1007-00007 · Vantage Mobility Systems Corp · Memos & Analysis

negotiation-call-summary-memo.docx DOCUMENT Finance & Banking

8 / 12 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

MEMORANDUM

TO: Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp. Thomas Langford, General Counsel, Vantage Mobility Systems Corp.

FROM: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP

DATE: November 15, 2022

RE: Summary of DPA Negotiation Call — Vantage Mobility Systems Corp. / Meridian Telematics Solutions, Inc.

Matter No.: 1007-00007

This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This memorandum is intended solely for the use of the individuals and entities identified in the distribution list below and should not be disclosed, distributed, or reproduced, in whole or in part, to any third party without the prior written consent of Calderwood & Harkness LLP.

I. Purpose and Overview

This memorandum summarizes the substance and outcomes of the negotiation call held on November 15, 2022, between counsel for Vantage Mobility Systems Corp. ("VMS") and counsel for Meridian Telematics Solutions, Inc. ("Meridian"), together with designated business representatives of both parties, regarding the Data Processing Agreement ("DPA") currently under negotiation between VMS and Meridian. The call was convened to address the eleven (11) material open issues identified in Calderwood & Harkness's internal issues memorandum circulated to the VMS deal team on November 4, 2022 (the "Issues Memorandum"), which arose from the redlined draft of the DPA (version 2.0) returned by Whitfield, Barrow & Crane LLP ("WBC"), counsel to Meridian, on October 21, 2022. WBC's redline contained sixty-three (63) substantive comments and proposed revisions to the initial draft DPA (version 1.0) that Calderwood & Harkness had circulated on behalf of VMS on September 28, 2022.

The call commenced at 2:00 p.m. Eastern Time and concluded at approximately 4:45 p.m. Eastern Time. The call was conducted via secure videoconference.

Of the eleven (11) material open issues identified in the Issues Memorandum, seven (7) were resolved in principle during the call, subject to final drafting in DPA version 3.0. Four (4) issues remain unresolved and will require further negotiation, additional internal consultation by VMS, and, in certain cases, input from VMS's private equity sponsor, Northgate Capital Partners. The sections below provide a detailed summary of each issue discussed, the positions advanced by each party, the resolutions reached (where applicable), and the status of unresolved items, together with recommended next steps.

II. Call Participants

The following individuals participated in the November 15, 2022 negotiation call:

Calderwood & Harkness LLP (Counsel to VMS):

• Rachel Bernstein — Partner, Privacy & Data Security

• Alan Burke — Senior Associate, Privacy & Data Security

Vantage Mobility Systems Corp.:

• Diana Kowalski — Chief Privacy Officer

Whitfield, Barrow & Crane LLP (Counsel to Meridian):

• Catherine Ng — Partner, Privacy & Cybersecurity

• Derek Yamada — Associate, Privacy & Cybersecurity

Meridian Telematics Solutions, Inc.:

• Lena Torrance — Head of Data Governance

The following individuals were not present on the call but are noted for context and completeness of the deal team roster:

• Kevin Ostrowski, Calderwood & Harkness LLP — Billing Partner (not required for substantive discussion)

• Sara Hendricks, Calderwood & Harkness LLP — Associate, Privacy & Data Security (assigned to drafting; not on this call)

• Thomas Langford, General Counsel, Vantage Mobility Systems Corp. — Mr. Langford was available by phone during the call window but did not dial in; Ms. Kowalski communicated with him by text message on one occasion during the call regarding the liability cap discussion (Issue 11)

• Marcus Chen, VP, Connected Services, Vantage Mobility Systems Corp. — unavailable due to prior commitment

• Priya Ramanathan, CEO, Meridian Telematics Solutions, Inc. — not on call

• Julian Voss, CTO, Meridian Telematics Solutions, Inc. — not on call

III. Background and Context

The following background is provided to contextualize the discussion and resolutions summarized in this memorandum.

A. The Commercial Relationship

VMS and Meridian executed a non-binding Letter of Intent ("LOI") on August 5, 2022, establishing the framework for a connected-vehicle data-sharing partnership. Under the proposed arrangement, Meridian would process and analyze real-time telematics and in-cabin sensor data generated by vehicles connected to VMS's proprietary VantageLink platform. The partnership is intended to enable Meridian to generate predictive maintenance insights, driver behavior scoring analytics, and fleet optimization analytics for VMS's commercial and consumer customer base.

The data sharing encompasses fourteen (14) discrete categories of vehicle telemetry and in-cabin sensor data drawn from approximately 800,000 opted-in vehicles. This subset represents approximately one-third of VMS's total connected-vehicle install base of approximately 2.4 million vehicles. The 800,000 opted-in vehicles generate approximately 4.2 terabytes of raw telemetry data per day, which would be transmitted to Meridian's AutoCloud analytics platform via secure API connections for processing and analysis.

Two of the fourteen data categories — GPS/geolocation data and seat occupancy data — are classified as "Sensitive Vehicle Data" under VMS's internal Data Governance Policy (Version 4.2, effective March 1, 2022) when such data is combined with, or transmitted alongside, vehicle identification numbers ("VINs"). This classification triggers enhanced processing restrictions and security requirements under VMS's internal governance framework.

B. Commercial Terms

The commercial terms of the partnership, as set forth in the LOI and incorporated by reference in the DPA, include the following:

• Annual Data Analytics License Fee: $6,500,000, payable in equal quarterly installments of $1,625,000 each, due within thirty (30) days of the commencement of each calendar quarter during the term;

• Royalty on Derivative Analytics Products: A 3.5% royalty on net revenues derived from the sale by Meridian to third parties of derivative analytics products that incorporate, or are materially derived from, VMS-sourced data;

• Term: A three (3)-year base term commencing on the effective date of the definitive agreements, with two (2) optional one (1)-year renewal periods exercisable by mutual written agreement of the parties; and

• Total Potential Contract Value: Approximately $19,500,000 for the base term (based on the annual license fee alone, excluding royalties), with additional value during any renewal periods and from royalty revenue streams.

C. DPA Negotiation History

The DPA negotiation has proceeded as follows:

1. Calderwood & Harkness prepared and circulated DPA version 1.0 to VMS for internal review on September 28, 2022. The initial draft comprised forty-seven (47) pages, including the main body of the agreement and three annexes (Annex A — Data Categories and Processing Details; Annex B — Technical and Organizational Security Measures; and Annex C — Sub-Processor List).

2. VMS approved DPA v1.0 with minor comments on October 7, 2022, at which point Calderwood & Harkness transmitted the draft to WBC on behalf of VMS.

3. WBC returned DPA version 2.0 on October 21, 2022, incorporating sixty-three (63) substantive comments and proposed revisions, along with a cover letter from Catherine Ng summarizing Meridian's principal areas of concern.

4. Calderwood & Harkness prepared the internal Issues Memorandum, dated November 4, 2022, analyzing WBC's redline and identifying eleven (11) material open issues requiring negotiation. The Issues Memorandum was circulated to Rachel Bernstein, Diana Kowalski, Thomas Langford, and Marcus Chen for review in advance of the November 15, 2022 negotiation call.

5. The November 15, 2022 negotiation call is the subject of this memorandum.

D. Applicable Regulatory Frameworks

The data processing activities contemplated by the DPA implicate the following regulatory frameworks, each of which informed the positions taken by the parties during the negotiation call:

• Michigan Identity Theft Protection Act (MCL 445.61 et seq.) — Applicable by virtue of VMS's incorporation and principal place of business in Michigan, and the Michigan governing law provision of the DPA.

• California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") (Cal. Civ. Code § 1798.100 et seq.) — Applicable due to the presence of approximately 112,000 California-registered vehicles within the 800,000 opted-in vehicle population, representing approximately 14% of the total data subject pool. The CCPA/CPRA imposes significant obligations on businesses and service providers with respect to the collection, processing, sale, and sharing of personal information of California residents, including statutory damages provisions that are relevant to the liability cap discussion (Issue 11 below).

• Federal Drivers' Privacy Protection Act ("DPPA") (18 U.S.C. § 2721 et seq.) — Applicable to the extent that data transmitted to Meridian constitutes "personal information" as defined in the DPPA, including information derived from motor vehicle records.

The DPA is governed by Michigan law, consistent with VMS's corporate domicile and the governing law provision agreed upon by the parties during the call (Issue 7 below).

IV. Resolved Issues (7 of 11)

The following seven issues were resolved in principle during the November 15, 2022 call. Final language reflecting these resolutions will be incorporated into DPA version 3.0, which Calderwood & Harkness will prepare and circulate to WBC on or before December 2, 2022. All resolutions described below are subject to final drafting review and approval by VMS.

A. Issue 1: Definition of "Personal Data" / "Personal Information"

VMS Position (DPA v1.0): VMS's initial draft adopted a broad, risk-based definition of "Personal Data" encompassing any data that, alone or in combination with other data (including VINs), could identify or be linked to an identifiable natural person. The definition explicitly included GPS/geolocation data and seat occupancy data when such data was associated with VINs, reflecting VMS's internal classification of those data categories as Sensitive Vehicle Data. This approach was designed to ensure maximum coverage under applicable privacy statutes and to align the contractual definition with the broadest applicable regulatory definition — specifically, the CCPA/CPRA's definition of "personal information" (Cal. Civ. Code § 1798.140(v)), which extends to information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."

Meridian Position (DPA v2.0): WBC's redline proposed a significantly narrower definition, limited to data that directly identifies an individual by name, address, email address, Social Security number, or other traditional direct identifiers. Meridian's position was that raw sensor data — such as tire pressure readings, engine diagnostic trouble codes, battery voltage levels, and ambient temperature measurements — does not constitute personal data unless and until it is affirmatively linked to a VIN and, through VMS's records, to an identifiable vehicle owner or lessee. Meridian argued that treating all fourteen categories of telemetry data as personal data regardless of linkage status would impose disproportionate compliance obligations and impair Meridian's ability to use the data for analytics and model development purposes.

Discussion: The parties engaged in a substantive discussion regarding the appropriate scope of the personal data definition. Catherine Ng acknowledged that GPS/geolocation data linked to VINs is clearly personal data under applicable law but maintained that mechanical sensor readings (e.g., tire pressure, engine RPM, coolant temperature) are not inherently personal in nature and should not be treated as such in the absence of linkage to an identifiable individual. Rachel Bernstein responded that the CCPA/CPRA's broad definition of personal information, together with increasing regulatory scrutiny of connected-vehicle data, counsels in favor of a comprehensive definition, particularly given that all fourteen data categories will be transmitted to Meridian alongside accompanying VINs in the initial data feed. Diana Kowalski noted that VMS's internal data governance framework treats all telemetry data as personal data when transmitted with VINs, and that the DPA should be consistent with VMS's internal policies.

Resolution: After extended discussion, the parties agreed on a tiered definitional framework that accommodates both parties' concerns:

(i) "Directly Identifiable Data" — Data that is linked to VINs and, through VMS's records, to individual vehicle owners or lessees. All fourteen categories of vehicle telemetry and in-cabin sensor data constitute Directly Identifiable Data when transmitted to Meridian with accompanying VINs in the initial data feed.

(ii) "Indirectly Identifiable Data" — Data that could become identifiable if combined with other reasonably available information, but that is not currently linked to a specific individual. Data that has been pseudonymized by Meridian (i.e., VINs stripped and replaced with non-reversible pseudonymous identifiers) after initial ingestion falls within this category.

