Attorney General's Office reviewing local claim of illegal data collection after breach in Europe

ALTON — The recent discovery that private data collected by thousands of Volkswagen, Audi, Skoda and SEAT electric vehicles was left exposed by Volkswagen’s software company, Cariad, shook Germany when researchers revealed the information included information collected about company leaders and police authorities across Europe. It was no surprise to Gerry Kennedy of Alton, who last year filed an official complaint about Volkswagen’s unauthorized collection of personal data with the state Attorney General’s Office.

The state Consumer Protection and Antitrust Bureau’s response at the time was, “After careful review, the Bureau has determined that it is unable to pursue your individual complaint. As a law enforcement agency, the Bureau has jurisdiction to act in cases where there has been a violation of the New Hampshire Consumer Protection Act (CPA), RSA 358-A. Violations of the CPA occur when the State can prove that the defendant’s unfair or deceptive actions were purposeful and not merely reckless or negligent. Further, the State must show that the defendant’s actions 'attained a level of rascality that would raise the eyebrow of someone inured to the rough and tumble world of commerce.'”

The paralegal who sent the letter added, “Although the Bureau is unable to take action in this matter, you may wish to explore all available private remedies with your own attorney.”

Kennedy did just that, following up on Dec. 9, 2024, with a nearly 17,000-word document that cited the law and how the unauthorized data collection reached the “level of rascality” required for legal action.

When contacted about the document, Assistant Attorney General Warren Cormack wrote, “The Consumer Protection and Antitrust Bureau can confirm that it received the documentation mentioned in your Dec. 20, 2024, email. It would be premature to discuss the document because the Bureau has not yet had an opportunity to review it in full. As a general practice, the Bureau does not provide updates on open consumer complaints or investigations.”

Kennedy, however, shared correspondence in which the bureau asked for additional information to assist with its review of the complaint.

The basis of Kennedy’s concern is personal data has value. Stellantis, a multinational automotive manufacturing company representing 14 brands, places the value of the data on its books at €588.24 per titled owner. Yet those purchasing vehicles are not compensated for that data, and are not even informed it is being collected.

Jen Caltrider, Misha Rykov and Zoë MacDonald, researchers for Mozilla’s Privacy Not Included research, found “every car brand we looked at collects more personal data than necessary and uses that information for a reason other than to operate your vehicle and manage their relationship with you.”

In following up on his initial complaint to the Department of Justice, Kennedy spelled out how that “theft” of data has led to uncollected taxes that could help solve New Hampshire’s budget challenges.

In making his case, Kennedy claimed third parties which purchase the data have no legitimate interest in it. It means, however, “Your car is clearly worth more than the NADA value and ... your car is now insured incorrectly, as the vehicle has other exposures.” NADA refers to the National Automobile Dealers Association.

Kennedy makes it clear neither car dealers nor insurance agents are responsible for the problem.

“The dealer is caught in the middle,” he said, “and they’re going to get blamed.”

He goes on to argue, “The United States relies heavily on motor vehicles as their preferred means of transportation. This preference is partially linked to longer trip distances compared to other parts of the globe, as the United States boasts one of the world’s largest road networks. In the fourth quarter of 2022, just over 285 million vehicles were registered in the United States.

“Let’s just say 200 million vehicles are connected,” he said. Using an even 200 million vehicles with data valued at $544 per vehicle, that would equal almost $109 billion in data value “that is being taken from the Titled Owners of the vehicles without compensation! Now we are talking some seriously big numbers!”

Casting that amount as short-term capital gains, with a tax rate of 24%, “that means that the government is not getting paid $26 [billion] in taxes,” Kennedy said.

Laying out the legal case for action, Kennedy argues the data extraction from a titled vehicle represents unauthorized taking and an intent to deprive, because the data is used for profit, resale, or other unauthorized purposes.

“The broad interpretation of theft under this section supports the idea that digital assets, like vehicle-generated data, are property subject to theft protections,” he writes.

Digital data qualifies as property under RSA 637:2(I). “Since the vehicle is titled by the State of New Hampshire, both the physical and digital aspects are legally recognized property,” he says. “The theft of digital data undermines the state’s authority and the owner’s rights.”

The New Hampshire Legislature, with an endorsement by the Attorney General’s Office, amended RSA 507-G to include the expectation of privacy. That law went into effect on Jan. 1.

“Accessing personal data generated by a vehicle without consent infringes on a consumer’s reasonable expectation of privacy and control over their property,” Kennedy writes. “If the vehicle manufacturer or third party misrepresents how data is collected, stored, or used, this constitutes a deceptive practice under RSA 358-A:3.

"Given the sensitive nature of vehicle-generated data (location, usage patterns, driving habits), unauthorized access is sufficiently egregious to warrant investigation.”