It was totally predictable, unfortunately. At least in the EU it’s quite illegal and even if a car maker slips something in, GDPR is always there so one can request a copy and have it deleted. Wish the regulation was even stricter though.
a) Zero trust in the car manufacturers to really respect GDPR
b) Zero repercussions for actually stealing my PII. Okay, maybe VW will pay a minuscule fine, but they won't