On April 29, 2021, the National Information Security Standardization Technical Committee organized the drafting of the standard draft “Security Requirements for Collecting Data of Internet-connected Vehicles” and solicited public feedback.
The following is a summary of the contents of this draft:
-
Data processing activities unrelated to vehicle management and driving safety shall not be carried out. If there are other requirements from the state administrative department for automobile data processing, they shall follow those requirements.
-
Personal information data containing shall not be transmitted outside the car without the separate consent of the data collector. Exceptions are made for videos, image data and other information below 1.2 million pixels and with erased identifiable personal identity information such as faces and license plates.
-
Data such as audio, video and images collected in the car cabin and processed shall not be transmitted outside of the car.
-
The storage time of vehicle position and trajectory-related data collected by Internet-connected vehicles in onboard storage devices and remote information service platforms (TSP) shall not exceed 7 days.
-
Data collected from external environmental such as road, building, terrain and traffic participants, as well as vehicle position and trajectory-related data, shall not exit the country. If vehicle operating status parameters, abnormal warning information, and other data need to exit the country, they should comply with relevant regulations on data export from the country.
From the perspective of content, this draft standard is very similar to the “Guidelines for the Access Management of Intelligent Internet-connected Vehicles by Production Enterprises and Products (Trial) (soliciting opinions)” released by the Ministry of Industry and Information Technology on April 7, 2021, and clarifies the necessity of local storage.
However, this standard doesn’t seem very reasonable. The clause “Data such as audio, video and images collected in the car cabin and processed shall not be transmitted outside of the car” implies that the collection of personal vehicle information by car owners themselves will also be restricted, such as watching videos recorded by an Internet-connected driving recorder. It is hoped that the official will provide detailed explanations for each article.
🔗 Source: CAC
This article is a translation by ChatGPT of a Chinese report from 42HOW. If you have any questions about it, please email bd@42how.com.