General Motors has agreed to pay $220 million to settle a data privacy lawsuit brought by attorneys general from 35 states. The case centres on GM’s Smart Driver programme and concerns about how vehicle data was collected, used and shared. The settlement is a reminder that information generated by connected products can create significant responsibilities for the businesses behind them.
For companies in Denmark and across Europe, the lesson extends well beyond the automotive industry. Websites, apps, booking systems and customer databases can all collect personal information. At Best Choice, we help businesses design digital systems that use data responsibly, make privacy choices clear and automate day-to-day work without collecting more information than necessary.
1. What the GM settlement signals for businesses
The lawsuit focused on GM’s Smart Driver programme and the handling of information about drivers. A connected vehicle can generate details about journeys and driving behaviour, making it important to explain what is collected, why it is needed and who may receive it. The settlement does not mean every data-driven business faces the same claims, but it highlights the risks of unclear or poorly controlled data practices.
Customers increasingly expect businesses to be transparent. If people discover that their information is used in ways they did not understand, trust can fall quickly. For a small business, that loss of confidence can be just as damaging as the cost of investigating and fixing a technical or compliance problem.
2. Map the data your systems collect
A practical first step is to create a simple map of the information flowing through your business. List what each website, app, CRM, booking system or connected device collects, where it is stored, which staff or suppliers can access it, and when it should be deleted. This often reveals duplicate records, unnecessary tracking or information being sent to systems that no longer need it.
For example, a clinic may need appointment details and contact information to provide care, but may not need to keep every abandoned booking form indefinitely. A café’s online ordering system may need delivery details to complete an order, while retaining those details for unrelated marketing would require a separate, well-explained purpose.
We can help businesses review how their systems work and build a clearer data flow. When systems are connected properly, staff spend less time copying information between tools, and managers can better understand where sensitive data is held.
3. Make consent and privacy choices understandable
Privacy notices and consent requests should be written for people, not just lawyers. Explain the purpose of collection in plain language, give customers a meaningful choice where consent is required, and make it straightforward to change that choice later. Avoid making optional marketing or analytics feel like a condition of using a service when it is not.
In Denmark and across the EU, businesses must consider the GDPR and, where relevant, rules on cookies and electronic communications. The correct legal basis depends on the activity, so companies should seek qualified legal advice for their situation. On the technical side, we can implement consent preferences so they are recorded and respected across websites, marketing tools and customer systems.
Open-source tools such as Klaro! can help manage website consent, while Matomo offers an analytics option that businesses can configure with privacy in mind. These tools still need thoughtful setup: installing a privacy-focused platform does not by itself guarantee compliance.
4. Build privacy into automation and integrations
Automation can reduce manual work, but it can also spread data farther and faster if integrations are not carefully planned. A warehouse system might send order details to a delivery provider, for instance, while a webshop shares customer information with accounting and support tools. Each connection should have a clear business purpose and pass only the data needed for that task.
At Best Choice, we can build custom workflows that connect business systems while limiting unnecessary data sharing. We can also add role-based access, activity logs and automated retention rules, helping teams see who can access information and when records should be reviewed or removed.
For a booking service, this might mean automatically sending a reminder without giving every employee access to a customer’s full history. For an online store, it could mean passing an order number and delivery details to a logistics service without exposing unrelated customer notes.
5. Prepare for customer requests and data incidents
Businesses should have a reliable process for handling requests from people who want to access, correct or delete their personal data. If information is scattered across spreadsheets, inboxes and separate platforms, responding can take far longer than expected. A well-designed CRM or central data workflow can help staff find relevant records and track what action has been taken.
It is also wise to prepare for mistakes and security incidents before they happen. Define who should be notified internally, how access can be restricted, and where accurate system records can be found. Regular staff training matters too: a carefully built system is less effective if employees do not know how to use it safely.
6. Turn privacy into a business advantage
Responsible data handling is not only about avoiding problems. Clear choices and sensible security can strengthen customer confidence, while cleaner data can improve reporting and marketing decisions. When a business collects only useful information, teams often spend less time managing duplicates and outdated records.
Start with a small review: list your main systems, identify the personal data they hold, check who can access it, and confirm how long it is kept. Then prioritise the biggest risks and the simplest improvements, such as removing unnecessary form fields or limiting staff permissions. For wider projects, an IT partner can help connect privacy requirements with practical business processes.
Conclusion
The GM settlement shows why organisations should take connected data and customer transparency seriously. Businesses in Denmark and across Europe can reduce risk by understanding their data flows, explaining choices clearly and designing automation with privacy in mind.
At Best Choice, we help businesses review and improve their websites, apps, integrations, databases and automated workflows. Contact us to discuss a practical solution that supports your operations while treating customer data with care.
