Issue #17 | November 2026, Week 1

General Motors to pay $220M over selling drivers’ private data

Jurisdiction

United States

Infringer Legal Name

General Motors

Infringer Domicile

United States

Alleged Violation

Data protection violation

Enforcement Action

$220 million fine

Case Status

Administrative action

General Motors (GM) has agreed to pay $220 million to settle a lawsuit brought by 36 US states over the sale of drivers’ personal data.

The lawsuit accused the carmaker of collecting and sharing customers’ location and driving information with data brokers, who then sold it to insurance companies. The data was reportedly used to influence how much drivers paid for insurance.

GM’s Smart Driver program operated from 2016 to 2024. Customers were encouraged to join, with the company claiming that tracking driving habits could help improve road safety.

However, authorities said GM shared the information with third parties without properly informing customers or getting their consent.

Many drivers reportedly signed up at dealerships while buying their cars. Dealership employees were also given bonuses and incentives for enrolling customers in the program.

As part of the settlement, GM is required to obtain clear customer consent before collecting or sharing driving data. The company must also limit the amount of information it collects, improve data protection and provide better training for dealership staff.

Italy fines Notarial Council and Justice Ministry over data protection breaches

Jurisdiction

Italy

Infringer Legal Name

Multiple entities

Infringer Domicile

Italy

Alleged Violation

Data handling violations

Enforcement Action

€15,000 fine; €20,000 fine

Case Status

Administrative action

Italy’s Data Protection Authority has fined the National Council of Notaries (CNN) €15,000 and the Ministry of Justice €20,000 over the handling of personal data during the 2024 competition for 400 notary positions.

The investigation began after media reports claimed that the Council had published a document containing written exam results alongside unofficial comments and annotations about some candidates.

The investigation found that a member of the examination committee had mistakenly submitted a list of candidates admitted to the oral exam, including unauthorized comments. The member had acted independently, without approval from the committee or the Ministry of Justice.

The authority also found that the ministry had displayed the written exam results, including the names of candidates who had failed to qualify for the oral exam, at the entrance to its offices. The rules require only successful candidates to be listed and limit where the results can be displayed.

The National Council of Notaries was also found to have shared the candidate list with registered notaries before the Ministry officially announced the results. It briefly published a version containing unofficial notes that differed from the ministry’s official list.

The fines were issued under Orders No. 761 and 762, both dated October 7, 2026. As the violations had already expired, the authority decided not to impose any additional corrective measures on either administration.

Fnac Darty fined €7M for illegal app tracking

Jurisdiction

France

Infringer Legal Name

Fnac Darty

Infringer Domicile

France

Alleged Violation

France’s Data Protection Act violation

Enforcement Action

€7 million fine

Case Status

Administrative action

France’s data protection authority (CNIL) has fined major European electronics retailer Fnac Darty a total of €7 million for tracking users through its mobile application without their consent.

The investigation began after a complaint from privacy organization None Of Your Business (NOYB). Following an audit in March 2024, the CNIL found that opening the app automatically sent user data to external servers, including device identifiers and browsing activity.

The data was used to provide personalized product recommendations and train the companies’ recommendation algorithms. However, users had not consented for tracking.

The CNIL ruled that the practice violated Article 82 of France’s Data Protection Act. The regulator found that the tracking did not qualify for any legal exemptions and therefore required users’ prior consent. As a result, Fnac Darty Participations et Services was fined €6 million, while Fnac Direct received a €1 million fine.

Lyft agrees to pay $1.8 million over California privacy violations

Jurisdiction

United States

Infringer Legal Name

Lyft

Infringer Domicile

United States

Alleged Violation

Privacy laws violation

Enforcement Action

$1.8 million penalty

Case Status

Administrative action

American ridesharing company Lyft has agreed to pay $1.8 million in civil penalties to settle claims that it violated California privacy laws.

The settlement follows allegations that Lyft made it difficult for users to opt out of having their personal information sold or shared. Under the California Consumer Privacy Act (CCPA), companies must provide consumers with a clear and simple way to exercise this right.

According to the California Attorney General’s office, Lyft previously buried its opt-out option behind several links in its privacy policy. Users also had to log in again and provide additional personal information to complete the process.

The investigation found that the mechanism created unnecessary barriers for consumers trying to protect their privacy. Lyft had also been sharing personal information, including location data, to display targeted advertisements within its app since mid-2023.

In addition to the $1.8 million penalty, Lyft is required to introduce a clear opt-out option directly in its app and inform California users of their right to prevent the sale of personal information.

Major Canadian telecom provider fined $15M over “unlimited” data claims

Jurisdiction

Canada

Infringer Legal Name

Rogers Communications

Infringer Domicile

Canada

Alleged Violation

Misleading advertising

Enforcement Action

$15 million penalty

Case Status

Administrative action

Major Canadian telecommunications and media company Rogers Communications has been ordered to pay a $15 million administrative penalty over misleading advertising of its “Infinite” wireless phone plans.

Canada’s Competition Bureau filed an application with the Competition Tribunal in December 2024, alleging that Rogers gave customers the false impression that its plans offered unlimited data.

However, the plans significantly reduce internet speeds once customers reach a certain data limit, meaning users may experience much slower service even though their data remains available.

The Tribunal also ordered Rogers to publish a corrective notice and reimburse the Competition Bureau for its legal fees.