Under the agreed framework, GPS/geolocation data and seat occupancy data linked to VINs are classified within the Directly Identifiable Data tier, reflecting their status as Sensitive Vehicle Data under VMS's internal governance policy. All fourteen data categories are treated as personal data for DPA purposes when transmitted with accompanying VINs. However, Meridian may apply pseudonymization procedures (specifically, stripping VINs from the data) after initial ingestion into its AutoCloud platform for analytics processing purposes. Upon completion of pseudonymization, the resulting pseudonymized data is reclassified as Indirectly Identifiable Data, which remains subject to the DPA's data protection obligations but with a reduced set of requirements reflecting the lower risk profile. The specific reduced obligations applicable to Indirectly Identifiable Data will be defined in DPA v3.0 and are expected to include relaxed access controls, modified audit rights, and adjusted breach notification requirements.

This resolution preserves VMS's core objective of ensuring comprehensive personal data protection at the point of data ingestion while providing Meridian with a workable framework for processing pseudonymized data for legitimate analytics purposes.

B. Issue 2: Purpose Limitation / Permitted Processing Purposes

VMS Position (DPA v1.0): VMS's initial draft contained a strict purpose limitation clause restricting Meridian's processing of VMS data to three specifically enumerated purposes: (i) generating predictive maintenance insights for VMS's vehicle fleet and customer base; (ii) producing driver behavior scoring analytics; and (iii) developing fleet optimization analytics. These three purposes were defined in alignment with the scope of work described in the LOI. Any processing for purposes other than these three enumerated purposes was expressly prohibited without VMS's prior written consent.

Meridian Position (DPA v2.0): WBC's redline sought to expand the permitted processing purposes to include two additional categories: (a) development of aggregate and anonymized analytics products by Meridian for commercial distribution, and (b) training of Meridian's proprietary machine-learning models using VMS-sourced data. Meridian's rationale, as articulated in WBC's cover letter and reiterated by Lena Torrance during the call, was that the ability to develop and commercialize analytics products incorporating insights derived from VMS data is a core component of Meridian's business model and a significant element of the commercial value proposition underlying the partnership. Meridian further argued that ML model training is essential to improving the quality and accuracy of the analytics outputs that directly benefit VMS under the three core permitted purposes.

Discussion: Rachel Bernstein expressed VMS's concern that permitting Meridian to develop and commercialize analytics products derived from VMS data, even in aggregate or anonymized form, could result in the indirect disclosure of VMS's proprietary information, competitive intelligence, or customer data to Meridian's other commercial customers and partners. Diana Kowalski emphasized that any use of VMS data beyond the three core purposes must be subject to robust safeguards ensuring that VMS data cannot be re-identified or reverse-engineered from anonymized or aggregated outputs. Catherine Ng responded that Meridian was willing to subject its anonymization methodology to VMS's review and approval, and that Meridian's standard anonymization processes employ k-anonymity, l-diversity, and differential privacy techniques that are widely accepted in the industry.

Resolution: The parties reached the following agreement:

Meridian may use VMS data for the three core permitted purposes (predictive maintenance insights, driver behavior scoring, and fleet optimization analytics) as well as for the development of aggregate and anonymized analytics products, subject to the following conditions:

(a) All data used by Meridian for analytics product development purposes must first be irreversibly anonymized — not merely pseudonymized. The standard for irreversible anonymization will be defined in DPA v3.0 and will require that the anonymization process render the data incapable of being re-associated with any identifiable natural person or specific vehicle, whether by Meridian alone or in combination with any other data set reasonably available to Meridian.

(b) Prior to applying any anonymization methodology to VMS data for product development purposes, Meridian must provide VMS with a detailed written description of the anonymization methodology, including the specific techniques employed (e.g., k-anonymity thresholds, differential privacy epsilon values, aggregation parameters), the data sets to which the methodology will be applied, and a technical assessment of re-identification risk.

(c) VMS retains the right to review and object to any proposed anonymization methodology within fifteen (15) business days of receipt of Meridian's written description. If VMS objects, Meridian may not proceed with the proposed anonymization methodology until the parties have resolved VMS's objections in writing. If VMS does not respond within the fifteen (15) business day review period, the proposed methodology shall be deemed approved.

Meridian's use of irreversibly anonymized data for machine-learning model training was accepted by VMS subject to the foregoing conditions. The parties acknowledged that this resolution strikes a balance between VMS's legitimate interest in controlling the use of its proprietary data and Meridian's commercial interest in leveraging analytics capabilities developed through the partnership.

C. Issue 3: Data Minimization and Collection Scope

VMS Position (DPA v1.0): VMS's initial draft provided that Meridian may only receive and process data falling within the fourteen (14) specific data categories enumerated in Annex A to the DPA. Annex A set forth a detailed schedule identifying each data category, the data fields within each category, the frequency of data collection, the technical format of the data feed, and the specific processing purpose(s) for which each data category was authorized. The data minimization clause required Meridian to process only the minimum amount of data necessary to achieve the specified processing purposes and prohibited the collection or processing of any data beyond the scope of Annex A.

Meridian Position (DPA v2.0): WBC's redline proposed the addition of a "future data categories" provision that would permit Meridian to receive and process additional data fields that may become available through updates to VMS's VantageLink platform without requiring a formal amendment to the DPA. Meridian argued that connected-vehicle platforms are rapidly evolving and that new data types — such as advanced driver-assistance system ("ADAS") telemetry, vehicle-to-everything ("V2X") communication data, and enhanced biometric cabin monitoring data — may become available during the term of the DPA. Meridian's position was that requiring a formal DPA amendment for each new data category would be unduly burdensome and would impair the parties' ability to capture value from platform enhancements in a timely manner.

Discussion: Diana Kowalski expressed strong opposition to any provision that would permit the scope of data processing to expand without VMS's affirmative written consent, noting that new data categories could implicate additional regulatory requirements (e.g., biometric data under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq.) or heightened sensitivity classifications under VMS's internal governance framework. Rachel Bernstein supported VMS's position and noted that automatic expansion of data processing scope would be inconsistent with the data minimization principle underlying applicable privacy regulations, including the CCPA/CPRA. Catherine Ng acknowledged the concern and indicated that Meridian would not insist on automatic expansion, provided that the amendment process is reasonably efficient.

Resolution: The parties agreed that any new data categories beyond the fourteen (14) categories enumerated in Annex A require a formal written amendment to the DPA, executed by authorized representatives of both parties. Meridian may not receive, access, process, or store additional data fields — regardless of their technical availability through the VantageLink platform or otherwise — without first executing such an amendment. The parties further agreed that the amendment process for adding new data categories will include, at a minimum, an updated Annex A identifying the new data category, its associated data fields, processing purposes, and applicable security measures, as well as a privacy impact assessment or equivalent analysis to be prepared by VMS (with Meridian's cooperation) addressing any regulatory implications of the expanded data processing scope. This resolution preserves VMS's control over the scope of data shared with Meridian and ensures compliance with applicable data minimization requirements.

D. Issue 4: Data Subject Rights Assistance

VMS Position (DPA v1.0): VMS's initial draft required Meridian to assist VMS in responding to data subject rights requests — including access requests, deletion requests, and opt-out requests — within five (5) business days of receiving VMS's written notification of such request. The obligation encompassed all forms of data subject rights requests under applicable law, including requests submitted by California consumers exercising their rights under the CCPA/CPRA (e.g., the right to know, the right to delete, and the right to opt-out of the sale or sharing of personal information). Meridian was required to bear all costs associated with providing such assistance, without reimbursement from VMS.

Meridian Position (DPA v2.0): WBC's redline proposed two modifications. First, Meridian sought to extend the response window from five (5) business days to fifteen (15) business days, citing the technical complexity of locating, extracting, and deleting specific data records from Meridian's distributed AutoCloud analytics platform, which processes data across multiple cloud environments and data lakes. Second, Meridian requested that VMS reimburse Meridian's reasonable costs for complying with data subject requests exceeding fifty (50) requests per calendar quarter, arguing that a high volume of data subject requests would impose significant operational burden and cost on Meridian's data governance team.

Discussion: Diana Kowalski noted that VMS currently receives an average of approximately 60–80 data subject requests per calendar quarter related to its connected-vehicle platform, with seasonal spikes following media coverage of data privacy issues in the automotive sector. She expressed concern that a fifteen (15) business day response window could impair VMS's ability to meet its own regulatory obligations — particularly under the CCPA/CPRA, which requires responses to consumer requests within forty-five (45) calendar days (with a possible forty-five (45) day extension). Rachel Bernstein emphasized that VMS must have sufficient time to review Meridian's response and compile its own response to the data subject before the regulatory deadline expires. Catherine Ng acknowledged the regulatory timeline constraints and indicated flexibility on the response window. Lena Torrance stated that the fifty (50) request threshold for cost reimbursement was too low given the size of the data subject population and suggested a higher threshold.

Resolution: The parties agreed on the following terms:

(a) Response Window: Meridian will respond to VMS's data subject rights assistance requests within ten (10) business days of receiving VMS's written notification. This provides VMS with adequate time to compile and submit its response to the data subject within applicable regulatory deadlines.

(b) Cost Allocation: Meridian will bear all costs associated with responding to the first one hundred (100) data subject requests per calendar quarter. For data subject requests exceeding one hundred (100) per calendar quarter, VMS will reimburse Meridian's reasonable, documented costs, subject to a cap of one hundred fifty dollars ($150) per request. Meridian must submit itemized invoices for reimbursement within thirty (30) days of the close of each calendar quarter.

Both parties acknowledged the particular significance of the CCPA/CPRA in the context of this provision, given that approximately 112,000 California-registered vehicles are included in the 800,000 opted-in vehicle pool, representing approximately 14% of the total data subject population. The parties agreed that the data subject rights assistance obligation extends to all applicable regulatory regimes, including the CCPA/CPRA, and is not limited to any single jurisdiction.

E. Issue 5: Return and Destruction of Data upon Termination

VMS Position (DPA v1.0): VMS's initial draft required Meridian, upon termination or expiration of the DPA for any reason, to: (i) return all VMS data in its possession or control to VMS within thirty (30) calendar days of the effective date of termination or expiration, in a format and on media reasonably specified by VMS; and (ii) certify the complete and irreversible destruction of all copies of VMS data (including copies in backup systems, disaster recovery environments, and archival storage) within forty-five (45) calendar days of the effective date of termination or expiration. The certification was required to be executed by an authorized officer of Meridian and delivered to VMS.

Meridian Position (DPA v2.0): WBC's redline proposed extending the data return period to ninety (90) calendar days and the certified destruction period to one hundred twenty (120) calendar days. Catherine Ng's cover letter explained that Meridian's AutoCloud platform utilizes a distributed cloud architecture with data replicated across multiple availability zones and stored in various formats (raw, processed, derived, cached, and archived). Meridian asserted that the technical complexity of identifying, extracting, and purging all instances of VMS data from this distributed environment — including from backup tapes, cold storage, and machine-learning training pipelines — required substantially more time than the thirty (30) and forty-five (45) day periods proposed by VMS.

Discussion: Diana Kowalski acknowledged the technical challenges associated with data purging from distributed cloud environments but expressed concern that the extended timelines proposed by Meridian would leave VMS data in Meridian's systems for an unreasonably long period following termination, during which the data would remain subject to security risks and potential unauthorized access. Rachel Bernstein noted that extended data retention periods following termination could also complicate VMS's compliance with data subject deletion requests received after the termination date. Lena Torrance provided additional detail regarding Meridian's data architecture and indicated that Meridian could likely complete the data return and destruction process within a shorter timeframe than the ninety (90) and one hundred twenty (120) day periods initially proposed, but that thirty (30) and forty-five (45) days were not operationally feasible.

Resolution: The parties agreed on the following terms:

(a) Data Return: Meridian will return all VMS data in its possession or control to VMS within forty-five (45) calendar days of the effective date of termination or expiration, in a format and on media reasonably specified by VMS. VMS will provide its format and media specifications to Meridian no later than fifteen (15) calendar days after the effective date of termination or expiration.

