Extract to table

Specifically, after Meridian has completed its processing of raw telemetry data and delivered the resulting analytics outputs (predictive maintenance insights, driver behavior scores, and fleet optimization analytics) to VMS or to authorized third-party recipients, Meridian is required to irreversibly delete or anonymize all raw data within ninety calendar days of initial receipt

100(c), a business's collection, use, retention, and sharing of a consumer's personal information must be "reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed

The general authorization model proposed by WBC effectively shifts the default from "consent required" (processor must obtain affirmative approval) to "consent presumed unless objection raised" (controller must monitor, evaluate, and affirmatively object)

Regardless of the approval model ultimately adopted, the DPA must require Meridian to impose substantially identical data protection obligations on all sub-processors through written sub-processing agreements

The key question is not whether sub-processors must comply with equivalent obligations, but rather who controls the decision of whether to engage a particular sub-processor in the first instance

SOC 2, ISO 27001), a description of the processing activities to be performed, the data categories involved, and a summary of the sub-processor's security posture; (ii) VMS's objection may be based on "reasonable data protection grounds," a standard that is broader than WBC's proposed "reasonable grounds" formulation and that expressly encompasses concerns relating to the sub-processor's security posture, jurisdiction, regulatory compliance history, and data governance practices — not limited to material security deficiencies; (iii) If VMS objects and the parties cannot resolve the dispute within fifteen business days through good-faith escalation to senior representatives, VMS retains the right to terminate the DPA for convenience without penalty or early termination fee; and (iv) Meridian must, in all cases, execute a written sub-processing agreement with each sub-processor imposing data protection obligations substantively equivalent to those imposed on Meridian under the DPA, and must provide copies of such sub-processing agreements to VMS upon request