehurst Cybersecurity Advisors LLC ("Pinehurst"), a Virginia-based cybersecurity consulting firm specializing in connected-vehicle and IoT environments, to conduct an independent security assessment of Meridian's data processing environment, including its infrastructure and sub-processing arrangements. As of the date of this memorandum, Pinehurst's preliminary findings report has not yet been delivered; based on our last communication with Pinehurst's engagement lead, delivery is anticipated within the next two to three weeks. Certain issues identified below — particularly those relating to sub-processor evaluation (Issue 2), audit rights (Issue 5), and the specificity of technical and organizational measures (Issue 8) — may warrant revisiting once Pinehurst's findings are available. We recommend that VMS take steps to expedite delivery of the Pinehurst report, as its findings may materially inform VMS's negotiation posture on these critical items.
Background Context. The DPA governs Meridian's processing of vehicle telemetry and in-cabin sensor data collected from approximately 800,000 opted-in vehicles enrolled in VMS's "Connected Insights" program. The data encompasses fourteen distinct categories of vehicle and environmental data, including but not limited to GPS/geolocation coordinates, seat occupancy sensor readings, tire pressure telemetry, ambient noise levels, windshield wiper activation data, headlight and taillight status, engine performance metrics, braking patterns, steering input data, battery voltage readings, HVAC system usage, fuel consumption data, airbag system status, and infotainment system interaction logs. At current enrollment levels, the Connected Insights program generates approximately 4.2 terabytes of raw telemetry data per day, transmitted from in-vehicle telematics control units to Meridian's processing infrastructure.
Two of the fourteen data categories — GPS/geolocation data and seat occupancy sensor data — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy (Data Governance Policy No. DG-2021-003, effective January 15, 2022, as amended July 1, 2022). This classification is based on the determination by VMS's Data Governance Committee that GPS/geolocation data and seat occupancy data, when combined with vehicle identification numbers ("VINs"), can be linked, directly or indirectly, to identifiable natural persons — specifically, vehicle owners and registered operators. GPS/geolocation data reveals the real-time and historical physical location of the vehicle and, by extension, the vehicle's driver or occupants. Seat occupancy data, when combined with GPS/geolocation and VIN data, can reveal the number and pattern of occupants at specific times and locations, raising additional privacy considerations.
Approximately 112,000 of the 800,000 opted-in vehicles — roughly fourteen percent — are registered in the State of California, which implicates VMS's compliance obligations under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA"). The CCPA/CPRA framework imposes specific requirements on businesses that share or disclose personal information with service providers and contractors, including contractual obligations regarding purpose limitation, data retention, and secondary use. In addition, VMS's obligations under the Michigan Identity Theft Protection Act (MCL 445.61 et seq.) and the federal Drivers' Privacy Protection Act ("DPPA") (18 U.S.C. § 2721 et seq.) are implicated to varying degrees by the issues discussed herein. We address the specific regulatory implications of each issue in the detailed analysis below.
II. Summary Table of Material Open Issues
The following table provides a high-level overview of each of the eleven material open issues, the relevant DPA provision, the positions of each party, and our priority classification. Detailed analysis follows in Part III.
III. Detailed Analysis of Each Material Open Issue
Issue 1: Data Retention Period (DPA v1.0, Section 7.3)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 7.3, provides that all raw vehicle telemetry data transmitted by VMS or collected by Meridian on VMS's behalf is subject to a ninety-day rolling deletion cycle. Specifically, after Meridian has completed its processing of raw telemetry data and delivered the resulting analytics outputs (predictive maintenance insights, driver behavior scores, and fleet optimization analytics) to VMS or to authorized third-party recipients, Meridian is required to irreversibly delete or anonymize all raw data within ninety calendar days of initial receipt. The ninety-day window was designed to provide Meridian with sufficient time to complete its initial processing, quality assurance, and output delivery activities while minimizing the period during which identifiable or re-identifiable raw data remains in Meridian's possession. Section 7.3 expressly prohibits retention of raw data beyond the ninety-day window for any purpose, including — and this language was deliberately included — machine-learning model training, algorithm refinement, or any other form of secondary processing.
This position reflects VMS's data minimization philosophy as codified in VMS's internal Data Governance Policy No. DG-2021-003, which requires that personal data and Sensitive Vehicle Data be retained for the minimum period necessary to accomplish the specified processing purpose and deleted promptly thereafter. The ninety-day period was calibrated in consultation with VMS's Connected Services engineering team as the maximum reasonable processing window for the data volumes involved.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline proposes substantial revisions to Section 7.3. Meridian seeks an eighteen-month retention period for raw data, replacing the ninety-day rolling deletion cycle. In support of this position, WBC's Comment No. 17 states that Meridian requires a longer retention window for three stated purposes: (i) machine-learning model training, which Meridian asserts requires access to large historical datasets to improve the accuracy and reliability of its predictive analytics models; (ii) algorithm validation, which Meridian states involves back-testing model outputs against historical raw data to verify performance; and (iii) longitudinal analysis, including seasonal driving pattern analysis, which Meridian argues requires data spanning at least twelve to eighteen months to capture annual cyclicality in vehicle usage patterns.
WBC's Redline also adds a new sub-clause to Section 7.3 that would permit Meridian to retain "pseudonymized" (but not fully anonymized) data for up to eighteen months after initial processing, subject to "reasonable technical safeguards" — a phrase that is not further defined in the Redline. The distinction between pseudonymized and fully anonymized data is significant, as discussed below.
C. Analysis. The eighteen-month retention window proposed by WBC substantially increases VMS's risk exposure across multiple dimensions.