(b) Certified Destruction: Meridian will certify the complete and irreversible destruction of all copies of VMS data (including copies in backup systems, disaster recovery environments, archival storage, and machine-learning training pipelines) within sixty (60) calendar days of the effective date of termination or expiration. The certificate of destruction must be executed by an authorized officer of Meridian (at the level of Vice President or above) and delivered to VMS in writing.

(c) Legal Hold Exception: Meridian may retain VMS data beyond the sixty (60) calendar day destruction period only where, and to the extent that, retention is required by applicable law or regulation, or by a valid and enforceable legal hold, subpoena, or court order. In any such case, Meridian must: (1) promptly notify VMS in writing of the specific legal requirement mandating retention; (2) identify with particularity the specific data retained and the legal basis for retention; and (3) ensure that all retained data remains subject to the DPA's confidentiality obligations, security requirements, and access restrictions for the duration of the retention period. Upon the expiration of the applicable legal requirement, Meridian must promptly destroy the retained data and provide a supplemental certificate of destruction.

This resolution represents a reasonable compromise between VMS's interest in prompt data return and destruction and Meridian's legitimate operational constraints.

F. Issue 6: Confidentiality Obligations and Non-Disclosure

VMS Position (DPA v1.0): VMS's initial draft provided that all VMS data received by Meridian under the DPA constitutes "Confidential Information" of VMS and is subject to perpetual confidentiality obligations that survive the termination or expiration of the DPA indefinitely. Meridian was prohibited from disclosing, using, or making available any VMS Confidential Information for any purpose other than the permitted processing purposes defined in the DPA, and was required to protect VMS Confidential Information with at least the same degree of care that Meridian uses to protect its own confidential information, but in no event less than a reasonable standard of care.

Meridian Position (DPA v2.0): WBC's redline proposed two modifications. First, Meridian sought to limit the survival period for confidentiality obligations to five (5) years following the termination or expiration of the DPA, arguing that perpetual confidentiality obligations are uncommon in commercial data processing agreements and impose an indefinite compliance burden on Meridian. Second, Meridian sought to exclude irreversibly anonymized and aggregated data from the scope of the confidentiality obligations, on the basis that such data, by definition, does not identify VMS, its vehicles, or its customers, and therefore does not warrant confidential treatment.

Discussion: Rachel Bernstein acknowledged that perpetual confidentiality obligations, while appropriate for certain categories of highly sensitive information, may be broader than necessary for all data categories covered by the DPA. However, she emphasized that a five (5) year survival period may be insufficient given the nature of the data and the potential for long-tail regulatory exposure. Diana Kowalski noted that VMS's internal data governance policy requires a minimum seven (7) year confidentiality period for personally identifiable information shared with third-party processors. Catherine Ng indicated that Meridian could accept a longer survival period and that the primary concern was avoiding a perpetual obligation. The parties also discussed the treatment of trade secrets, with Rachel Bernstein noting that trade secret protections under Michigan law (MCL 445.1901 et seq.) and applicable federal law survive independently of any contractual confidentiality period.

Resolution: The parties agreed on the following terms:

(a) Survival Period: Confidentiality obligations with respect to Directly Identifiable Data and Indirectly Identifiable Data (as defined per the resolution of Issue 1 above) survive for seven (7) years following the termination or expiration of the DPA.

(b) Exclusion for Anonymized Data: Data that has been irreversibly anonymized in accordance with the anonymization methodology approved by VMS pursuant to the resolution of Issue 2 above is excluded from the DPA's confidentiality obligations upon completion of the anonymization process. For avoidance of doubt, data that has been pseudonymized (but not irreversibly anonymized) remains subject to the full confidentiality obligations for the seven (7) year survival period.

(c) Trade Secret Protection: Nothing in the DPA limits or modifies either party's rights or obligations with respect to trade secrets under applicable law, including the Michigan Uniform Trade Secrets Act (MCL 445.1901 et seq.) and the federal Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.). Trade secret protections survive indefinitely regardless of the seven (7) year contractual confidentiality period.

G. Issue 7: Governing Law and Dispute Resolution

VMS Position (DPA v1.0): VMS's initial draft specified Michigan as the governing law jurisdiction and provided for the exclusive jurisdiction of state and federal courts sitting in Wayne County, Michigan (i.e., the United States District Court for the Eastern District of Michigan and the Wayne County Circuit Court) for the resolution of any disputes arising out of or relating to the DPA.

Meridian Position (DPA v2.0): WBC's redline proposed California as the governing law jurisdiction and substituted binding arbitration under JAMS Comprehensive Arbitration Rules and Procedures, seated in San Francisco, California, for court-based dispute resolution. Meridian's rationale, as stated in WBC's cover letter, was that Meridian is incorporated in Delaware and headquartered in San Jose, California, that a substantial portion of Meridian's workforce and data processing operations are located in California, and that California's well-developed body of technology and data privacy law provides a more appropriate framework for the interpretation of a data processing agreement of this nature.

Discussion: Rachel Bernstein stated that VMS's strong preference for Michigan governing law reflects VMS's Michigan incorporation, its headquarters in Dearborn, Michigan, its workforce concentration in Michigan, and the predominance of Michigan law in VMS's existing vendor and data processing agreements. She noted that VMS is familiar with Michigan's regulatory and litigation environment and that Michigan governing law provides VMS with the most predictable framework for contract interpretation and dispute resolution. Diana Kowalski added that VMS's board of directors and Northgate Capital Partners have consistently required Michigan governing law in VMS's material commercial agreements. Catherine Ng did not strongly contest the governing law issue but advocated for arbitration rather than court litigation, arguing that arbitration provides a more efficient, confidential, and predictable dispute resolution mechanism for complex data processing disputes. Derek Yamada noted that arbitration would allow the parties to select an arbitrator with specialized expertise in data privacy and technology law.

Resolution: The parties agreed on the following terms:

(a) Governing Law: The DPA will be governed by and construed in accordance with the laws of the State of Michigan, without regard to its conflicts of law principles.

(b) Dispute Resolution — Two-Step Process:

(i) Mandatory Mediation: In the event of any dispute, controversy, or claim arising out of or relating to the DPA, or the breach, termination, or validity thereof, the aggrieved party must first submit the dispute to non-binding mediation. Mediation will be conducted in Detroit, Michigan, before a mutually agreed mediator, and must commence within thirty (30) days of the aggrieved party's delivery of written notice of the dispute to the other party.

(ii) Binding Arbitration: If mediation does not result in a resolution of the dispute within thirty (30) days of the commencement of mediation (or such longer period as the parties may agree in writing), either party may submit the dispute to binding arbitration administered by the American Arbitration Association ("AAA") under the AAA Commercial Arbitration Rules then in effect. The arbitration will be seated in Detroit, Michigan, and conducted before a single arbitrator selected in accordance with the AAA's arbitrator selection procedures. Each party will bear its own costs and attorneys' fees incurred in connection with the mediation and arbitration, provided that the arbitrator may, in the arbitrator's discretion, award reasonable attorneys' fees and costs to the prevailing party.

(c) Injunctive Relief: Notwithstanding the foregoing, either party may seek temporary, preliminary, or permanent injunctive relief, or other equitable remedies, in any state or federal court of competent jurisdiction sitting in Michigan, without first exhausting the mediation and arbitration process described above. The parties consent to the personal jurisdiction of the state and federal courts sitting in Wayne County, Michigan, for purposes of any such proceeding.

This resolution accommodates VMS's governing law preference and Meridian's preference for alternative dispute resolution, while preserving both parties' ability to seek emergency equitable relief through the courts.

V. Unresolved Issues (4 of 11)

The following four issues were not resolved during the November 15, 2022 call and will require further negotiation, internal consultation, and, in certain cases, additional information (including the results of the pending Pinehurst Cybersecurity Advisors LLC security assessment). Each issue is summarized below, together with a description of the positions advanced by the parties, the substance of the discussion, and the current status.

A. Issue 8: Data Retention Period

VMS Position: VMS seeks a ninety (90)-day rolling deletion requirement for raw telemetry data after processing. Under this framework, raw telemetry data transmitted to Meridian would be deleted from Meridian's systems within ninety (90) calendar days of ingestion, with only processed, derived, and aggregated outputs retained beyond that period. VMS's position is that raw telemetry data — which contains Directly Identifiable Data linked to VINs — should not be retained by Meridian beyond the period necessary to perform the contracted analytics services, and that the ongoing retention of raw identifiable data creates unnecessary risk exposure for VMS.

Meridian Position: Meridian seeks an eighteen (18)-month retention period for raw telemetry data, primarily for machine-learning model training purposes. Meridian's position is that shorter retention periods would materially impair the quality, accuracy, and predictive power of its machine-learning models, which require longitudinal data spanning multiple seasonal cycles, weather patterns, driving conditions, and vehicle maintenance intervals to achieve statistical reliability. Meridian asserted that an eighteen (18)-month retention period is consistent with industry standards for automotive machine-learning applications.

Discussion: Lena Torrance presented Meridian's technical rationale in detail during the call. She explained that Meridian's predictive maintenance models rely on supervised learning techniques that require training data sets encompassing at least twelve (12) months of continuous longitudinal data per vehicle to account for seasonal variability, component degradation curves, and driving pattern changes. She stated that limiting raw data retention to ninety (90) days would result in models trained on fragmentary data, leading to reduced prediction accuracy and higher false positive rates, which would ultimately diminish the value of the analytics outputs delivered to VMS. She cited internal benchmarking data indicating that model accuracy (as measured by F1 score) improves by approximately 23% when training data spans twelve months compared to three months.

Diana Kowalski responded that retaining raw, identifiable (or pseudonymized) telemetry data for eighteen (18) months significantly increases VMS's risk exposure, particularly with respect to the approximately 112,000 California-registered vehicles in the opted-in pool. She noted that a longer retention period increases the volume of data at risk in the event of a breach, amplifies potential regulatory penalties (particularly statutory damages under the CCPA/CPRA), and expands the window during which data subject deletion requests may need to be honored. She further noted that VMS's internal data governance policy mandates that third-party processors delete or return personal data as soon as it is no longer necessary for the specified processing purpose, and that an eighteen-month rolling retention period is difficult to reconcile with that requirement.

Rachel Bernstein proposed a potential compromise framework during the discussion, noting the distinction between retaining raw data (which contains or is linked to Directly Identifiable Data) and retaining processed, derived, or aggregated outputs (which may be pseudonymized or anonymized and present a lower risk profile). She suggested that the parties consider a shorter raw data retention period — potentially in the range of one hundred twenty (120) to one hundred eighty (180) calendar days — with longer retention permitted for derived outputs, pseudonymized data sets, or irreversibly anonymized data only. This approach would limit the period during which identifiable raw telemetry is maintained in Meridian's systems while still providing Meridian with longitudinal derived data for model training purposes. Catherine Ng indicated that Meridian would consider the proposal but needed to consult with Julian Voss (Meridian CTO) regarding the technical feasibility of training models on derived outputs rather than raw data.

Status: Unresolved. The parties agreed to exchange revised proposals in writing. Calderwood & Harkness will draft compromise language reflecting the framework suggested by Rachel Bernstein (shorter raw data retention with extended retention for derived/anonymized outputs) for VMS's review prior to inclusion in DPA v3.0. Meridian committed to providing a technical memorandum from its data science team addressing whether derived outputs (as opposed to raw telemetry) can serve as adequate training data for its machine-learning models.

B. Issue 9: Sub-Processor Approval Rights

VMS Position: VMS requires prior written consent for all sub-processors engaged by Meridian to process VMS data, with no exceptions. Under VMS's proposed framework, Meridian may not engage any sub-processor to process any category of VMS data — whether Directly Identifiable Data, Indirectly Identifiable Data, pseudonymized data, or anonymized data — without first obtaining VMS's express written consent. VMS views this requirement as essential to maintaining contractual and operational control over the entities that access, process, and store its proprietary vehicle telemetry data, particularly data classified as Sensitive Vehicle Data.

