Data that is being sold revealing your whereabouts, for example where you live, work or where you go to church? This happened to more than 50 million car owners around the world.

A California-based data broker is involved in a class-action lawsuit because it has been accused of secretly collecting and selling real-time GPS location information from more than 50 million cars around the world, including California-based consumers. The claim in the lawsuit is that the company never requests consent from drivers before tracking their location.

In Californian territory, it is required to obtain consent before location data can be processed under the California Invasion of Privacy Act (CIPA), which bans the use of an “electronic tracking device to determine the location or movement of a person” without consent.

In EU territory the EDPB recommends to not collect location data at all, except if doing so is necessary for the particular purpose. In that case, (explicit) consent is also required and it must be given freely, specifically and informed.

The company had failed to request consent from drivers and had concluded agreements with car manufacturers to source location data from their vehicles. The company had the availability of 4.3 billion data points a day based on the tracking of 40 million vehicles globally. This data was thereinafter being sold to thousands of organizations that have access to this data.

Not obtaining consent when processing location data can be problematic, especially due to its sensitive nature. Different data points combined may reveal different components of person’s life. When you are processing data from all around the world, different rules and regulations come into play which you need to comply with. Because of the complexity of jurisdictional differences, many organizations therefore tend to choose the extensive GDPR as the ‘global golden standard’.

Class-Action Lawsuit Targets Company that Harvests Location Data from 50 Million Cars

Schermafbeelding 2022 05 13 om 15.14.03 - Class-Action Lawsuit Targets Company that Harvests Location Data from 50 Million Cars