Re-identification Risk. Even pseudonymized VIN-linked data can, under certain circumstances, be re-identified. Pseudonymization — the processing of personal data such that the data can no longer be attributed to a specific individual without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures — does not eliminate the risk that an attacker or unauthorized party could reverse the pseudonymization process and link the data back to identifiable individuals. In the context of GPS/geolocation data, even rudimentary analysis techniques (e.g., identifying a vehicle's "home" location based on overnight parking patterns) can re-identify a pseudonymized record with high probability. Seat occupancy data compounds this risk by revealing the presence and number of vehicle occupants at specific times and locations. Retaining pseudonymized Sensitive Vehicle Data for eighteen months — rather than ninety days — extends the window during which such data is vulnerable to re-identification by a factor of six.
CCPA/CPRA Implications. Data retention for eighteen months for a secondary purpose (model training and algorithm validation) that differs from the purpose disclosed to consumers at the time of data collection — namely, "Connected Insights" analytics — raises significant concerns under the CPRA's data minimization and purpose limitation principles. Under CPRA Section 1798.100(c), a business's collection, use, retention, and sharing of a consumer's personal information must be "reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed." If VMS's privacy notices to California consumers describe the purpose of data collection as generating predictive maintenance and driver behavior analytics, retaining raw data for eighteen months to facilitate Meridian's model-training activities may be viewed as inconsistent with the disclosed purpose. This could trigger additional disclosure obligations under CPRA Section 1798.100(a) with respect to the approximately 112,000 California data subjects. Moreover, the California Attorney General and, beginning July 1, 2023, the California Privacy Protection Agency may take the position that extended retention for model-training purposes requires a separate, affirmative consumer opt-in.
Michigan Identity Theft Protection Act. While the Michigan Identity Theft Protection Act (MCL 445.61 et seq.) does not prescribe specific data retention limits, the statute requires reasonable security measures for personal information and imposes notification obligations in the event of a breach. Maintaining identifiable or re-identifiable data for extended periods necessarily increases VMS's and Meridian's breach exposure surface — i.e., the volume of data that could be compromised in any single breach event — and consequently increases the potential scope and cost of breach notification obligations.
Drivers' Privacy Protection Act. The DPPA (18 U.S.C. § 2721 et seq.) restricts the disclosure and use of "personal information" obtained in connection with a motor vehicle record, which includes information that identifies an individual in connection with a VIN. To the extent that Meridian retains VIN-linked data — even in pseudonymized form — for model-training purposes, such retention may implicate the DPPA's "permissible use" restrictions, particularly if the model-training purpose is not covered by the enumerated permissible uses set forth in 18 U.S.C. § 2721(b). Unauthorized disclosure or use of DPPA-protected information carries statutory damages of not less than $2,500 per violation (18 U.S.C. § 2724(b)), which, applied to 800,000 vehicles, could result in catastrophic aggregate exposure.
Commercial Context. The commercial partnership Letter of Intent executed by the parties on August 5, 2022 (the "LOI") does not expressly contemplate Meridian retaining VMS raw data for model-training purposes. The LOI describes Meridian's role as a data processor generating analytics outputs for VMS and developing derivative analytics products for third-party sale, subject to a royalty arrangement. Meridian's request to retain raw data for eighteen months for model-training and algorithm validation purposes appears to represent an expansion of scope beyond what was commercially agreed. If Meridian's model-training activities are intended to improve its platform capabilities in ways that benefit Meridian's other customers — potentially including VMS's competitors — this expansion has commercial implications that extend beyond the DPA and into the broader partnership arrangement.
D. Recommendation. We recommend that VMS maintain the ninety-day rolling deletion requirement for raw data, with particular emphasis on Sensitive Vehicle Data categories (GPS/geolocation and seat occupancy). The risk profile of eighteen-month retention of pseudonymized Sensitive Vehicle Data is incompatible with VMS's data governance policy and its CCPA/CPRA compliance posture.
As a potential compromise, VMS could agree to permit Meridian to retain fully anonymized and aggregated data — with irreversible removal of VINs, device identifiers, and any re-identification keys — for a period not exceeding twelve months after the completion of initial processing, solely for the purpose of machine-learning model training and algorithm validation. This compromise would be conditioned on: (a) VMS's prior written approval of the anonymization methodology employed by Meridian, including an assessment of whether the anonymization achieves true irreversibility under applicable standards; (b) an express covenant by Meridian not to attempt re-identification of any anonymized data; (c) annual certification by an authorized officer of Meridian confirming compliance with the anonymization requirements and the covenant against re-identification; and (d) VMS's right to audit compliance with the anonymization requirements (consistent with the audit rights discussed under Issue 5).
This approach preserves VMS's data governance position and regulatory compliance while acknowledging Meridian's legitimate commercial interest in model improvement. The distinction between pseudonymized data (which remains within the scope of data protection regulations and the DPA's protections) and truly anonymized data (which, if properly anonymized, falls outside the scope of most data protection statutes) is critical and should be clearly reflected in the DPA.
We note that the adequacy of any proposed anonymization methodology should ideally be validated by Pinehurst as part of its security assessment. We recommend raising this point with Pinehurst and requesting that their assessment scope include an evaluation of Meridian's anonymization capabilities and processes.
Issue 2: Sub-Processor Approval Rights (DPA v1.0, Section 8)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 8, requires Meridian to obtain the prior written consent of VMS before engaging any sub-processor to perform any portion of the data processing activities contemplated by the DPA. This prior-consent model reflects VMS's determination that, given the sensitivity and volume of the data involved, VMS should retain affirmative control over the identity and qualifications of any entity that processes VMS data.
