"The auto industry is unique in that an 18-year-old employee from Texas can query the billing information of a vehicle in California, and it won’t really set off any alarm bells."
It seems like nothing in the current set of regulatory schemes or business practices will stop automakers from chucking everyone's detailed car telemetry and other PII into one giant database and then improperly securing it...
https://samcurry.net/hacking-subaru
(This time it was Subaru.)
Note there's no Europe in that database, though. I wonder if GDPR made them take it more seriously, or if there's just a second giant Europe database out there somewhere... (The recent VW experience suggests the latter.)