Meridian Position: Meridian proposes a general authorization model in which Meridian provides VMS with an initial list of its existing sub-processors (to be set forth in Annex C to the DPA) and updates the list periodically. When Meridian intends to engage a new sub-processor or replace an existing sub-processor, it would provide VMS with written notice of the proposed change, including the identity of the sub-processor, the nature and scope of the processing to be performed, and the location(s) of the sub-processor's data processing facilities. VMS would then have a thirty (30)-day objection window following receipt of the notice to object to the proposed sub-processor. If VMS does not submit a written objection within the thirty (30)-day window, the sub-processor would be deemed approved. If VMS objects, the parties would discuss the objection in good faith, and if the objection cannot be resolved, VMS would have the right to terminate the DPA upon sixty (60) days' written notice.

Discussion: Catherine Ng argued at length that the prior written consent model proposed by VMS is operationally burdensome and inconsistent with prevailing industry practice for cloud-based analytics platforms that rely on dynamic ecosystems of infrastructure providers, API services, and specialized processing vendors. She noted that Meridian currently utilizes Cloudvault Infrastructure, Inc. ("Cloudvault") as its primary cloud hosting provider for the AutoCloud platform, pursuant to a master services agreement between Meridian and Cloudvault executed on March 1, 2021. Cloudvault operates data centers in Reno, Nevada, and Columbus, Ohio, both of which are SOC 2 Type II certified. Catherine Ng stated that requiring Meridian to obtain VMS's prior written consent before engaging any new sub-processor — including infrastructure-level service providers performing routine hosting, caching, or content delivery functions — would create unacceptable operational delays and impair Meridian's ability to maintain and upgrade its platform.

Rachel Bernstein emphasized VMS's heightened sensitivity regarding sub-processor access to its data, given the nature of the data involved (vehicle telemetry linked to identifiable individuals), VMS's obligations under applicable privacy statutes, and VMS's internal data governance framework. She noted that VMS's PE sponsor, Northgate Capital Partners, has implemented portfolio-wide cybersecurity and data governance standards that require prior approval of all material sub-processors, and that VMS must ensure its contractual arrangements are consistent with these requirements. She further noted that the CCPA/CPRA imposes service provider obligations that extend to sub-processors, and that VMS must maintain adequate contractual controls to ensure compliance throughout the processing chain.

Lena Torrance indicated a willingness to pre-approve Cloudvault by including it in the initial sub-processor list (Annex C) and to provide VMS with a comprehensive initial list of all current sub-processors. However, she resisted the blanket prior written consent requirement for all future sub-processors, characterizing it as disproportionate and operationally impractical. She suggested that a differentiated approach — in which the level of VMS approval required varies based on the sensitivity of the data processed by the sub-processor — might be acceptable to Meridian.

Diana Kowalski stated that VMS's core concern is ensuring that it has contractual control over which entities access data classified as Sensitive Vehicle Data (i.e., GPS/geolocation and seat occupancy data linked to VINs) and that it has meaningful visibility into and influence over the sub-processor ecosystem more broadly. She indicated openness to considering a differentiated approach, provided that the highest level of control (prior written consent) applies to any sub-processor with access to Directly Identifiable Data or Sensitive Vehicle Data.

Status: Unresolved. Calderwood & Harkness will prepare a hybrid sub-processor approval proposal for VMS's consideration, structured as follows:

(i) Prior Written Consent: Required for any sub-processor that will process, access, or store Directly Identifiable Data or Sensitive Vehicle Data (GPS/geolocation and seat occupancy data linked to VINs);

(ii) General Authorization with Objection Rights: Applicable to sub-processors that process only pseudonymized data, anonymized data, or Indirectly Identifiable Data, subject to Meridian's obligation to provide VMS with advance written notice and a thirty (30)-day objection window.

The hybrid proposal will be prepared as a separate memorandum for Rachel Bernstein and Diana Kowalski by November 21, 2022. The analysis will also take into account any preliminary findings from the Pinehurst Cybersecurity Advisors LLC security assessment of Meridian's data processing environment, which is expected to be delivered in late November 2022. The Pinehurst assessment may provide additional information regarding the security posture and capabilities of Meridian's existing sub-processors that could inform VMS's position.

C. Issue 10: Breach Notification Timeline

VMS Position: VMS requires Meridian to notify VMS within twenty-four (24) hours of Meridian's discovery of any personal data breach affecting VMS data. VMS's position is that a twenty-four (24) hour notification window is necessary to provide VMS with adequate time to assess the breach, activate its own incident response procedures, and meet its downstream notification obligations to affected data subjects, regulators, and other stakeholders.

Meridian Position: Meridian proposes a seventy-two (72) hour notification window, aligned with the notification timeline established by Article 33(1) of the European Union General Data Protection Regulation ("GDPR"), which requires data controllers to notify supervisory authorities of a personal data breach within seventy-two (72) hours of becoming aware of the breach. Meridian argues that a twenty-four (24) hour notification window is insufficient to conduct a meaningful preliminary investigation, confirm whether a breach has actually occurred (as opposed to a false positive or security event that does not rise to the level of a breach), and determine the nature, scope, and severity of the incident.

Discussion: Lena Torrance provided a detailed explanation of Meridian's incident response procedures during the call. She stated that Meridian's Security Operations Center ("SOC") receives an average of approximately 1,200 security alerts per week from automated monitoring systems, of which approximately 3–5% (approximately 36–60 per week) require escalation for further investigation, and of which fewer than 0.1% (approximately 1–2 per month) are ultimately confirmed as security incidents meeting the threshold for breach notification. She argued that imposing a twenty-four (24) hour notification obligation from the point of "Discovery" of a breach — particularly if "Discovery" is defined broadly to include initial detection of anomalous activity — would likely result in a significant volume of premature notifications for events that are subsequently determined to be false positives or non-material security events. Such over-notification, she argued, would divert VMS's internal resources, create unnecessary alarm, and potentially trigger downstream notification cascades that are unwarranted by the actual severity of the event.

Diana Kowalski responded that VMS's internal data governance policy and Northgate Capital Partners' portfolio-wide cybersecurity requirements mandate twenty-four (24) hour notification to VMS from any data processor that experiences a confirmed or suspected breach affecting VMS data. She explained that VMS has downstream notification obligations — both contractual (to its OEM and fleet management partners) and regulatory (under applicable state breach notification laws) — that require VMS to act quickly upon receiving notification of a breach. A seventy-two (72) hour delay in notification from Meridian could compress VMS's response window to an unacceptable degree and could result in VMS failing to meet its own notification deadlines.

Rachel Bernstein noted that the Michigan Identity Theft Protection Act (MCL 445.61 et seq.) does not specify a precise notification window but requires notification "without unreasonable delay," and that a twenty-four (24) hour contractual standard provides VMS with adequate time to meet its own downstream obligations. She further noted that while the GDPR seventy-two (72) hour standard is a useful benchmark, it applies to a different regulatory context (controller-to-supervisory authority notification, not processor-to-controller notification) and does not necessarily represent the appropriate standard for the VMS-Meridian processing relationship.

Catherine Ng argued that the twenty-four (24) hour standard, while understandable from VMS's perspective, is not practically achievable for a complex, distributed cloud analytics platform and that the GDPR seventy-two (72) hour standard has emerged as a widely accepted industry benchmark for processor-to-controller notification even outside the GDPR's territorial scope.

During the discussion, the parties informally explored the possibility of a two-tier notification approach:

(i) Preliminary Notification (24 hours): Within twenty-four (24) hours of Meridian's discovery of a suspected personal data breach affecting VMS data, Meridian would provide VMS with a brief written preliminary notification identifying: the nature of the suspected incident; the date and time of discovery; the data categories and approximate number of data subjects potentially affected (if known); and the initial steps taken by Meridian to investigate and mitigate the incident.

(ii) Detailed Incident Report (72 hours): Within seventy-two (72) hours of Meridian's discovery of the suspected breach, Meridian would provide VMS with a detailed written incident report containing full particulars, including: a comprehensive description of the nature and scope of the breach; the specific data categories and data subjects affected; the likely consequences of the breach; the measures taken or proposed to address the breach and mitigate its adverse effects; and the identity and contact information of Meridian's designated incident response coordinator.

While this two-tier framework was discussed informally and appeared to generate interest from both sides, no formal agreement was reached during the call.

Status: Unresolved. The two-tier notification framework discussed during the call will be developed into formal proposed language by Sara Hendricks for internal review by Rachel Bernstein and Diana Kowalski. The proposal will also address the definition of "Discovery" for purposes of triggering the notification obligation and will consider whether different notification timelines should apply depending on the severity or scope of the breach.

D. Issue 11: Liability Cap for Data Breaches and Unauthorized Processing

VMS Position: VMS seeks uncapped liability for losses arising from data breaches and unauthorized processing of VMS data by Meridian. VMS's rationale is that the volume of data involved (approximately 800,000 opted-in vehicles generating approximately 4.2 terabytes of raw telemetry per day), the sensitivity of certain data categories (GPS/geolocation and seat occupancy data), and the potential regulatory exposure — particularly under the CCPA/CPRA, which provides for statutory damages in the range of $100–$750 per consumer per incident (Cal. Civ. Code § 1798.150(a)(1)) — make a fixed liability cap unworkable and inequitable. VMS estimates that, in a worst-case scenario involving a breach affecting all 112,000 California-registered vehicles, potential CCPA/CPRA statutory damages alone could range from approximately $11.2 million (at $100 per consumer) to approximately $84 million (at $750 per consumer), exclusive of actual damages, regulatory fines, attorneys' fees, and litigation costs.

Meridian Position: Meridian proposes a liability cap of $15,000,000 (fifteen million dollars) for all claims arising from data breaches and unauthorized processing, representing approximately 2.31 times the annual license fee of $6,500,000. Meridian asserts that uncapped liability is commercially unacceptable and would expose Meridian to potentially existential financial risk. Meridian further argues that a $15 million cap significantly exceeds industry norms for data processing agreements of comparable scope and scale, and that VMS's uncapped liability position is disproportionate to the commercial value of the partnership.

Discussion: This issue generated the most extensive and contentious discussion during the call.

Catherine Ng stated unequivocally that Meridian's board of directors and its insurers would not approve a DPA containing uncapped data breach liability. She noted that Meridian's existing cyber liability insurance policy provides coverage of $10 million per occurrence and $20 million in the aggregate, and that a $15 million contractual cap is consistent with the available insurance coverage. She further stated that uncapped liability provisions are extremely rare in data processing agreements in the connected-vehicle and telematics sector and that VMS's position is a significant outlier relative to market practice.

Rachel Bernstein countered that VMS's potential exposure in a significant data breach — encompassing CCPA/CPRA statutory damages, regulatory fines and penalties, class action litigation defense costs and settlements, business interruption losses, reputational harm, and contractual indemnification obligations to VMS's OEM and fleet management partners — could substantially exceed $15 million. She noted that a $15 million cap would potentially leave VMS with tens of millions of dollars in unrecoverable losses in a severe breach scenario, and that this risk allocation is unacceptable to VMS and its PE sponsor.

Lena Torrance suggested that Meridian could explore obtaining enhanced cyber insurance coverage to support a higher liability cap but stated that Meridian could not agree to uncapped exposure under any circumstances. She indicated that Meridian would be willing to discuss a higher cap — potentially in the range of $20–25 million — if VMS would agree to a defined limit. She also noted that Meridian's willingness to agree to a higher cap would be contingent upon the resolution of other outstanding issues, including the data retention period (Issue 8), which directly affects the volume of data at risk in a breach scenario.