DPA v1.0 includes Annex C, which identifies Cloudvault Infrastructure, Inc. ("Cloudvault") as the sole approved sub-processor as of the effective date. Cloudvault operates its "AutoCloud" platform, a cloud infrastructure environment designed for automotive and IoT data workloads, with data centers located in Reno, Nevada, and Columbus, Ohio. Meridian's existing master services agreement with Cloudvault was executed on March 1, 2021, and governs the infrastructure services that Cloudvault provides to Meridian for the storage and processing of client data, including VMS data. The Cloudvault MSA is currently in its initial three-year term and is set to expire on February 28, 2024, subject to renewal.
Section 8 also requires that Meridian impose on any approved sub-processor, through a written sub-processing agreement, data protection obligations that are substantively equivalent to those imposed on Meridian under the DPA. Meridian remains fully liable to VMS for the acts and omissions of its sub-processors as if such acts and omissions were Meridian's own.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline proposes replacing the prior-written-consent model with a general authorization model. Under Meridian's proposed approach, VMS would provide blanket consent to Meridian's engagement of sub-processors, subject to the following safeguards:
(a) Meridian would maintain and regularly update a list of all sub-processors, including the identity, location, and processing activities of each sub-processor, and make such list available to VMS upon request;
(b) Meridian would provide VMS with thirty calendar days' prior written notice before engaging any new sub-processor or making a material change to an existing sub-processor's processing activities;
(c) VMS would have the right to object to a proposed new sub-processor within the thirty-day notice window, provided that such objection is based on "reasonable grounds" relating to data protection concerns; and
(d) If VMS objects and the parties are unable to resolve the dispute through good-faith discussions within a timeframe to be agreed, a dispute resolution mechanism (to be defined) would apply.
WBC's Comment No. 22 states that the general authorization model is "consistent with GDPR Article 28(2) and industry practice" and argues that a strict prior-consent model is "operationally impractical" in a high-velocity data processing context where Meridian may need to engage specialized sub-processors on short notice to support data processing activities.
C. Analysis. Justification for Tight Control. Given the sensitivity of the GPS/geolocation and seat occupancy data, the volume of data involved (approximately 4.2 terabytes per day from 800,000 vehicles), and the regulatory obligations that attach to this data under CCPA/CPRA, DPPA, and Michigan law, VMS has a strong justification for maintaining tight control over the identity and qualifications of entities that access or process VMS data. Each new sub-processor introduces an additional vector for potential data breach, unauthorized access, or non-compliant processing, and VMS — as the data controller — bears the regulatory and reputational consequences of any sub-processor failure.
Burden Shifting. The general authorization model proposed by WBC effectively shifts the default from "consent required" (processor must obtain affirmative approval) to "consent presumed unless objection raised" (controller must monitor, evaluate, and affirmatively object). This places the burden on VMS to continuously monitor Meridian's sub-processor list, evaluate each proposed sub-processor within a thirty-day window, and raise timely objections — a burden that, in practice, requires VMS to maintain ongoing due diligence capabilities. While this model is common in many commercial data processing arrangements, it is less appropriate where the data involved is of the sensitivity and volume at issue here.
Operational Considerations. We acknowledge that a strict prior-written-consent model can, in certain circumstances, create operational friction. If Meridian needs to migrate data to a new infrastructure provider on short notice (e.g., due to a service outage or capacity constraint at Cloudvault), the requirement to obtain VMS's prior written consent could delay Meridian's ability to respond. However, this risk can be mitigated through advance planning and by maintaining a pre-approved roster of contingency sub-processors.
Cloudvault Assessment. As noted above, Cloudvault's specific suitability as a sub-processor has not yet been independently verified. Pinehurst's pending security assessment is expected to include an evaluation of Cloudvault's security posture, including its physical and logical access controls, encryption practices, incident response capabilities, and data isolation measures. Until the Pinehurst report is received, VMS's approval of Cloudvault as the sole sub-processor should be regarded as provisional.
Flow-Down Obligations. Regardless of the approval model ultimately adopted, the DPA must require Meridian to impose substantially identical data protection obligations on all sub-processors through written sub-processing agreements. Both parties appear to agree on this point in principle. The key question is not whether sub-processors must comply with equivalent obligations, but rather who controls the decision of whether to engage a particular sub-processor in the first instance.
D. Recommendation. We recommend a hybrid approach that differentiates between sub-processors that will access or process Sensitive Vehicle Data and those that will not:
(a) Sensitive Vehicle Data Sub-Processors. Maintain the prior-written-consent requirement for any sub-processor that will access, store, or process Sensitive Vehicle Data (i.e., GPS/geolocation data and seat occupancy data, whether alone or in combination with VINs or other identifiers). This ensures that VMS retains affirmative control over the most sensitive categories of data.
(b) Non-Sensitive Data Sub-Processors. For sub-processors that will process only non-sensitive data categories (i.e., the twelve categories other than GPS/geolocation and seat occupancy), accept the general authorization model with a thirty-day objection window, subject to the following conditions:
(i) Meridian must furnish VMS with adequate due diligence information about the proposed sub-processor, including the sub-processor's identity, jurisdiction of incorporation and principal operations, relevant certifications (e.g., SOC 2, ISO 27001), a description of the processing activities to be performed, the data categories involved, and a summary of the sub-processor's security posture;
(ii) VMS's objection may be based on "reasonable data protection grounds," a standard that is broader than WBC's proposed "reasonable grounds" formulation and that expressly encompasses concerns relating to the sub-processor's security posture, jurisdiction, regulatory compliance history, and data governance practices — not limited to material security deficiencies;
(iii) If VMS objects and the parties cannot resolve the dispute within fifteen business days through good-faith escalation to senior representatives, VMS retains the right to terminate the DPA for convenience without penalty or early termination fee; and
(iv) Meridian must, in all cases, execute a written sub-processing agreement with each sub-processor imposing data protection obligations substantively equivalent to those imposed on Meridian under the DPA, and must provide copies of such sub-processing agreements to VMS upon request.
