◆ Smart connected vehicles collect and process personal information through cameras, sensors, and microphones, which is legally limited to the “necessary minimum”.
◆Smart connected vehicles form a digital ecosystem in a vertical field, establishing a networked interconnection between cars, smartphones, computers, cameras, various sensors, road infrastructure, servers, data centers, etc. This requires all manufacturers of components or systems containing digital elements across the supply chain to jointly bear the responsibility for network security.
◆The car is not only a means of transportation for most people but also a mobile private space, a personal domain for family gatherings and relaxation. Smart connected vehicles urgently need to develop a culture of privacy-friendly product design to enhance users’ sense of control over their privacy.
In the closed testing ground of the national-level vehicle networking pilot zone in Tianjin (Xiqing), smart connected vehicle testers conduct debugging and testing before the closed test begins (photo taken on June 14, 2024) by Sun Fanyue / This Journal“I used to think the inside of a car was a safe private space, but now that cars are connected and smarter, I worry that they collect my privacy and may leak it,” said Ms. Zhang, a smart connected vehicle owner.
Ms. Zhang’s anxiety is not unfounded. To better achieve functions like assisted driving and smart navigation, many cars, especially new energy vehicles, are accelerating the advancement of vehicle networking. Smart connected vehicles collect personal information such as driving trajectories, driving habits, facial fingerprints, and in-car voice to provide intelligent and personalized services.
In this sense, smart connected vehicles are not just transportation tools but also information collectors. It is reported that a smart connected vehicle can generate terabytes (1TB=1024GB) of massive data every day, including high-definition video data, high-precision location information, and highly sensitive personal privacy information, which poses risks to the privacy safety of vehicle owners.
Moreover, these risks are being ignited – in 2023, a certain brand of car was reported to have leaked data from over 2.15 million users; in the same year, nine former employees of a foreign car company revealed that employees had shared videos and images recorded by the customer’s in-car camera through internal systems…
When the car itself is also a data collector, how can owners feel secure about their privacy?
“Necessary Minimum”
The acceleration of vehicle intelligence has led to an increasingly tense battle for privacy security.
According to data from CCID Consulting, the global penetration rate of new smart connected passenger vehicles has exceeded half in 2023; the penetration rate in the Chinese market reached 68.2%, expected to rise to 78.9% by 2025, dominating the passenger vehicle market.
Several experts interviewed by the “Outlook” Weekly reported that under the rapid development trend of smart connected vehicles, the collection and processing of personal information through cameras, sensors, and microphones is legally confined to the “necessary minimum” for the sake of information security.
China’s Civil Code, Cybersecurity Law, Data Security Law, and Personal Information Protection Law provide fundamental guidelines for the collection and processing of vehicle data. For example, the Civil Code requires that “the processing of personal information should adhere to the principles of legality, legitimacy, and necessity, and shall not be excessive.” The Personal Information Protection Law stipulates that “the collection of personal information should be limited to the minimum scope necessary to achieve the processing purpose and shall not excessively collect personal information.”
This means that necessity is the premise for collecting personal information. Zhu Wei, deputy director of the Communication Law Research Center at China University of Political Science and Law, stated that the collection of personal information by smart connected vehicles must be authorized by users and only collect information that is meaningful and necessary for driving purposes. “For example, if a vehicle does not collect location information during the journey, it cannot achieve navigation function, and this information is necessary. However, if the car accesses the user’s contact list and records phone calls in the car to push targeted ads based on the collected data, it constitutes excessive information collection.”
Some experts also suggest that it is necessary to comprehensively assess which information collection is necessary based on changes in user requirements for vehicle functions. Gao Xiang, director of the Supply Chain Research and Cooperation Center of the China Electric Vehicle Hundred People’s Association, said: “For instance, if the phone rings while driving, some vehicles will automatically voice prompt who is calling. Achieving this function requires connecting the phone and the vehicle, allowing the vehicle to read the phone’s contact list. Vehicles will develop new functions to enhance user experience and safety, and the realization of these functions relies on data collection.”
The “Several Provisions on the Management of Automotive Data Security (Trial)” implemented in October 2021 proposed clear data security requirements, advocating that automotive data processors adhere to four principles in conducting automotive data processing activities: in-vehicle processing principle (do not provide data externally unless absolutely necessary), default non-collection principle (unless the driver sets it otherwise, the default setting for each drive is non-collection), precision range applicability principle (determine the coverage and resolution of cameras, radars, etc., based on the accuracy requirements of the provided functional services), and desensitization processing principle (carry out anonymization and de-identification processing as much as possible).
Although laws and regulations have made provisions for privacy protection in smart connected vehicles, there are still challenges in practical implementation, such as insufficient detail and unclear definitions of data rights and responsibilities, making it difficult for consumers to provide evidence of privacy infringement by car companies.
Guo Qing, a partner at Anli Law Firm, told reporters that under the principle of who claims, who proves, the court will first clarify whether the data disclosed by the car company indeed belongs to privacy, then determine whether the disclosure behavior is inappropriate, assess whether the disclosure of privacy by the car company has caused damage and loss to the individual, and finally clarify the legal causal relationship between the car company’s disclosure behavior and the losses incurred by the owner. “Car owners need to provide evidence according to these four conditions, which is quite difficult,” Guo said.
“Many car companies state that data ownership belongs to consumers, but when some consumers dispute data collection with car companies, it is very difficult for consumers to obtain relevant data from the car companies as evidence,” said a related person in charge of automotive safety testing at the automotive information platform “Dongchedi.” Car companies should strengthen self-discipline, manage data well, and fully communicate with consumers to meet reasonable data acquisition requests.
