Overview

For GM and OnStar, privacy governance assigns ownership across recipient roles, contracts, change reviews, reports, and enforcement. The CCPA distinguishes service providers, contractors, and third parties and requires purpose-bound agreements, cooperation, and remediation rights. The GM judgment adds case-specific assessments before covered material changes, annual reporting, policy enforcement, and a $12.75 million penalty, while the complaint’s governance allegations remain unadjudicated.

Learning outcomes

Recipient labels do not determine privacy controls; role, written terms, and actual processing do.
A new recipient, field, product purpose, or material disclosure should trigger review rather than inherit an old conclusion.
Reports and assessments create evidence of accountability, but the GM judgment’s requirements apply to its covered data and conduct.

Keywords

GM/OnStarCCPAContractsRecipientsAssessmentsReporting

Making the Duty Operable: Roles, Contracts, and Review

For GM and OnStar, a data-lifecycle duty can fail even when a privacy policy is accurate: a vendor may receive the wrong field, a contract may not restrict a new use, or a product change may bypass the assessment that should have caught it. This chapter examines the governance around a connected-car data flow—recipient roles, contracts, change review, reporting, and enforcement—so readers can see who owns each decision and what evidence makes a privacy promise operational.

The recipient’s role determines the control

The CCPA does not treat every organization that receives personal information as the same kind of actor. It distinguishes a third party from a service provider or contractor, and those distinctions affect what the recipient may do with the information and what the business must require in its agreement.

A service provider processes personal information on behalf of a business for a business purpose under a written contract. A contractor is also governed by a written contract with restrictions on selling or sharing the information, using it for purposes outside the contract, and retaining or disclosing it outside the direct business relationship. The contract can also address onward processing when the recipient engages another person to help perform the service. These categories are not labels chosen only for procurement. They describe the relationship in which the recipient handles the data.

The contract’s purpose is to preserve the boundary established at collection. The CCPA requires an agreement with a third party, service provider, or contractor to specify that information is sold or disclosed only for limited and specified purposes, require the recipient to provide the level of privacy protection required by the title, and give the business rights to take reasonable and appropriate steps to ensure compliant use. The agreement must also require the recipient to tell the business if it can no longer meet its obligations and give the business a right, after notice, to stop and remediate unauthorized use.

Those provisions turn “we trust our vendors” into questions that can be answered. What purpose is written into the agreement? Which fields are needed for it? Can the recipient combine the data with information from another client or its own consumer interactions? Can it use the information to build its own product? How can GM or OnStar monitor compliance, receive notice of a problem, and stop or correct the use? If the contract cannot answer those questions, the business may not know who owns the next lifecycle transition.

The role also affects consumer requests. The CCPA requires service providers and contractors to assist the business in responding to a verifiable request, including by providing information in their possession and correcting inaccurate information or enabling the business to do so. The deletion rules can require cooperation and notification through the relevant chain. A connected-car business therefore needs more than a list of vendor names. It needs a record of who holds which fields, under whose direction, for which purpose, and with what ability to locate, correct, restrict, or delete them.

The GM judgment’s own categories demonstrate why scope matters. It defines covered driving data by reference to information originating from a vehicle or GM-branded mobile app and specified driving events, and defines covered OnStar data as certain identifiers or a VIN disclosed to third parties with covered driving data. Those definitions are narrower than all vehicle information.

Published by DeepMox

FAQ

How does a recipient’s role affect a connected-car data contract?

It determines the permitted relationship and required restrictions: service providers and contractors process under written contracts, while third-party disclosures require different controls.

When should a connected-car privacy assessment be revisited?

It should be revisited when a material change affects covered use or disclosure, preferably before the change; the GM judgment sets a 45-day outside timing in specified circumstances.

Who can enforce CCPA privacy duties involving connected-car data?

The CPPA can investigate and bring administrative actions, and the Attorney General can bring civil actions; private civil actions are limited to specified security-breach circumstances.

Previous12 minGM/OnStar Retention and Deletion

Next13 minGM/OnStar Data Continuity Duty

GM/OnStar Privacy Governance

Making the Duty Operable: Roles, Contracts, and Review

The recipient’s role determines the control

FAQ