We further recommend that VMS's final position on the approval of Cloudvault as a sub-processor be reserved pending receipt and review of the Pinehurst security assessment. In the interim, the DPA should reflect Cloudvault's approval as provisional and subject to confirmation following the completion of VMS's independent security evaluation.
Issue 3: Breach Notification Timeline (DPA v1.0, Section 10.1)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 10.1, requires Meridian to notify VMS within twenty-four hours of Meridian "becoming aware" of any personal data breach. The term "personal data breach" is defined broadly in Section 1.12 of DPA v1.0 to include any unauthorized access to, acquisition of, disclosure of, use of, or loss of personal data, including Sensitive Vehicle Data, whether or not such incident results in actual harm to any data subject. The twenty-four-hour notification window was designed to ensure that VMS receives prompt notification of any security incident affecting VMS data, enabling VMS to initiate its own incident response procedures, assess regulatory notification obligations, and take steps to mitigate potential harm to data subjects.
Section 10.1 further requires that the initial notification include, at minimum: the nature and category of the breach, the data categories and approximate number of data records affected, the identity of any sub-processor involved, the measures taken or proposed to address the breach, and a contact person at Meridian for further inquiries. Meridian is required to cooperate fully with VMS's investigation and remediation efforts.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline proposes extending the notification window from twenty-four hours to seventy-two hours. WBC's Comment No. 31 offers three justifications for this change:
(a) GDPR Alignment. WBC states that a seventy-two-hour notification period is consistent with the standard established by Article 33 of the General Data Protection Regulation ("GDPR"), which requires a controller to notify its supervisory authority of a personal data breach within seventy-two hours of becoming aware of it.
(b) Quality of Information. WBC argues that twenty-four hours is insufficient for Meridian to conduct a meaningful preliminary assessment of the breach before notifying VMS, and that requiring notification before Meridian has a basic understanding of the scope and nature of the incident could result in the delivery of inaccurate or incomplete information that undermines effective incident response.
(c) Premature Notification Risks. WBC contends that premature notification without adequate information could "trigger unnecessary alarm and misdirected response efforts," consuming VMS's incident response resources on false positives or incidents that turn out to be less significant than initially feared.
C. Analysis. GDPR Article 33 Distinction. WBC's reliance on the GDPR seventy-two-hour standard is somewhat misleading. GDPR Article 33(1) establishes the seventy-two-hour window for notification by a controller to a supervisory authority — i.e., one leg of the notification chain. GDPR Article 33(2), which governs processor-to-controller notification, requires the processor to notify the controller "without undue delay" after becoming aware of a personal data breach, without specifying a fixed time period. In practice, many GDPR-compliant data processing agreements use time frames ranging from twenty-four to forty-eight hours for processor-to-controller notification, precisely because the controller needs sufficient time after receiving the processor's notification to prepare its own seventy-two-hour notification to the supervisory authority. If Meridian takes the full seventy-two hours to notify VMS, VMS may have as little as zero hours to prepare and submit its own regulatory notifications — an untenable position.
U.S. Regulatory Landscape. No U.S. federal statute prescribes a specific processor-to-controller notification period. However, state breach notification laws — including Michigan's Identity Theft Protection Act — impose notification obligations on covered entities that begin to run upon discovery or awareness of a breach. Michigan's statute requires notification to affected individuals "without unreasonable delay," though it permits delay for law enforcement purposes. The California breach notification statute (Cal. Civ. Code § 1798.82) requires notification "in the most expedient time possible and without unreasonable delay." VMS's ability to comply with these state-law obligations depends on receiving prompt notification from Meridian; a seventy-two-hour delay in processor notification could consume a significant portion of VMS's available response time before the state notification clock has even begun to run from VMS's perspective.
Data Sensitivity and Volume. The potential consequences of a breach involving GPS/geolocation data and seat occupancy data linked to VINs for up to 800,000 vehicles are substantial. GPS/geolocation data can reveal the real-time or historical location of identifiable individuals, creating risks of physical safety, stalking, and surveillance harm that escalate with each hour of delay. Rapid notification is essential to enable VMS to implement containment measures, notify affected individuals if warranted, and engage with law enforcement if the breach involves criminal activity.
Industry Practice. Practice in the automotive and connected-vehicle sector varies, but several major OEM data processing agreements known to us impose twenty-four-hour notification requirements on processors. The twenty-four-hour standard is not unusual in arrangements involving high-volume, high-sensitivity data processing.
D. Recommendation. We recommend maintaining the twenty-four-hour notification requirement, but we suggest proposing a two-tier notification approach that may address Meridian's legitimate concern about the quality of information available in the first twenty-four hours:
(a) Initial Notification (24 Hours). Meridian must provide initial notification to VMS within twenty-four hours of becoming aware of any personal data breach. The initial notification must include, at minimum: (i) a description of the nature and known or suspected scope of the breach; (ii) the categories of data affected (and specifically whether Sensitive Vehicle Data is involved); (iii) an approximation of the number of data records affected; (iv) a summary of initial remedial actions taken or proposed; and (v) the identity and contact information of Meridian's designated incident response lead.
