China publishes data security rules in auto industry
China has issued auto data security rules, requiring companies that process vehicle data to protect personal information collected from cars.
The rules, which take effect on October 1, target automakers, component and software vendors, dealerships and other service companies that process car data in China. These companies should fully inform and obtain the consent of vehicle owners and passengers before collecting and using their personal data, according to rules released on Friday by the Cyberspace Administration of China and four other ministries.
The rules, which follow a draft released in May, also stipulated the different types of automotive data and how it should be handled. “Important data”, including sensitive military and government locations, big data on public transport and electric vehicle charging facilities, as well as personal data sets of more than 100,000 people, are expected to be stored in China, according to the rules.
Meanwhile, other types of data could be shipped overseas for business purposes, but they must be approved by the cyberspace regulator and other state agencies, according to the rules.
As more vehicles become electrified or have greater range capabilities, automakers and others have collected more data on cars. Such measures have fueled civil servants’ concerns about the risks associated with security and data management.
China has restricted the use of Tesla Inc. vehicles by military personnel and employees of key state-owned companies, the Wall Street Journal reported.
The rules also define principles for automatic data processing. They require the reduction of unnecessary and arbitrary collection and sharing of data. According to the rules, data must be desensitized before processing to prevent abuse.
They are also asking companies that deal with “important data” to review their data security management with local authorities every year, in accordance with China’s data security law that comes into force in September.
Shares of Hong Kong-listed automakers fell broadly on Friday. Chinese electric car maker Li Auto Inc. closed down 4.0%, while rival XPeng Inc. fell 4.4%. Geely Automobile Holdings fell 3.9% and BYD Co. fell 3.1%, all underperforming the 1.8% drop in the Hang Seng index.
Also on Friday, China approved the Personal Information Protection Act, a sweeping privacy law that will limit data collection by tech companies, but analysts believe the policy is unlikely to limit the widespread use of the state oversight.
Write to editors in Singapore at [email protected]