How to Build a Good Privacy Security “Firewall”
Smart connected vehicles must ensure functional safety and information security, raising higher requirements for the construction of relevant technical “firewalls”.
Currently, the data storage methods of smart connected vehicles can be divided into in-vehicle, cloud, and edge storage based on storage location. In-vehicle storage usually utilizes onboard hard drives and other devices, cloud storage uploads large amounts of data to cloud servers, while edge storage stores data at edge nodes close to the vehicle, such as roadside base stations and smart traffic facilities.
Generally speaking, sensitive data stored in vehicles has a relatively lower risk of leakage among the three storage methods since it does not leave the vehicle, which is beneficial for privacy protection, but is limited by storage capacity and computing power. Therefore, car companies tend to store a certain proportion of data in the cloud and edge nodes. This poses greater challenges for smart connected vehicles in terms of data access control, data encryption and decryption, and resisting cyber attacks.
The aforementioned person in charge of automotive safety testing at “Dongchedi” stated that car companies are increasingly investing in the research and development of data security assurance technologies. “In the past, the underlying logic for car companies to ensure data security was based on compliance requirements and the protection of corporate trade secrets. Now, some new energy vehicle companies pay more attention to enhancing user experience and trust through data security assurance to increase brand competitiveness.”
It is understood that many car companies tend to establish an integrated digital platform to consolidate data resources from the very beginning of vehicle design and, based on this, establish a unified data security architecture. Some car companies are also building intelligent and automated data security management through conventional operations such as data access control and data desensitization and anonymization.
Experts believe that as the number of users of smart connected vehicles and related personal information data continues to increase, car companies’ data security teams can accelerate the exploration of cutting-edge data protection technologies. For example, utilizing the distributed storage and tamper-proof characteristics of blockchain to establish a decentralized system for vehicle networking data access control, enhancing the security of access control; applying privacy computing technology to complete data statistics and analysis under the condition of “data available but invisible”; and establishing intelligent intrusion detection and defense systems to automatically identify and resist new types of cyber attacks.
At the same time, strengthening the information security network of smart connected vehicles also requires relevant supply chain enterprises to form a synergy in terms of responsibility and technology. Some experts have proposed that smart connected vehicles constitute a vertical digital ecosystem that establishes networked interconnections between cars, smartphones, computers, cameras, various sensors, road infrastructure, servers, data centers, and other elements. Therefore, all manufacturers of components or systems containing digital elements across the supply chain need to jointly bear the responsibility for network security, rather than simply packaging security responsibility to vehicle manufacturers or even shifting it to users.
As smart connected vehicles and other intelligent products increasingly integrate into life, consumers need to ensure control over their own privacy and feel the atmosphere of privacy-friendly intelligent products.
Interviews with several smart connected vehicle owners revealed that some owners become distracted while driving due to privacy concerns, preventing them from fully enjoying the convenience and fun brought by smart technology. Some owners are also reluctant to use certain innovative and convenient smart services that require collecting more personal privacy for privacy security reasons.
Clearly, the anxiety of vehicle owners regarding privacy security, along with the resulting resistance to technology, urgently requires the development of a privacy-friendly product design culture in smart connected vehicles to enhance users’ sense of control over their privacy.
In the second half of 2024, “Dongchedi” tested over 120 popular models, and more than half of the models were equipped with in-car cameras, but about 60% of the models did not have adjustable physical covers for the cameras, and about 24% of the models even had camera functions that could not be manually turned off. The aforementioned person in charge of automotive safety testing believes that “users should have the right to choose whether they are filmed by in-car cameras.”
The “2022 China Consumer Awareness and Concerns Survey on Data Security and Personal Privacy in Smart Connected Vehicles” shows that Chinese consumers lack overall confidence in whether smart vehicle manufacturers can properly protect personal sensitive information – more than 40% of surveyed consumers expressed complete lack of confidence or low confidence in this regard. They believe that compared to smartphone manufacturers, smart vehicle manufacturers implement fewer measures to inform users about personal data collection, and users are less aware of the personal information collected by smart vehicles.
In response, experts believe that the development of mobile information permission management provides certain ideas for car companies. Car companies can refer to mobile information management permission settings, allowing users to decide whether to enable hardware devices like in-car cameras and microphones to avoid excessive information collection.
Privacy-friendly smart vehicle design is attracting more attention. In November 2024, the China Association of Automobile Manufacturers released the “Automotive Privacy Protection” label, authorizing the first batch of over 20 models that passed the evaluation to use this label. The CAAM focuses on evaluating automotive privacy protection capabilities around six aspects: privacy agreements, microphones, in-car cameras, location information, external cameras, and user experience, covering information collection authorization, collection prompts, access authorization, data deletion, and transmission encryption, thereby enhancing consumers’ trust in vehicles.
Many interviewees believe that cars are not only means of transportation but also mobile private spaces, personal domains for family gatherings and relaxation. This requires smart connected vehicles to retain users’ sense of safety, trust, and intimacy with the vehicle while developing. “Car companies must earn people’s trust; losing trust equals losing the market,” Gao Xiang said.
From a technological development perspective, smart connected vehicles are pushing modern automotive civilization into a new era of significance, and the ensuing privacy anxiety reflects the struggle between technology and ethics in the smart age.
Moreover, Chinese car companies that play a leading role in technological innovation in smart connected vehicles also bear the responsibility of driving the industry toward the “next station” in data security. This requires relying on the powers of law, technology, and culture to seek a dynamic balance between technological advancement and ethical guardianship, promoting digital technology to settle into digital civilization and building an intelligent society that protects privacy security.
Video Recommendations