(b) Detailed Supplemental Report (72 Hours). Meridian must provide a comprehensive supplemental report within seventy-two hours of becoming aware of the breach, including: (i) a more detailed root cause analysis; (ii) a full scope assessment, including affected systems, sub-processors, and data subjects; (iii) a detailed remediation plan with timelines; (iv) an assessment of the risk of harm to affected data subjects; and (v) any additional information reasonably necessary for VMS to evaluate its own regulatory notification obligations.
The DPA should include an express provision that the initial notification obligation shall not be delayed pending completion of a full investigation. This provision is critical to prevent Meridian from invoking the "quality of information" concern as a basis for delaying initial notification beyond the twenty-four-hour window.
We believe this two-tier approach preserves VMS's ability to initiate timely incident response and regulatory notification while acknowledging Meridian's practical concern that a comprehensive root cause analysis and full scope assessment cannot reasonably be completed within twenty-four hours. This structure is consistent with emerging best practices in processor-to-controller breach notification frameworks and should be defensible to WBC.
Issue 4: Liability Cap for Data Breaches and Unauthorized Processing (DPA v1.0, Section 12)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 12, provides that Meridian's liability in connection with data breaches and any unauthorized processing of VMS data, including Sensitive Vehicle Data, is uncapped. This means that there is no contractual ceiling on the aggregate amount of damages that VMS may recover from Meridian for losses arising from such incidents. VMS's rationale for this position is straightforward: given the potential magnitude of regulatory fines, class-action litigation exposure, reputational harm, customer churn, regulatory remediation costs, and the sheer volume and sensitivity of the data involved, capping Meridian's liability would inappropriately shift risk from the processor — who has operational control over the data processing environment — to the controller, who bears the external-facing regulatory and reputational consequences of any breach.
Section 12 does not address the broader liability framework for non-data-protection claims under the DPA (e.g., breach of commercial terms), which is governed by the master services agreement being negotiated in parallel.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline proposes a liability cap of fifteen million dollars ($15,000,000) for all claims arising under the DPA, inclusive of claims for data breaches and unauthorized processing. WBC's Comment No. 37 characterizes the fifteen-million-dollar cap as "generous" relative to market norms, noting that the cap represents approximately 2.31 times the annual license fee of $6.5 million that Meridian pays to VMS for access to VMS's Connected Insights data. WBC further argues that unlimited liability provisions are "commercially unreasonable" for a company of Meridian's size and may be uninsurable, creating a situation where the unlimited liability provision provides an illusory remedy because Meridian could not satisfy an uncapped judgment.
C. Analysis. Magnitude of Potential Exposure. The fifteen-million-dollar cap must be evaluated against VMS's potential exposure in the event of a breach involving GPS/geolocation and seat occupancy data linked to VINs for up to 800,000 vehicles. A non-exhaustive summary of potential exposure categories includes:
• CCPA/CPRA statutory damages: Up to $7,500 per intentional violation for the approximately 112,000 California data subjects, potentially resulting in aggregate statutory damages exposure in excess of $840 million in a worst-case scenario. Even in a scenario involving a fraction of affected California consumers, the potential exposure far exceeds $15 million.
• DPPA statutory damages: Minimum of $2,500 per violation under 18 U.S.C. § 2724(b), which could be multiplied across the 800,000-vehicle population if VIN-linked data is improperly disclosed or used.
• Regulatory enforcement actions: The California Attorney General and, beginning July 1, 2023, the California Privacy Protection Agency have authority to impose administrative fines for CCPA/CPRA violations. State attorneys general in other jurisdictions where vehicles are registered may also take action.
• Class-action litigation: Consumer class actions alleging invasion of privacy, negligence, or violations of state consumer protection statutes are a realistic possibility in the event of a breach involving location data.
• Reputational harm and customer attrition: VMS's Connected Insights program depends on consumer trust and opt-in participation. A significant data breach could lead to a material decline in opt-in rates, undermining the commercial viability of the program.
• Incident response and remediation costs: Forensic investigation, legal counsel, notification costs, credit monitoring, call center operations, and public relations efforts can be substantial.
Against this backdrop, a fifteen-million-dollar cap is plainly inadequate to protect VMS's interests.
Meridian's Perspective. At the same time, we recognize that Meridian is a company with approximately $78 million in annual recurring revenue and approximately 340 employees. An uncapped liability provision, in the abstract, exposes Meridian to the theoretical risk of a judgment that exceeds its ability to pay — which, as WBC notes, could render the provision effectively illusory. Moreover, unlimited-liability provisions may be uninsurable or may be excluded from the scope of Meridian's commercial general liability and cyber-liability insurance policies, which is a legitimate commercial concern. From a negotiation dynamics perspective, Meridian's counsel will likely take a firm position on some form of liability limitation, and an outright refusal to discuss any form of cap may impede progress on other issues.
Contract Value Context. The total base-term contract value is $19.5 million ($6.5 million annual license fee × three-year base term), plus royalties on derivative analytics products sold to third parties (at a rate of 3.5%) and potential renewal-term fees. A fifteen-million-dollar cap would represent approximately 77% of the base-term value — or approximately 2.31 times a single year's fee, as WBC notes. While multiples of annual fees are a common benchmark in commercial contracts, such benchmarks are not well-suited to data processing arrangements where the potential downside exposure bears no relation to the fee structure.