Diana Kowalski indicated that Northgate Capital Partners, as VMS's private equity sponsor, has strong views on adequate downside protection in VMS's material vendor agreements and that she would need to consult with Erik Johansson (Northgate Managing Director) and Thomas Langford (VMS G

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp. Thomas Langford, General Counsel, Vantage Mobility Systems Corp.
FROM: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: November 15, 2022
RE: Summary of DPA Negotiation Call — Vantage Mobility Systems Corp. / Meridian Telematics Solutions, Inc.
Matter No.: 1007-00007
This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and in connection with the provision of legal advice. This memorandum is intended solely for the use of the individuals and entities identified in the distribution list below and should not be disclosed, distributed, or reproduced, in whole or in part, to any third party without the prior written consent of Calderwood & Harkness LLP.
I. Purpose and Overview
This memorandum summarizes the substance and outcomes of the negotiation call held on November 15, 2022, between counsel for Vantage Mobility Systems Corp. ("VMS") and counsel for Meridian Telematics Solutions, Inc. ("Meridian"), together with designated business representatives of both parties, regarding the Data Processing Agreement ("DPA") currently under negotiation between VMS and Meridian. The call was convened to address the eleven (11) material open issues identified in Calderwood & Harkness's internal issues memorandum circulated to the VMS deal team on November 4, 2022 (the "Issues Memorandum"), which arose from the redlined draft of the DPA (version 2.0) returned by Whitfield, Barrow & Crane LLP ("WBC"), counsel to Meridian, on October 21, 2022. WBC's redline contained sixty-three (63) substantive comments and proposed revisions to the initial draft DPA (version 1.0) that Calderwood & Harkness had circulated on behalf of VMS on September 28, 2022.
The call commenced at 2:00 p.m. Eastern Time and concluded at approximately 4:45 p.m. Eastern Time. The call was conducted via secure videoconference.
Of the eleven (11) material open issues identified in the Issues Memorandum, seven (7) were resolved in principle during the call, subject to final drafting in DPA version 3.0. Four (4) issues remain unresolved and will require further negotiation, additional internal consultation by VMS, and, in certain cases, input from VMS's private equity sponsor, Northgate Capital Partners. The sections below provide a detailed summary of each issue discussed, the positions advanced by each party, the resolutions reached (where applicable), and the status of unresolved items, together with recommended next steps.
II. Call Participants
The following individuals participated in the November 15, 2022 negotiation call:
Calderwood & Harkness LLP (Counsel to VMS):
•  Rachel Bernstein — Partner, Privacy & Data Security
•  Alan Burke — Senior Associate, Privacy & Data Security
Vantage Mobility Systems Corp.:
•  Diana Kowalski — Chief Privacy Officer
Whitfield, Barrow & Crane LLP (Counsel to Meridian):
•  Catherine Ng — Partner, Privacy & Cybersecurity
•  Derek Yamada — Associate, Privacy & Cybersecurity
Meridian Telematics Solutions, Inc.:
•  Lena Torrance — Head of Data Governance
The following individuals were not present on the call but are noted for context and completeness of the deal team roster:
•  Kevin Ostrowski, Calderwood & Harkness LLP — Billing Partner (not required for substantive discussion)
•  Sara Hendricks, Calderwood & Harkness LLP — Associate, Privacy & Data Security (assigned to drafting; not on this call)
•  Thomas Langford, General Counsel, Vantage Mobility Systems Corp. — Mr. Langford was available by phone during the call window but did not dial in; Ms. Kowalski communicated with him by text message on one occasion during the call regarding the liability cap discussion (Issue 11)
•  Marcus Chen, VP, Connected Services, Vantage Mobility Systems Corp. — unavailable due to prior commitment
•  Priya Ramanathan, CEO, Meridian Telematics Solutions, Inc. — not on call
•  Julian Voss, CTO, Meridian Telematics Solutions, Inc. — not on call
III. Background and Context
The following background is provided to contextualize the discussion and resolutions summarized in this memorandum.
A. The Commercial Relationship
VMS and Meridian executed a non-binding Letter of Intent ("LOI") on August 5, 2022, establishing the framework for a connected-vehicle data-sharing partnership. Under the proposed arrangement, Meridian would process and analyze real-time telematics and in-cabin sensor data generated by vehicles connected to VMS's proprietary VantageLink platform. The partnership is intended to enable Meridian to generate predictive maintenance insights, driver behavior scoring analytics, and fleet optimization analytics for VMS's commercial and consumer customer base.
The data sharing encompasses fourteen (14) discrete categories of vehicle telemetry and in-cabin sensor data drawn from approximately 800,000 opted-in vehicles. This subset represents approximately one-third of VMS's total connected-vehicle install base of approximately 2.4 million vehicles. The 800,000 opted-in vehicles generate approximately 4.2 terabytes of raw telemetry data per day, which would be transmitted to Meridian's AutoCloud analytics platform via secure API connections for processing and analysis.
Two of the fourteen data categories — GPS/geolocation data and seat occupancy data — are classified as "Sensitive Vehicle Data" under VMS's internal Data Governance Policy (Version 4.2, effective March 1, 2022) when such data is combined with, or transmitted alongside, vehicle identification numbers ("VINs"). This classification triggers enhanced processing restrictions and security requirements under VMS's internal governance framework.
B. Commercial Terms
The commercial terms of the partnership, as set forth in the LOI and incorporated by reference in the DPA, include the following:
•  Annual Data Analytics License Fee: $6,500,000, payable in equal quarterly installments of $1,625,000 each, due within thirty (30) days of the commencement of each calendar quarter during the term;
•  Royalty on Derivative Analytics Products: A 3.5% royalty on net revenues derived from the sale by Meridian to third parties of derivative analytics products that incorporate, or are materially derived from, VMS-sourced data;
•  Term: A three (3)-year base term commencing on the effective date of the definitive agreements, with two (2) optional one (1)-year renewal periods exercisable by mutual written agreement of the parties; and
•  Total Potential Contract Value: Approximately $19,500,000 for the base term (based on the annual license fee alone, excluding royalties), with additional value during any renewal periods and from royalty revenue streams.
C. DPA Negotiation History
The DPA negotiation has proceeded as follows:
1.  Calderwood & Harkness prepared and circulated DPA version 1.0 to VMS for internal review on September 28, 2022. The initial draft comprised forty-seven (47) pages, including the main body of the agreement and three annexes (Annex A — Data Categories and Processing Details; Annex B — Technical and Organizational Security Measures; and Annex C — Sub-Processor List).
2.  VMS approved DPA v1.0 with minor comments on October 7, 2022, at which point Calderwood & Harkness transmitted the draft to WBC on behalf of VMS.
3.  WBC returned DPA version 2.0 on October 21, 2022, incorporating sixty-three (63) substantive comments and proposed revisions, along with a cover letter from Catherine Ng summarizing Meridian's principal areas of concern.
4.  Calderwood & Harkness prepared the internal Issues Memorandum, dated November 4, 2022, analyzing WBC's redline and identifying eleven (11) material open issues requiring negotiation. The Issues Memorandum was circulated to Rachel Bernstein, Diana Kowalski, Thomas Langford, and Marcus Chen for review in advance of the November 15, 2022 negotiation call.
5.  The November 15, 2022 negotiation call is the subject of this memorandum.
D. Applicable Regulatory Frameworks
The data processing activities contemplated by the DPA implicate the following regulatory frameworks, each of which informed the positions taken by the parties during the negotiation call:
•  Michigan Identity Theft Protection Act (MCL 445.61 et seq.) — Applicable by virtue of VMS's incorporation and principal place of business in Michigan, and the Michigan governing law provision of the DPA.
•  California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") (Cal. Civ. Code § 1798.100 et seq.) — Applicable due to the presence of approximately 112,000 California-registered vehicles within the 800,000 opted-in vehicle population, representing approximately 14% of the total data subject pool. The CCPA/CPRA imposes significant obligations on businesses and service providers with respect to the collection, processing, sale, and sharing of personal information of California residents, including statutory damages provisions that are relevant to the liability cap discussion (Issue 11 below).
•  Federal Drivers' Privacy Protection Act ("DPPA") (18 U.S.C. § 2721 et seq.) — Applicable to the extent that data transmitted to Meridian constitutes "personal information" as defined in the DPPA, including information derived from motor vehicle records.
The DPA is governed by Michigan law, consistent with VMS's corporate domicile and the governing law provision agreed upon by the parties during the call (Issue 7 below).
IV. Resolved Issues (7 of 11)
The following seven issues were resolved in principle during the November 15, 2022 call. Final language reflecting these resolutions will be incorporated into DPA version 3.0, which Calderwood & Harkness will prepare and circulate to WBC on or before December 2, 2022. All resolutions described below are subject to final drafting review and approval by VMS.
A. Issue 1: Definition of "Personal Data" / "Personal Information"
VMS Position (DPA v1.0): VMS's initial draft adopted a broad, risk-based definition of "Personal Data" encompassing any data that, alone or in combination with other data (including VINs), could identify or be linked to an identifiable natural person. The definition explicitly included GPS/geolocation data and seat occupancy data when such data was associated with VINs, reflecting VMS's internal classification of those data categories as Sensitive Vehicle Data. This approach was designed to ensure maximum coverage under applicable privacy statutes and to align the contractual definition with the broadest applicable regulatory definition — specifically, the CCPA/CPRA's definition of "personal information" (Cal. Civ. Code § 1798.140(v)), which extends to information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."
Meridian Position (DPA v2.0): WBC's redline proposed a significantly narrower definition, limited to data that directly identifies an individual by name, address, email address, Social Security number, or other traditional direct identifiers. Meridian's position was that raw sensor data — such as tire pressure readings, engine diagnostic trouble codes, battery voltage levels, and ambient temperature measurements — does not constitute personal data unless and until it is affirmatively linked to a VIN and, through VMS's records, to an identifiable vehicle owner or lessee. Meridian argued that treating all fourteen categories of telemetry data as personal data regardless of linkage status would impose disproportionate compliance obligations and impair Meridian's ability to use the data for analytics and model development purposes.
Discussion: The parties engaged in a substantive discussion regarding the appropriate scope of the personal data definition. Catherine Ng acknowledged that GPS/geolocation data linked to VINs is clearly personal data under applicable law but maintained that mechanical sensor readings (e.g., tire pressure, engine RPM, coolant temperature) are not inherently personal in nature and should not be treated as such in the absence of linkage to an identifiable individual. Rachel Bernstein responded that the CCPA/CPRA's broad definition of personal information, together with increasing regulatory scrutiny of connected-vehicle data, counsels in favor of a comprehensive definition, particularly given that all fourteen data categories will be transmitted to Meridian alongside accompanying VINs in the initial data feed. Diana Kowalski noted that VMS's internal data governance framework treats all telemetry data as personal data when transmitted with VINs, and that the DPA should be consistent with VMS's internal policies.
Resolution: After extended discussion, the parties agreed on a tiered definitional framework that accommodates both parties' concerns:
(i) "Directly Identifiable Data" — Data that is linked to VINs and, through VMS's records, to individual vehicle owners or lessees. All fourteen categories of vehicle telemetry and in-cabin sensor data constitute Directly Identifiable Data when transmitted to Meridian with accompanying VINs in the initial data feed.
(ii) "Indirectly Identifiable Data" — Data that could become identifiable if combined with other reasonably available information, but that is not currently linked to a specific individual. Data that has been pseudonymized by Meridian (i.e., VINs stripped and replaced with non-reversible pseudonymous identifiers) after initial ingestion falls within this category.
Under the agreed framework, GPS/geolocation data and seat occupancy data linked to VINs are classified within the Directly Identifiable Data tier, reflecting their status as Sensitive Vehicle Data under VMS's internal governance policy. All fourteen data categories are treated as personal data for DPA purposes when transmitted with accompanying VINs. However, Meridian may apply pseudonymization procedures (specifically, stripping VINs from the data) after initial ingestion into its AutoCloud platform for analytics processing purposes. Upon completion of pseudonymization, the resulting pseudonymized data is reclassified as Indirectly Identifiable Data, which remains subject to the DPA's data protection obligations but with a reduced set of requirements reflecting the lower risk profile. The specific reduced obligations applicable to Indirectly Identifiable Data will be defined in DPA v3.0 and are expected to include relaxed access controls, modified audit rights, and adjusted breach notification requirements.
This resolution preserves VMS's core objective of ensuring comprehensive personal data protection at the point of data ingestion while providing Meridian with a workable framework for processing pseudonymized data for legitimate analytics purposes.
B. Issue 2: Purpose Limitation / Permitted Processing Purposes
