GDPR to the rescue
> JLR needs a bullet-proof method for this to be automatically disconnected when the vehicle changes hands. I don't know how you do this but the current process is clearly not sufficient."
There is a bullet-proof method. It's called 'reminding' JLR that they can be fined up to 4% of global revenue because they are a data processor, processing personal information about you (your home address for starters) and allowing that information to be passed to an unknown 3rd party without your consent and without a clear business need.
If they don't act immediately you can also 'remind' them that you can start a private prosecution - no need to wait for the ICO to review and take up your case.