PE Sponsor Considerations. We note that Northgate Capital Partners holds a 72% equity stake in VMS and manages approximately $2.8 billion in assets under management. Northgate may have portfolio-level views on acceptable risk allocation in data processing arrangements that should inform VMS's negotiation posture. We recommend that Thomas Langford consult with Northgate's portfolio operations team on this issue if he has not already done so.
D. Recommendation. We recommend that VMS resist a flat cap and instead propose a tiered liability structure that differentiates based on the nature and cause of the loss:
(a) Tier 1 — Uncapped Liability. Claims arising from: (i) unauthorized processing of VMS data (i.e., processing for purposes not authorized by the DPA); (ii) willful misconduct or gross negligence by Meridian or its personnel; (iii) data breaches caused by Meridian's failure to implement and maintain the technical and organizational measures specified in Annex B; and (iv) breaches of Meridian's confidentiality obligations. These categories represent scenarios where Meridian has failed to discharge fundamental obligations within its control, and VMS should not bear the risk of such failures.
(b) Tier 2 — Capped Liability. Claims arising from data breaches that occur despite Meridian's compliance with the agreed technical and organizational measures in Annex B — i.e., "no-fault" breaches resulting from sophisticated attacks that overcome compliant security measures. For these claims, VMS could agree to a cap of the greater of (x) fifteen million dollars ($15,000,000) or (y) two times the aggregate fees paid or payable under the first twelve months of the partnership term (approximately $13,000,000), resulting in an effective cap of $15 million under current fee levels but providing upward adjustment if fees increase.
As an alternative or additional measure, we recommend requiring Meridian to maintain cyber-liability insurance coverage with minimum limits of not less than ten million dollars ($10,000,000) per occurrence and in the aggregate, with VMS named as an additional insured. Such insurance coverage would partially backstop a negotiated cap and provide Meridian with an insurable mechanism for addressing its exposure concerns. The DPA should require Meridian to provide VMS with evidence of coverage prior to the effective date and upon each policy renewal during the term, and should prohibit Meridian from materially reducing its coverage without VMS's prior written consent.
This tiered approach protects VMS against the most consequential and preventable breach scenarios while providing Meridian with some measure of liability predictability for incidents that are genuinely beyond Meridian's control.
Issue 5: Audit Rights (DPA v1.0, Section 11)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 11, grants VMS or its designated auditor — including third-party auditors such as Pinehurst — the right to conduct on-site audits of Meridian's data processing facilities, including the facilities of any sub-processor processing VMS data. Section 11 provides for unlimited audit frequency, with a minimum of ten business days' prior written notice to Meridian before each audit. Audits are conducted at VMS's expense and may encompass the review of physical and logical security controls, processing records and logs, sub-processor agreements, data flow documentation, incident response plans, employee training records, and general compliance with Meridian's obligations under the DPA. The unlimited audit right was included to ensure that VMS has comprehensive visibility into Meridian's processing environment and can respond promptly to emerging risks.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline proposes significant restrictions on VMS's audit rights. Specifically, Meridian seeks the following modifications:
(a) Audits limited to once per twelve-month period — i.e., one annual audit;
(b) A minimum of thirty calendar days' prior written notice before any audit, replacing the ten-business-day notice period in DPA v1.0;
(c) A requirement that audits be conducted during regular business hours and not unreasonably interfere with Meridian's operations;
(d) A cost-sharing provision under which VMS bears audit costs up to $25,000 per audit, with Meridian bearing any costs in excess of $25,000; and
(e) A provision permitting Meridian to satisfy its audit obligations by providing SOC 2 Type II reports or equivalent third-party certifications in lieu of on-site audits, at Meridian's election.
WBC's Comment No. 35 argues that unlimited audit rights impose an "unreasonable operational burden" on Meridian and are "inconsistent with the confidentiality and security" of Meridian's multi-tenant processing environment, where auditors from one customer could potentially access areas containing another customer's data.
C. Analysis. Practical Value vs. Operational Burden. We acknowledge that unlimited audit rights, while valuable as a contractual tool, may be impractical to exercise at high frequency. The cost and personnel commitment required to conduct comprehensive on-site audits of a sophisticated data processing environment are substantial, and VMS is unlikely to conduct more than one or two audits per year in practice. However, the contractual right to conduct ad hoc audits in response to specific triggering events — such as a security incident, a material change in sub-processors, a regulatory inquiry, or the receipt of adverse findings from Pinehurst — is critically important and should not be surrendered.
Annual Frequency Limitation. Limiting VMS to a single annual audit could leave VMS unable to respond to emerging risks in real time. If, for example, Meridian proposes to engage a new sub-processor to process Sensitive Vehicle Data (and VMS consents to such engagement), VMS should have the right to audit the new sub-processor's environment before or shortly after processing begins — not twelve months later. Similarly, if a security incident occurs at Meridian or Cloudvault, VMS needs the ability to conduct an immediate follow-up audit to assess the adequacy of remediation.
$25,000 Cost Cap. The proposed $25,000 cost cap effectively limits the scope and depth of any single audit. A comprehensive on-site audit of a data processing environment handling 4.2 terabytes per day, conducted by qualified cybersecurity professionals, could reasonably be expected to cost in excess of $25,000. The cost-sharing mechanism as proposed could incentivize Meridian to insist on narrowly scoped reviews, limit auditor access, or challenge the scope of the audit as "exceeding the budget."