VMS Position (DPA v1.0): VMS's initial draft contained a strict purpose limitation clause restricting Meridian's processing of VMS data to three specifically enumerated purposes: (i) generating predictive maintenance insights for VMS's vehicle fleet and customer base; (ii) producing driver behavior scoring analytics; and (iii) developing fleet optimization analytics. These three purposes were defined in alignment with the scope of work described in the LOI. Any processing for purposes other than these three enumerated purposes was expressly prohibited without VMS's prior written consent.
Meridian Position (DPA v2.0): WBC's redline sought to expand the permitted processing purposes to include two additional categories: (a) development of aggregate and anonymized analytics products by Meridian for commercial distribution, and (b) training of Meridian's proprietary machine-learning models using VMS-sourced data. Meridian's rationale, as articulated in WBC's cover letter and reiterated by Lena Torrance during the call, was that the ability to develop and commercialize analytics products incorporating insights derived from VMS data is a core component of Meridian's business model and a significant element of the commercial value proposition underlying the partnership. Meridian further argued that ML model training is essential to improving the quality and accuracy of the analytics outputs that directly benefit VMS under the three core permitted purposes.
Discussion: Rachel Bernstein expressed VMS's concern that permitting Meridian to develop and commercialize analytics products derived from VMS data, even in aggregate or anonymized form, could result in the indirect disclosure of VMS's proprietary information, competitive intelligence, or customer data to Meridian's other commercial customers and partners. Diana Kowalski emphasized that any use of VMS data beyond the three core purposes must be subject to robust safeguards ensuring that VMS data cannot be re-identified or reverse-engineered from anonymized or aggregated outputs. Catherine Ng responded that Meridian was willing to subject its anonymization methodology to VMS's review and approval, and that Meridian's standard anonymization processes employ k-anonymity, l-diversity, and differential privacy techniques that are widely accepted in the industry.
Resolution: The parties reached the following agreement:
Meridian may use VMS data for the three core permitted purposes (predictive maintenance insights, driver behavior scoring, and fleet optimization analytics) as well as for the development of aggregate and anonymized analytics products, subject to the following conditions:
(a) All data used by Meridian for analytics product development purposes must first be irreversibly anonymized — not merely pseudonymized. The standard for irreversible anonymization will be defined in DPA v3.0 and will require that the anonymization process render the data incapable of being re-associated with any identifiable natural person or specific vehicle, whether by Meridian alone or in combination with any other data set reasonably available to Meridian.
(b) Prior to applying any anonymization methodology to VMS data for product development purposes, Meridian must provide VMS with a detailed written description of the anonymization methodology, including the specific techniques employed (e.g., k-anonymity thresholds, differential privacy epsilon values, aggregation parameters), the data sets to which the methodology will be applied, and a technical assessment of re-identification risk.
(c) VMS retains the right to review and object to any proposed anonymization methodology within fifteen (15) business days of receipt of Meridian's written description. If VMS objects, Meridian may not proceed with the proposed anonymization methodology until the parties have resolved VMS's objections in writing. If VMS does not respond within the fifteen (15) business day review period, the proposed methodology shall be deemed approved.
Meridian's use of irreversibly anonymized data for machine-learning model training was accepted by VMS subject to the foregoing conditions. The parties acknowledged that this resolution strikes a balance between VMS's legitimate interest in controlling the use of its proprietary data and Meridian's commercial interest in leveraging analytics capabilities developed through the partnership.
C. Issue 3: Data Minimization and Collection Scope
VMS Position (DPA v1.0): VMS's initial draft provided that Meridian may only receive and process data falling within the fourteen (14) specific data categories enumerated in Annex A to the DPA. Annex A set forth a detailed schedule identifying each data category, the data fields within each category, the frequency of data collection, the technical format of the data feed, and the specific processing purpose(s) for which each data category was authorized. The data minimization clause required Meridian to process only the minimum amount of data necessary to achieve the specified processing purposes and prohibited the collection or processing of any data beyond the scope of Annex A.
Meridian Position (DPA v2.0): WBC's redline proposed the addition of a "future data categories" provision that would permit Meridian to receive and process additional data fields that may become available through updates to VMS's VantageLink platform without requiring a formal amendment to the DPA. Meridian argued that connected-vehicle platforms are rapidly evolving and that new data types — such as advanced driver-assistance system ("ADAS") telemetry, vehicle-to-everything ("V2X") communication data, and enhanced biometric cabin monitoring data — may become available during the term of the DPA. Meridian's position was that requiring a formal DPA amendment for each new data category would be unduly burdensome and would impair the parties' ability to capture value from platform enhancements in a timely manner.
Discussion: Diana Kowalski expressed strong opposition to any provision that would permit the scope of data processing to expand without VMS's affirmative written consent, noting that new data categories could implicate additional regulatory requirements (e.g., biometric data under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq.) or heightened sensitivity classifications under VMS's internal governance framework. Rachel Bernstein supported VMS's position and noted that automatic expansion of data processing scope would be inconsistent with the data minimization principle underlying applicable privacy regulations, including the CCPA/CPRA. Catherine Ng acknowledged the concern and indicated that Meridian would not insist on automatic expansion, provided that the amendment process is reasonably efficient.
Resolution: The parties agreed that any new data categories beyond the fourteen (14) categories enumerated in Annex A require a formal written amendment to the DPA, executed by authorized representatives of both parties. Meridian may not receive, access, process, or store additional data fields — regardless of their technical availability through the VantageLink platform or otherwise — without first executing such an amendment. The parties further agreed that the amendment process for adding new data categories will include, at a minimum, an updated Annex A identifying the new data category, its associated data fields, processing purposes, and applicable security measures, as well as a privacy impact assessment or equivalent analysis to be prepared by VMS (with Meridian's cooperation) addressing any regulatory implications of the expanded data processing scope. This resolution preserves VMS's control over the scope of data shared with Meridian and ensures compliance with applicable data minimization requirements.
D. Issue 4: Data Subject Rights Assistance
VMS Position (DPA v1.0): VMS's initial draft required Meridian to assist VMS in responding to data subject rights requests — including access requests, deletion requests, and opt-out requests — within five (5) business days of receiving VMS's written notification of such request. The obligation encompassed all forms of data subject rights requests under applicable law, including requests submitted by California consumers exercising their rights under the CCPA/CPRA (e.g., the right to know, the right to delete, and the right to opt-out of the sale or sharing of personal information). Meridian was required to bear all costs associated with providing such assistance, without reimbursement from VMS.
Meridian Position (DPA v2.0): WBC's redline proposed two modifications. First, Meridian sought to extend the response window from five (5) business days to fifteen (15) business days, citing the technical complexity of locating, extracting, and deleting specific data records from Meridian's distributed AutoCloud analytics platform, which processes data across multiple cloud environments and data lakes. Second, Meridian requested that VMS reimburse Meridian's reasonable costs for complying with data subject requests exceeding fifty (50) requests per calendar quarter, arguing that a high volume of data subject requests would impose significant operational burden and cost on Meridian's data governance team.
Discussion: Diana Kowalski noted that VMS currently receives an average of approximately 60–80 data subject requests per calendar quarter related to its connected-vehicle platform, with seasonal spikes following media coverage of data privacy issues in the automotive sector. She expressed concern that a fifteen (15) business day response window could impair VMS's ability to meet its own regulatory obligations — particularly under the CCPA/CPRA, which requires responses to consumer requests within forty-five (45) calendar days (with a possible forty-five (45) day extension). Rachel Bernstein emphasized that VMS must have sufficient time to review Meridian's response and compile its own response to the data subject before the regulatory deadline expires. Catherine Ng acknowledged the regulatory timeline constraints and indicated flexibility on the response window. Lena Torrance stated that the fifty (50) request threshold for cost reimbursement was too low given the size of the data subject population and suggested a higher threshold.
Resolution: The parties agreed on the following terms:
(a) Response Window: Meridian will respond to VMS's data subject rights assistance requests within ten (10) business days of receiving VMS's written notification. This provides VMS with adequate time to compile and submit its response to the data subject within applicable regulatory deadlines.
(b) Cost Allocation: Meridian will bear all costs associated with responding to the first one hundred (100) data subject requests per calendar quarter. For data subject requests exceeding one hundred (100) per calendar quarter, VMS will reimburse Meridian's reasonable, documented costs, subject to a cap of one hundred fifty dollars ($150) per request. Meridian must submit itemized invoices for reimbursement within thirty (30) days of the close of each calendar quarter.
Both parties acknowledged the particular significance of the CCPA/CPRA in the context of this provision, given that approximately 112,000 California-registered vehicles are included in the 800,000 opted-in vehicle pool, representing approximately 14% of the total data subject population. The parties agreed that the data subject rights assistance obligation extends to all applicable regulatory regimes, including the CCPA/CPRA, and is not limited to any single jurisdiction.
E. Issue 5: Return and Destruction of Data upon Termination
VMS Position (DPA v1.0): VMS's initial draft required Meridian, upon termination or expiration of the DPA for any reason, to: (i) return all VMS data in its possession or control to VMS within thirty (30) calendar days of the effective date of termination or expiration, in a format and on media reasonably specified by VMS; and (ii) certify the complete and irreversible destruction of all copies of VMS data (including copies in backup systems, disaster recovery environments, and archival storage) within forty-five (45) calendar days of the effective date of termination or expiration. The certification was required to be executed by an authorized officer of Meridian and delivered to VMS.
Meridian Position (DPA v2.0): WBC's redline proposed extending the data return period to ninety (90) calendar days and the certified destruction period to one hundred twenty (120) calendar days. Catherine Ng's cover letter explained that Meridian's AutoCloud platform utilizes a distributed cloud architecture with data replicated across multiple availability zones and stored in various formats (raw, processed, derived, cached, and archived). Meridian asserted that the technical complexity of identifying, extracting, and purging all instances of VMS data from this distributed environment — including from backup tapes, cold storage, and machine-learning training pipelines — required substantially more time than the thirty (30) and forty-five (45) day periods proposed by VMS.
Discussion: Diana Kowalski acknowledged the technical challenges associated with data purging from distributed cloud environments but expressed concern that the extended timelines proposed by Meridian would leave VMS data in Meridian's systems for an unreasonably long period following termination, during which the data would remain subject to security risks and potential unauthorized access. Rachel Bernstein noted that extended data retention periods following termination could also complicate VMS's compliance with data subject deletion requests received after the termination date. Lena Torrance provided additional detail regarding Meridian's data architecture and indicated that Meridian could likely complete the data return and destruction process within a shorter timeframe than the ninety (90) and one hundred twenty (120) day periods initially proposed, but that thirty (30) and forty-five (45) days were not operationally feasible.
Resolution: The parties agreed on the following terms:
(a) Data Return: Meridian will return all VMS data in its possession or control to VMS within forty-five (45) calendar days of the effective date of termination or expiration, in a format and on media reasonably specified by VMS. VMS will provide its format and media specifications to Meridian no later than fifteen (15) calendar days after the effective date of termination or expiration.
(b) Certified Destruction: Meridian will certify the complete and irreversible destruction of all copies of VMS data (including copies in backup systems, disaster recovery environments, archival storage, and machine-learning training pipelines) within sixty (60) calendar days of the effective date of termination or expiration. The certificate of destruction must be executed by an authorized officer of Meridian (at the level of Vice President or above) and delivered to VMS in writing.
