Yep, and this will be the end of CARIAD. Volkswagen has already b decided to bleed them to death with the Rivien joint-venture. I guess they'll shut down the rest of the operation much, much faster now. This is the perfect reason for them to do so and what they have been waiting for.
That's not how the GDPR works. Cariad may be a subcontractor (data processor in GDPR speak) for VW, but the driver does not have a contract with Cariad -- their contract is with VW (the data controller in GDPR speak). The data controller is always jointly liable with the processor for 3rd-party data breaches.