SOC 2 Type II Reports. SOC 2 Type II reports are a useful component of a comprehensive compliance monitoring program, but they are not an adequate substitute for on-site audit rights. SOC 2 reports are backward-looking — they attest to the design and operating effectiveness of controls during a defined observation period (typically six to twelve months). They do not capture real-time compliance, emerging vulnerabilities, or changes in the processing environment that postdate the observation period. Moreover, SOC 2 reports are prepared to the scope and criteria selected by the service organization, which may not align with VMS's specific data protection concerns or the requirements of the DPA. Finally, SOC 2 reports do not assess compliance with the specific contractual obligations of the DPA, such as the data retention, purpose limitation, and sub-processor flow-down requirements.
Pinehurst Assessment. The scope and findings of Pinehurst's pending security assessment may inform the appropriate frequency, scope, and methodology of ongoing audits. If Pinehurst identifies material deficiencies in Meridian's security posture, VMS may need to conduct follow-up audits on an accelerated timeline.
D. Recommendation. We recommend the following compromise structure:
(a) Scheduled Annual Audit. One scheduled audit per twelve-month period, with a minimum of twenty business days' prior written notice (splitting the difference between VMS's proposed ten business days and WBC's proposed thirty calendar days). The scheduled audit may be conducted on-site at Meridian's primary processing facility and at any sub-processor facility processing VMS data.
(b) Ad Hoc Audit Right. The right to conduct one additional ad hoc audit per twelve-month period, triggered by any of the following events: (i) a material security incident or personal data breach (whether at Meridian or any sub-processor); (ii) a material change in sub-processors, including the engagement of a new sub-processor to process Sensitive Vehicle Data; (iii) a regulatory inquiry, investigation, or enforcement action directed at VMS or Meridian relating to VMS data; or (iv) Pinehurst findings (or the findings of any subsequent security assessment) identifying material deficiencies in Meridian's security posture. Ad hoc audits require a minimum of ten business days' prior written notice.
(c) Cost Allocation. VMS bears reasonable audit costs. We recommend eliminating the $25,000 cost cap, which arbitrarily constrains audit scope. As an alternative, VMS could agree to bear all direct costs of audits conducted during regular business hours, with Meridian bearing incremental costs only if Meridian requests that audits be conducted outside regular business hours.
(d) SOC 2 Reports as Supplement. Meridian may provide SOC 2 Type II reports (or equivalent third-party certifications) as a supplement to, but not a substitute for, on-site audit rights. SOC 2 reports should be provided to VMS promptly upon receipt and reviewed by VMS as part of its ongoing due diligence, but receipt of a SOC 2 report does not limit or waive VMS's right to conduct on-site audits.
(e) Sub-Processor Audit Rights. Audit rights extend expressly to Cloudvault and any other sub-processor facility processing VMS data, consistent with VMS's responsibility as data controller to oversee the entire processing chain.
(f) Multi-Tenant Protections. We are willing to accept reasonable confidentiality and access-control measures to protect Meridian's other customers' data during on-site audits, provided that such measures do not prevent VMS's auditors from accessing all systems, records, and facilities relevant to VMS data processing.
We recommend revisiting this issue once Pinehurst's findings are available, as the findings may support a more or less expansive audit rights framework depending on the identified risk profile.
Issue 6: Definition of "Personal Data" / Scope of Protected Data (DPA v1.0, Section 1)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 1.8, defines "Personal Data" broadly to encompass any data that, alone or in combination with other information (including VINs, device identifiers, or other vehicle-specific identifiers), can be used to identify, contact, or locate a natural person. The definition expressly includes GPS/geolocation data and seat occupancy data as subcategories of "Sensitive Vehicle Data" when such data is linked or reasonably linkable to VINs or other identifiers that are associated with identified or identifiable natural persons. The definition is intentionally aligned with the broadest applicable statutory definition — specifically, the CCPA/CPRA's definition of "personal information," which encompasses information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."
The rationale for this broad definition is twofold. First, it ensures that the DPA's protections attach to all data that could, under any applicable statute, be classified as personal data or personal information, thereby avoiding a gap between VMS's regulatory obligations and its contractual protections. Second, it reflects VMS's internal data governance policy, which takes a conservative, "protect everything that could be personal" approach to data classification.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline proposes narrowing the definition of "Personal Data" in two significant respects:
(a) "Directly and Currently Linked" Standard. WBC proposes replacing VMS's "linkable" standard with a narrower standard that limits "Personal Data" to data that is "directly and currently linked to an identified individual." Under this formulation, data that is merely "linkable" — i.e., data that could be linked to an individual through the use of additional information but is not currently so linked — would fall outside the scope of the DPA's protections. WBC argues that many of the fourteen data categories (e.g., tire pressure readings, ambient noise levels, windshield wiper activation events, headlight and taillight status) are not personal data even if technically associated with a VIN, because they do not directly identify any individual.
(b) Pseudonymized Data Carve-Out. WBC proposes a carve-out for data that has been "pseudonymized," defined as data processed in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information. Under Meridian's proposal, pseudonymized data would not be treated as "Personal Data" for purposes of the DPA, effectively exempting such data from the DPA's retention, deletion, purpose limitation, and security requirements.
C. Analysis. CCPA/CPRA Alignment. Under the CCPA, as amended by the CPRA, "personal information" is defined as information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v)(1). This definition is intentionally broad and encompasses data that is "linkable," not merely data that is currently linked. Adopting Meridian's narrower "directly and currently linked" standard would create a gap between VMS's CCPA/CPRA obligations (which attach to linkable data) and the DPA's protections (which, under Meridian's proposal, would not). This gap could leave VMS contractually unprotected with respect to data that is nonetheless subject to regulatory requirements.