(c) Legal Hold Exception: Meridian may retain VMS data beyond the sixty (60) calendar day destruction period only where, and to the extent that, retention is required by applicable law or regulation, or by a valid and enforceable legal hold, subpoena, or court order. In any such case, Meridian must: (1) promptly notify VMS in writing of the specific legal requirement mandating retention; (2) identify with particularity the specific data retained and the legal basis for retention; and (3) ensure that all retained data remains subject to the DPA's confidentiality obligations, security requirements, and access restrictions for the duration of the retention period. Upon the expiration of the applicable legal requirement, Meridian must promptly destroy the retained data and provide a supplemental certificate of destruction.
This resolution represents a reasonable compromise between VMS's interest in prompt data return and destruction and Meridian's legitimate operational constraints.
F. Issue 6: Confidentiality Obligations and Non-Disclosure
VMS Position (DPA v1.0): VMS's initial draft provided that all VMS data received by Meridian under the DPA constitutes "Confidential Information" of VMS and is subject to perpetual confidentiality obligations that survive the termination or expiration of the DPA indefinitely. Meridian was prohibited from disclosing, using, or making available any VMS Confidential Information for any purpose other than the permitted processing purposes defined in the DPA, and was required to protect VMS Confidential Information with at least the same degree of care that Meridian uses to protect its own confidential information, but in no event less than a reasonable standard of care.
Meridian Position (DPA v2.0): WBC's redline proposed two modifications. First, Meridian sought to limit the survival period for confidentiality obligations to five (5) years following the termination or expiration of the DPA, arguing that perpetual confidentiality obligations are uncommon in commercial data processing agreements and impose an indefinite compliance burden on Meridian. Second, Meridian sought to exclude irreversibly anonymized and aggregated data from the scope of the confidentiality obligations, on the basis that such data, by definition, does not identify VMS, its vehicles, or its customers, and therefore does not warrant confidential treatment.
Discussion: Rachel Bernstein acknowledged that perpetual confidentiality obligations, while appropriate for certain categories of highly sensitive information, may be broader than necessary for all data categories covered by the DPA. However, she emphasized that a five (5) year survival period may be insufficient given the nature of the data and the potential for long-tail regulatory exposure. Diana Kowalski noted that VMS's internal data governance policy requires a minimum seven (7) year confidentiality period for personally identifiable information shared with third-party processors. Catherine Ng indicated that Meridian could accept a longer survival period and that the primary concern was avoiding a perpetual obligation. The parties also discussed the treatment of trade secrets, with Rachel Bernstein noting that trade secret protections under Michigan law (MCL 445.1901 et seq.) and applicable federal law survive independently of any contractual confidentiality period.
Resolution: The parties agreed on the following terms:
(a) Survival Period: Confidentiality obligations with respect to Directly Identifiable Data and Indirectly Identifiable Data (as defined per the resolution of Issue 1 above) survive for seven (7) years following the termination or expiration of the DPA.
(b) Exclusion for Anonymized Data: Data that has been irreversibly anonymized in accordance with the anonymization methodology approved by VMS pursuant to the resolution of Issue 2 above is excluded from the DPA's confidentiality obligations upon completion of the anonymization process. For avoidance of doubt, data that has been pseudonymized (but not irreversibly anonymized) remains subject to the full confidentiality obligations for the seven (7) year survival period.
(c) Trade Secret Protection: Nothing in the DPA limits or modifies either party's rights or obligations with respect to trade secrets under applicable law, including the Michigan Uniform Trade Secrets Act (MCL 445.1901 et seq.) and the federal Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.). Trade secret protections survive indefinitely regardless of the seven (7) year contractual confidentiality period.
G. Issue 7: Governing Law and Dispute Resolution
VMS Position (DPA v1.0): VMS's initial draft specified Michigan as the governing law jurisdiction and provided for the exclusive jurisdiction of state and federal courts sitting in Wayne County, Michigan (i.e., the United States District Court for the Eastern District of Michigan and the Wayne County Circuit Court) for the resolution of any disputes arising out of or relating to the DPA.
Meridian Position (DPA v2.0): WBC's redline proposed California as the governing law jurisdiction and substituted binding arbitration under JAMS Comprehensive Arbitration Rules and Procedures, seated in San Francisco, California, for court-based dispute resolution. Meridian's rationale, as stated in WBC's cover letter, was that Meridian is incorporated in Delaware and headquartered in San Jose, California, that a substantial portion of Meridian's workforce and data processing operations are located in California, and that California's well-developed body of technology and data privacy law provides a more appropriate framework for the interpretation of a data processing agreement of this nature.
Discussion: Rachel Bernstein stated that VMS's strong preference for Michigan governing law reflects VMS's Michigan incorporation, its headquarters in Dearborn, Michigan, its workforce concentration in Michigan, and the predominance of Michigan law in VMS's existing vendor and data processing agreements. She noted that VMS is familiar with Michigan's regulatory and litigation environment and that Michigan governing law provides VMS with the most predictable framework for contract interpretation and dispute resolution. Diana Kowalski added that VMS's board of directors and Northgate Capital Partners have consistently required Michigan governing law in VMS's material commercial agreements. Catherine Ng did not strongly contest the governing law issue but advocated for arbitration rather than court litigation, arguing that arbitration provides a more efficient, confidential, and predictable dispute resolution mechanism for complex data processing disputes. Derek Yamada noted that arbitration would allow the parties to select an arbitrator with specialized expertise in data privacy and technology law.
Resolution: The parties agreed on the following terms:
(a) Governing Law: The DPA will be governed by and construed in accordance with the laws of the State of Michigan, without regard to its conflicts of law principles.
(b) Dispute Resolution — Two-Step Process:
(i) Mandatory Mediation: In the event of any dispute, controversy, or claim arising out of or relating to the DPA, or the breach, termination, or validity thereof, the aggrieved party must first submit the dispute to non-binding mediation. Mediation will be conducted in Detroit, Michigan, before a mutually agreed mediator, and must commence within thirty (30) days of the aggrieved party's delivery of written notice of the dispute to the other party.
(ii) Binding Arbitration: If mediation does not result in a resolution of the dispute within thirty (30) days of the commencement of mediation (or such longer period as the parties may agree in writing), either party may submit the dispute to binding arbitration administered by the American Arbitration Association ("AAA") under the AAA Commercial Arbitration Rules then in effect. The arbitration will be seated in Detroit, Michigan, and conducted before a single arbitrator selected in accordance with the AAA's arbitrator selection procedures. Each party will bear its own costs and attorneys' fees incurred in connection with the mediation and arbitration, provided that the arbitrator may, in the arbitrator's discretion, award reasonable attorneys' fees and costs to the prevailing party.
(c) Injunctive Relief: Notwithstanding the foregoing, either party may seek temporary, preliminary, or permanent injunctive relief, or other equitable remedies, in any state or federal court of competent jurisdiction sitting in Michigan, without first exhausting the mediation and arbitration process described above. The parties consent to the personal jurisdiction of the state and federal courts sitting in Wayne County, Michigan, for purposes of any such proceeding.
This resolution accommodates VMS's governing law preference and Meridian's preference for alternative dispute resolution, while preserving both parties' ability to seek emergency equitable relief through the courts.
V. Unresolved Issues (4 of 11)
The following four issues were not resolved during the November 15, 2022 call and will require further negotiation, internal consultation, and, in certain cases, additional information (including the results of the pending Pinehurst Cybersecurity Advisors LLC security assessment). Each issue is summarized below, together with a description of the positions advanced by the parties, the substance of the discussion, and the current status.
A. Issue 8: Data Retention Period
VMS Position: VMS seeks a ninety (90)-day rolling deletion requirement for raw telemetry data after processing. Under this framework, raw telemetry data transmitted to Meridian would be deleted from Meridian's systems within ninety (90) calendar days of ingestion, with only processed, derived, and aggregated outputs retained beyond that period. VMS's position is that raw telemetry data — which contains Directly Identifiable Data linked to VINs — should not be retained by Meridian beyond the period necessary to perform the contracted analytics services, and that the ongoing retention of raw identifiable data creates unnecessary risk exposure for VMS.
Meridian Position: Meridian seeks an eighteen (18)-month retention period for raw telemetry data, primarily for machine-learning model training purposes. Meridian's position is that shorter retention periods would materially impair the quality, accuracy, and predictive power of its machine-learning models, which require longitudinal data spanning multiple seasonal cycles, weather patterns, driving conditions, and vehicle maintenance intervals to achieve statistical reliability. Meridian asserted that an eighteen (18)-month retention period is consistent with industry standards for automotive machine-learning applications.
Discussion: Lena Torrance presented Meridian's technical rationale in detail during the call. She explained that Meridian's predictive maintenance models rely on supervised learning techniques that require training data sets encompassing at least twelve (12) months of continuous longitudinal data per vehicle to account for seasonal variability, component degradation curves, and driving pattern changes. She stated that limiting raw data retention to ninety (90) days would result in models trained on fragmentary data, leading to reduced prediction accuracy and higher false positive rates, which would ultimately diminish the value of the analytics outputs delivered to VMS. She cited internal benchmarking data indicating that model accuracy (as measured by F1 score) improves by approximately 23% when training data spans twelve months compared to three months.
Diana Kowalski responded that retaining raw, identifiable (or pseudonymized) telemetry data for eighteen (18) months significantly increases VMS's risk exposure, particularly with respect to the approximately 112,000 California-registered vehicles in the opted-in pool. She noted that a longer retention period increases the volume of data at risk in the event of a breach, amplifies potential regulatory penalties (particularly statutory damages under the CCPA/CPRA), and expands the window during which data subject deletion requests may need to be honored. She further noted that VMS's internal data governance policy mandates that third-party processors delete or return personal data as soon as it is no longer necessary for the specified processing purpose, and that an eighteen-month rolling retention period is difficult to reconcile with that requirement.
Rachel Bernstein proposed a potential compromise framework during the discussion, noting the distinction between retaining raw data (which contains or is linked to Directly Identifiable Data) and retaining processed, derived, or aggregated outputs (which may be pseudonymized or anonymized and present a lower risk profile). She suggested that the parties consider a shorter raw data retention period — potentially in the range of one hundred twenty (120) to one hundred eighty (180) calendar days — with longer retention permitted for derived outputs, pseudonymized data sets, or irreversibly anonymized data only. This approach would limit the period during which identifiable raw telemetry is maintained in Meridian's systems while still providing Meridian with longitudinal derived data for model training purposes. Catherine Ng indicated that Meridian would consider the proposal but needed to consult with Julian Voss (Meridian CTO) regarding the technical feasibility of training models on derived outputs rather than raw data.
Status: Unresolved. The parties agreed to exchange revised proposals in writing. Calderwood & Harkness will draft compromise language reflecting the framework suggested by Rachel Bernstein (shorter raw data retention with extended retention for derived/anonymized outputs) for VMS's review prior to inclusion in DPA v3.0. Meridian committed to providing a technical memorandum from its data science team addressing whether derived outputs (as opposed to raw telemetry) can serve as adequate training data for its machine-learning models.
B. Issue 9: Sub-Processor Approval Rights
VMS Position: VMS requires prior written consent for all sub-processors engaged by Meridian to process VMS data, with no exceptions. Under VMS's proposed framework, Meridian may not engage any sub-processor to process any category of VMS data — whether Directly Identifiable Data, Indirectly Identifiable Data, pseudonymized data, or anonymized data — without first obtaining VMS's express written consent. VMS views this requirement as essential to maintaining contractual and operational control over the entities that access, process, and store its proprietary vehicle telemetry data, particularly data classified as Sensitive Vehicle Data.
