> I would not be surprised if there were no consequences at all until it hit the press or someone in a position of power was embarrassed.

At which point the Data Protection Authorities (GDPR enforcement) would get involved. They would almost certainly levy a hefty fine against the auto manufacturer.