VMS Internal Data Governance Policy. VMS's Data Governance Policy No. DG-2021-003 classifies GPS/geolocation data and seat occupancy data as "Sensitive Vehicle Data" specifically because of their linkability to VINs. Adopting a DPA definition that excludes linkable data would create an internal inconsistency between VMS's data governance framework and its contractual protections, potentially undermining VMS's ability to demonstrate a coherent and consistent data protection program to regulators and auditors.
DPPA Implications. DPPA protections attach to "personal information" obtained from motor vehicle records, which by definition includes VINs and information associated with VINs. If VINs are transmitted to Meridian alongside telemetry data — which they are, in the current data flow architecture — the DPPA's protections arguably extend to all VIN-associated data, regardless of whether the data is "directly and currently linked" to an identified individual. Narrowing the DPA definition could leave VMS without contractual remedies for DPPA violations involving VIN-associated data that Meridian does not consider "Personal Data" under the narrowed definition.
Pseudonymization vs. Anonymization. Pseudonymization is not anonymization. Pseudonymized data, by definition, can be re-identified with the use of additional information. Under the CCPA/CPRA, pseudonymized data that is "reasonably capable of being associated with" a consumer remains personal information. The GDPR similarly treats pseudonymized data as personal data (Recital 26). Excluding pseudonymized data from the DPA's protections would be inconsistent with both the CCPA/CPRA and the GDPR and would significantly reduce the scope of the DPA's data protection framework at a time when VMS is transmitting VIN-linked telemetry data to Meridian.
Practical Impact on Non-Sensitive Data Categories. We acknowledge Meridian's point that some of the fourteen data categories — such as tire pressure readings, ambient noise levels, and windshield wiper activation events — may appear, in isolation, to lack personal data characteristics. However, when these data elements are transmitted alongside VINs and combined with GPS/geolocation data, they become part of a comprehensive profile of a vehicle's movements, environment, and usage patterns that is clearly "reasonably capable of being associated with" an identifiable individual. The protective scope of the DPA should not depend on whether individual data elements, viewed in isolation, appear personally identifying; it should reflect the reality of how the data is collected, transmitted, and processed as an integrated dataset.
D. Recommendation. We recommend that VMS maintain its broad "linkable" definition of Personal Data, consistent with the CCPA/CPRA standard and VMS's internal data governance policy. We further recommend rejecting the carve-out for pseudonymized data, which is inconsistent with applicable law and would create a significant gap in VMS's contractual protections.
As a potential area of compromise, VMS could agree to classify the fourteen data categories into tiers for purposes of applying differentiated security, access control, and retention obligations:
• Tier 1 — Sensitive Vehicle Data: GPS/geolocation data and seat occupancy data. Subject to the highest level of protection under the DPA, including the strictest retention, access control, encryption, and purpose limitation requirements.
• Tier 2 — Standard Vehicle Data: All remaining twelve data categories (tire pressure, ambient noise levels, windshield wiper activation, headlight/taillight status, engine performance metrics, braking patterns, steering input data, battery voltage readings, HVAC system usage, fuel consumption data, airbag system status, and infotainment system interaction logs). Subject to the standard data protection obligations under the DPA, which may be somewhat less restrictive than Tier 1 obligations in certain respects (e.g., access controls, retention review frequency).
Critically, however, all fourteen data categories would remain within the definition of "Personal Data" for definitional and jurisdictional purposes. The tiered approach addresses Meridian's concern that undifferentiated application of the highest security standards to all data categories may be operationally burdensome, while preserving VMS's position that all VIN-linked telemetry data is personal data and must be subject to the DPA's protections.
Issue 7: Data Return and Destruction Obligations upon Termination (DPA v1.0, Section 14)
A. VMS Position (DPA v1.0)
DPA v1.0, Section 14, provides that upon termination or expiration of the DPA (for any reason), Meridian must, at VMS's election, either: (a) return all VMS data to VMS in a machine-readable format specified by VMS, within thirty calendar days of the effective date of termination or expiration; or (b) irreversibly destroy all VMS data and provide a written certification of destruction, signed by an authorized officer of Meridian, within thirty calendar days. Section 14 expressly prohibits Meridian from retaining any copies, backups, or derivatives of VMS data following the completion of the return or destruction process.
B. Meridian/WBC Position (DPA v2.0 Redline)
WBC's Redline accepts the general framework of Section 14 but proposes three modifications:
(a) Extended Timeline. Meridian proposes a ninety-day period (rather than thirty days) for the completion of data return or destruction activities.
(b) Legal-Hold Exception. Meridian seeks the right to retain VMS data to the extent required by applicable law or regulation — for example, where Meridian is subject to a litigation hold, regulatory preservation obligation, or tax record-keeping requirement. Under Meridian's proposal, any data retained pursuant to this exception would remain subject to the DPA's confidentiality and data protection obligations for as long as it is retained.
(c) Derived Analytics / Model Parameters Exemption. This is the most significant of the three proposed modifications. Meridian proposes exempting "derived analytics" and "model parameters" from the return/destruction obligation, on the basis that these constitute Meridian's proprietary intellectual property and do not constitute "VMS data" within the meaning of the DPA. WBC's Comment No. 43 states that machine-learning model weights, trained parameters, and statistical aggregations generated by Meridian's processing of VMS data are "Meridian's work product, developed using Meridian's proprietary algorithms and infrastructure," and that requiring their deletion would "destroy Meridian's core intellectual property."
C. Analysis. Extended Timeline. A ninety-day return or destruction period is excessive for a sophisticated data processor with established data management capabilities. Meridian processes 4.2 terabytes of data per day; it should have the technical infrastructure and operational processes nec

MEMORANDUM

MATTER NO.: 1007-00007

Record

Parties

Dates

Amounts