Meridian Position: Meridian proposes a general authorization model in which Meridian provides VMS with an initial list of its existing sub-processors (to be set forth in Annex C to the DPA) and updates the list periodically. When Meridian intends to engage a new sub-processor or replace an existing sub-processor, it would provide VMS with written notice of the proposed change, including the identity of the sub-processor, the nature and scope of the processing to be performed, and the location(s) of the sub-processor's data processing facilities. VMS would then have a thirty (30)-day objection window following receipt of the notice to object to the proposed sub-processor. If VMS does not submit a written objection within the thirty (30)-day window, the sub-processor would be deemed approved. If VMS objects, the parties would discuss the objection in good faith, and if the objection cannot be resolved, VMS would have the right to terminate the DPA upon sixty (60) days' written notice.
Discussion: Catherine Ng argued at length that the prior written consent model proposed by VMS is operationally burdensome and inconsistent with prevailing industry practice for cloud-based analytics platforms that rely on dynamic ecosystems of infrastructure providers, API services, and specialized processing vendors. She noted that Meridian currently utilizes Cloudvault Infrastructure, Inc. ("Cloudvault") as its primary cloud hosting provider for the AutoCloud platform, pursuant to a master services agreement between Meridian and Cloudvault executed on March 1, 2021. Cloudvault operates data centers in Reno, Nevada, and Columbus, Ohio, both of which are SOC 2 Type II certified. Catherine Ng stated that requiring Meridian to obtain VMS's prior written consent before engaging any new sub-processor — including infrastructure-level service providers performing routine hosting, caching, or content delivery functions — would create unacceptable operational delays and impair Meridian's ability to maintain and upgrade its platform.
Rachel Bernstein emphasized VMS's heightened sensitivity regarding sub-processor access to its data, given the nature of the data involved (vehicle telemetry linked to identifiable individuals), VMS's obligations under applicable privacy statutes, and VMS's internal data governance framework. She noted that VMS's PE sponsor, Northgate Capital Partners, has implemented portfolio-wide cybersecurity and data governance standards that require prior approval of all material sub-processors, and that VMS must ensure its contractual arrangements are consistent with these requirements. She further noted that the CCPA/CPRA imposes service provider obligations that extend to sub-processors, and that VMS must maintain adequate contractual controls to ensure compliance throughout the processing chain.
Lena Torrance indicated a willingness to pre-approve Cloudvault by including it in the initial sub-processor list (Annex C) and to provide VMS with a comprehensive initial list of all current sub-processors. However, she resisted the blanket prior written consent requirement for all future sub-processors, characterizing it as disproportionate and operationally impractical. She suggested that a differentiated approach — in which the level of VMS approval required varies based on the sensitivity of the data processed by the sub-processor — might be acceptable to Meridian.
Diana Kowalski stated that VMS's core concern is ensuring that it has contractual control over which entities access data classified as Sensitive Vehicle Data (i.e., GPS/geolocation and seat occupancy data linked to VINs) and that it has meaningful visibility into and influence over the sub-processor ecosystem more broadly. She indicated openness to considering a differentiated approach, provided that the highest level of control (prior written consent) applies to any sub-processor with access to Directly Identifiable Data or Sensitive Vehicle Data.
Status: Unresolved. Calderwood & Harkness will prepare a hybrid sub-processor approval proposal for VMS's consideration, structured as follows:
(i) Prior Written Consent: Required for any sub-processor that will process, access, or store Directly Identifiable Data or Sensitive Vehicle Data (GPS/geolocation and seat occupancy data linked to VINs);
(ii) General Authorization with Objection Rights: Applicable to sub-processors that process only pseudonymized data, anonymized data, or Indirectly Identifiable Data, subject to Meridian's obligation to provide VMS with advance written notice and a thirty (30)-day objection window.
The hybrid proposal will be prepared as a separate memorandum for Rachel Bernstein and Diana Kowalski by November 21, 2022. The analysis will also take into account any preliminary findings from the Pinehurst Cybersecurity Advisors LLC security assessment of Meridian's data processing environment, which is expected to be delivered in late November 2022. The Pinehurst assessment may provide additional information regarding the security posture and capabilities of Meridian's existing sub-processors that could inform VMS's position.
C. Issue 10: Breach Notification Timeline
VMS Position: VMS requires Meridian to notify VMS within twenty-four (24) hours of Meridian's discovery of any personal data breach affecting VMS data. VMS's position is that a twenty-four (24) hour notification window is necessary to provide VMS with adequate time to assess the breach, activate its own incident response procedures, and meet its downstream notification obligations to affected data subjects, regulators, and other stakeholders.
Meridian Position: Meridian proposes a seventy-two (72) hour notification window, aligned with the notification timeline established by Article 33(1) of the European Union General Data Protection Regulation ("GDPR"), which requires data controllers to notify supervisory authorities of a personal data breach within seventy-two (72) hours of becoming aware of the breach. Meridian argues that a twenty-four (24) hour notification window is insufficient to conduct a meaningful preliminary investigation, confirm whether a breach has actually occurred (as opposed to a false positive or security event that does not rise to the level of a breach), and determine the nature, scope, and severity of the incident.
Discussion: Lena Torrance provided a detailed explanation of Meridian's incident response procedures during the call. She stated that Meridian's Security Operations Center ("SOC") receives an average of approximately 1,200 security alerts per week from automated monitoring systems, of which approximately 3–5% (approximately 36–60 per week) require escalation for further investigation, and of which fewer than 0.1% (approximately 1–2 per month) are ultimately confirmed as security incidents meeting the threshold for breach notification. She argued that imposing a twenty-four (24) hour notification obligation from the point of "Discovery" of a breach — particularly if "Discovery" is defined broadly to include initial detection of anomalous activity — would likely result in a significant volume of premature notifications for events that are subsequently determined to be false positives or non-material security events. Such over-notification, she argued, would divert VMS's internal resources, create unnecessary alarm, and potentially trigger downstream notification cascades that are unwarranted by the actual severity of the event.
Diana Kowalski responded that VMS's internal data governance policy and Northgate Capital Partners' portfolio-wide cybersecurity requirements mandate twenty-four (24) hour notification to VMS from any data processor that experiences a confirmed or suspected breach affecting VMS data. She explained that VMS has downstream notification obligations — both contractual (to its OEM and fleet management partners) and regulatory (under applicable state breach notification laws) — that require VMS to act quickly upon receiving notification of a breach. A seventy-two (72) hour delay in notification from Meridian could compress VMS's response window to an unacceptable degree and could result in VMS failing to meet its own notification deadlines.
Rachel Bernstein noted that the Michigan Identity Theft Protection Act (MCL 445.61 et seq.) does not specify a precise notification window but requires notification "without unreasonable delay," and that a twenty-four (24) hour contractual standard provides VMS with adequate time to meet its own downstream obligations. She further noted that while the GDPR seventy-two (72) hour standard is a useful benchmark, it applies to a different regulatory context (controller-to-supervisory authority notification, not processor-to-controller notification) and does not necessarily represent the appropriate standard for the VMS-Meridian processing relationship.
Catherine Ng argued that the twenty-four (24) hour standard, while understandable from VMS's perspective, is not practically achievable for a complex, distributed cloud analytics platform and that the GDPR seventy-two (72) hour standard has emerged as a widely accepted industry benchmark for processor-to-controller notification even outside the GDPR's territorial scope.
During the discussion, the parties informally explored the possibility of a two-tier notification approach:
(i) Preliminary Notification (24 hours): Within twenty-four (24) hours of Meridian's discovery of a suspected personal data breach affecting VMS data, Meridian would provide VMS with a brief written preliminary notification identifying: the nature of the suspected incident; the date and time of discovery; the data categories and approximate number of data subjects potentially affected (if known); and the initial steps taken by Meridian to investigate and mitigate the incident.
(ii) Detailed Incident Report (72 hours): Within seventy-two (72) hours of Meridian's discovery of the suspected breach, Meridian would provide VMS with a detailed written incident report containing full particulars, including: a comprehensive description of the nature and scope of the breach; the specific data categories and data subjects affected; the likely consequences of the breach; the measures taken or proposed to address the breach and mitigate its adverse effects; and the identity and contact information of Meridian's designated incident response coordinator.
While this two-tier framework was discussed informally and appeared to generate interest from both sides, no formal agreement was reached during the call.
Status: Unresolved. The two-tier notification framework discussed during the call will be developed into formal proposed language by Sara Hendricks for internal review by Rachel Bernstein and Diana Kowalski. The proposal will also address the definition of "Discovery" for purposes of triggering the notification obligation and will consider whether different notification timelines should apply depending on the severity or scope of the breach.
D. Issue 11: Liability Cap for Data Breaches and Unauthorized Processing
VMS Position: VMS seeks uncapped liability for losses arising from data breaches and unauthorized processing of VMS data by Meridian. VMS's rationale is that the volume of data involved (approximately 800,000 opted-in vehicles generating approximately 4.2 terabytes of raw telemetry per day), the sensitivity of certain data categories (GPS/geolocation and seat occupancy data), and the potential regulatory exposure — particularly under the CCPA/CPRA, which provides for statutory damages in the range of $100–$750 per consumer per incident (Cal. Civ. Code § 1798.150(a)(1)) — make a fixed liability cap unworkable and inequitable. VMS estimates that, in a worst-case scenario involving a breach affecting all 112,000 California-registered vehicles, potential CCPA/CPRA statutory damages alone could range from approximately $11.2 million (at $100 per consumer) to approximately $84 million (at $750 per consumer), exclusive of actual damages, regulatory fines, attorneys' fees, and litigation costs.
Meridian Position: Meridian proposes a liability cap of $15,000,000 (fifteen million dollars) for all claims arising from data breaches and unauthorized processing, representing approximately 2.31 times the annual license fee of $6,500,000. Meridian asserts that uncapped liability is commercially unacceptable and would expose Meridian to potentially existential financial risk. Meridian further argues that a $15 million cap significantly exceeds industry norms for data processing agreements of comparable scope and scale, and that VMS's uncapped liability position is disproportionate to the commercial value of the partnership.
Discussion: This issue generated the most extensive and contentious discussion during the call.
Catherine Ng stated unequivocally that Meridian's board of directors and its insurers would not approve a DPA containing uncapped data breach liability. She noted that Meridian's existing cyber liability insurance policy provides coverage of $10 million per occurrence and $20 million in the aggregate, and that a $15 million contractual cap is consistent with the available insurance coverage. She further stated that uncapped liability provisions are extremely rare in data processing agreements in the connected-vehicle and telematics sector and that VMS's position is a significant outlier relative to market practice.
Rachel Bernstein countered that VMS's potential exposure in a significant data breach — encompassing CCPA/CPRA statutory damages, regulatory fines and penalties, class action litigation defense costs and settlements, business interruption losses, reputational harm, and contractual indemnification obligations to VMS's OEM and fleet management partners — could substantially exceed $15 million. She noted that a $15 million cap would potentially leave VMS with tens of millions of dollars in unrecoverable losses in a severe breach scenario, and that this risk allocation is unacceptable to VMS and its PE sponsor.
Lena Torrance suggested that Meridian could explore obtaining enhanced cyber insurance coverage to support a higher liability cap but stated that Meridian could not agree to uncapped exposure under any circumstances. She indicated that Meridian would be willing to discuss a higher cap — potentially in the range of $20–25 million — if VMS would agree to a defined limit. She also noted that Meridian's willingness to agree to a higher cap would be contingent upon the resolution of other outstanding issues, including the data retention period (Issue 8), which directly affects the volume of data at risk in a breach scenario.
Diana Kowalski indicated that Northgate Capital Partners, as VMS's private equity sponsor, has strong views on adequate downside protection in VMS's material vendor agreements and that she would need to consult with Erik Johansson (Northgate Managing Director) and Thomas Langford (VMS G

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts