How to protect the privacy of new energy vehicles when collecting data at all times?
2024-12-02
With nothing to do, I asked my classmate XX where I have been in the past month. It actually counted the places I have been to. I was confused, how could it collect this kind of information about me? "Mr. Li, a new energy car owner living in Beijing, was deeply troubled after chatting with car AI recently. Many car owners have the same problem. In recent years, the intelligence and networking index of new energy vehicles have continuously reached new highs, and related equipment of new energy vehicles is collecting and uploading information inside and outside the vehicle at all times. How to clarify the boundary between data usage and privacy protection, and protect the privacy and security of new energy vehicle owners, has become a concern for many car owners. The interviewed experts believe that according to relevant laws and regulations, car companies should follow the principles of legality, legitimacy, and necessity when collecting personal information from car owners, that is, car companies should not collect personal information without the consent of car owners. For the collection of video data such as faces and audio data such as voiceprints of car owners and passengers through cameras and recording devices, which are the most concerned and sensitive data for car owners, car companies should obtain the explicit consent of car owners when collecting such information. Collecting cabin data information requires the explicit consent of the car owner. Mr. Li has been driving for over 15 years and initially drove a gasoline car. With the increasing maturity and intelligence of new energy vehicle technology, he replaced his gasoline car with a new energy vehicle at the beginning of last year. During driving, he and his 7-year-old daughter often chat with car AI and enjoy the convenience brought by the intelligence of new energy vehicles. Recently, while waiting to pick up his daughter from school, he started chatting with car AI to pass the time. He was curious for a moment and asked it, "Where have I been in the past month, student XXX?" The car AI replied, "Have you been..." Mr. Li was stunned at the time. How could the car AI collect all the places he had been to? He immediately remembered something from last year. In December last year, a car of the brand he purchased had a serious traffic accident in Qingyuan, Guangdong, causing casualties. Car companies quickly explained the situation of vehicle collision accidents through official social media accounts, using text descriptions and published driving record videos. Mr. Li told reporters that after the incident, he contacted the car company's sales team to ask why the car company had this information. The sales team responded that the driving records were stored in the car's built-in USB drive, and the data needed the owner's authorization to upload, but it did not include the motion trajectory or recording function. Mr. Li quickly searched for authorization options, but couldn't find them. The fact that car companies can obtain and publish driving record videos in a timely manner raises concerns about the protection of car owners' privacy information Mr. Li said. He also consulted the "User Privacy Policy" on the official website of the car company, which stated: "We need to collect and process vehicle data related to the use, operation, and condition of the vehicle through the supporting on-board sensing devices of the car products, including vehicle VIN code and vehicle driving status data... In accordance with the provisions of laws and regulations, we will store your personal information collected and generated during domestic operations in the data center located in Beijing, which is controlled by us, within the territory of the People's Republic of China." During the interview, many new energy vehicle owners expressed that they are not clear about what information new energy vehicles will collect, nor do they know when their information will be collected. The reporter found through the user agreements of multiple new energy vehicle brands that the collected information includes detailed communication records, friend contact lists, schedule information, property information, internet records, commonly used device information, and other content that is not related to intelligent driving or even completely unrelated. Some agreements even stipulate that car companies can commercially utilize user databases. So, what information can car companies collect from users? Lawyer Wang Yixiang from Beijing Yinghe Law Firm introduced that according to the Personal Information Protection Law and the "Several Provisions on the Management of Automotive Data Security (Trial)", car companies should follow the principles of legality, legitimacy, and necessity when collecting personal information from car owners. Among them, the principle of necessity requires car companies to collect personal information to the minimum extent necessary to fulfill the needs of car owners, that is, the principle of non essential collection. Car companies are not allowed to collect personal information without the consent of car owners. At present, some intelligent connected vehicles mainly collect data types such as driving speed, route, and vehicle operating status data, as well as cabin data involving personal information, that is, video data such as the faces of car owners and passengers collected through cameras and recording devices, as well as audio data such as voiceprints. These are the most concerned and sensitive data for car owners, and car companies should obtain the explicit consent of car owners when collecting such information Wang Yixiang said. There is a risk of information leakage. Car companies evade responsibility through agreements. Many interviewed car owners are concerned that after collecting cabin data involving personal information of car owners, car companies are prone to leakage risks. Mr. Zhai, a resident of Beijing, shared his experience with reporters: "Last Spring Festival, when I was driving back home, the car AI reminded me that I was in a state of fatigue driving. After asking the customer manager, he learned that the car uses infrared technology to monitor eye conditions such as pupils. If it is inferred that the driver is in a state of fatigue, it will prompt fatigue driving. It is a good thing to remind safe driving, but I don't know if the car company will commercialize this information after collecting it." Mr. Chen from Chengdu, Sichuan Province told reporters that in October last year, when he renewed his new energy vehicle insurance, he found that his insurance premiums had increased significantly compared to the previous year. When I asked the insurance staff, I found out that his car had a low rating. The insurance staff listed several factors that affect the insurance premium for him: for example, his car has to travel about 200 kilometers every day, charges almost every day, and drives continuously for more than 4 hours multiple times. There are also many traffic violation data, which makes his car prone to traffic accidents, so the insurance premium needs to increase. I haven't provided any other data except for traffic violation data, how did they know Mr. Chen was very surprised by this. Either the car company voluntarily leaks to the other party, or there are loopholes in the information collection and storage process of new energy vehicles. If I keep driving like this, everyone else will know exactly where I go and whom I meet every day Mr. Chen said. Ms. Liu, a new energy vehicle owner from Inner Mongolia Autonomous Region, told reporters: "Not long ago, I received a call from the 4S dealership, and they actually knew that my car had driven 3000 kilometers and reminded me to go for the first maintenance. This made me wonder if they could see my vehicle's activity trajectory and mileage." It is understood that new energy vehicles integrate advanced sensor technology, cloud computing, big data, artificial intelligence and other high-tech technologies, which can achieve functions such as autonomous driving, intelligent navigation, and remote monitoring. The implementation of these functions relies on the collection, processing, and analysis of a large amount of data. For example, with the development of intelligent vehicle technology, more and more new energy vehicles are equipped with in car cameras. Many models come standard with driver monitoring cameras for the driver, while some high-end models also have in car observation cameras and rear entertainment system cameras. Outside the car, the camera can collect road data and upload it to the car company's database to continuously upgrade the vehicle's driving assistance system. As a major feature of new energy vehicles is their networking ability, multiple vehicle data will be synchronized and uploaded in real-time to the car company's cloud backend system. In the car, the camera can capture faces, recognize different car owners, and automatically adjust preset vehicle settings, driving modes, etc. according to different car owners. But this process itself also carries significant security risks. In 2023, a certain brand of car was exposed to over 2.15 million user vehicle data breaches, covering almost all customer groups registered on the brand's main cloud service platform since 2012. In February 2024, a configuration error occurred in the cloud storage server of a well-known brand of car, resulting in the exposure of private keys, internal data, and other sensitive information to the public eye... In addition, various new energy vehicle data leakage incidents such as in car videos and data being made public or spread on social media have emerged in recent years, causing widespread social attention. But during the investigation, reporters found that many car companies would evade responsibility through agreements to avoid potential issues such as user privacy breaches. For example, the official website of a new energy vehicle company claims that due to the special nature of network services, users need to agree that XX Automobile will change, interrupt some or all of its network services, and delete (no longer save) any information submitted by users during use, without notifying users or assuming any responsibility to any users or third parties. Another new energy vehicle company has stated that unless otherwise specified by laws and regulations or our fault exists, we will not be liable for damages, including but not limited to: due to hacker attacks, computer viruses, telecommunications department technical adjustments or network failures, website upgrades, banking issues, etc. Experts interviewed pointed out that currently, the development of new energy vehicles has entered the fast lane, and data security has become a major challenge and key factor for the healthy development of the intelligent vehicle industry. Only by improving legal rules and securing the "safety belt" for intelligent vehicle data can we achieve stability and ensure that intelligent vehicles truly move towards a smart, convenient, and safe future. Professor Zhai Yehu from the Law School of Capital University of Economics and Business believes that for the protection of basic information, principles such as legality, legitimacy, necessity, and good faith are usually followed; The protection of sensitive information is even stricter, and generally requires the consent of the information subject. Without consent, it may constitute infringement. It is particularly important to clarify that vehicle tracking belongs to the category of sensitive information, and its disclosure must obtain the consent of the owner, otherwise it may infringe on the owner's privacy rights. New energy vehicle companies must comply with relevant laws and regulations in the process of collecting, storing, and circulating information. The principle of necessity requires that if the personal information of the car owner is no longer necessary to be saved after use, the car company should delete it. At the same time, car owners have the right to request car companies to delete relevant information, which is known as the right to delete or the right to forget personal information, and is explicitly stipulated in the Personal Information Protection Law and the Civil Code's tort liability section. It should be emphasized that if a car company leaks or resells personal information of car owners on a large scale, it not only constitutes infringement under civil law, but may also violate the crime of reselling personal information under criminal law and bear criminal responsibility Zhai Yehu said. Regarding whether car companies can disclose the relevant personal information of car owners as needed, Associate Professor Wang Yegang from the Law School of Central University of Finance and Economics believes that this actually involves the legality judgment of personal information processing. According to the provisions of the Personal Information Protection Law, the disclosure of personal information is essentially a personal information processing behavior. Therefore, the disclosure of relevant personal information of car owners by car companies should also meet the conditions for processing personal information in accordance with the law, that is, in principle, the consent of the car owner should be obtained; If the consent of the car owner is not obtained, the car company shall disclose relevant personal information and shall prove that its behavior complies with the legal provisions that do not require personal consent. Otherwise, it shall not disclose the personal information of the car owner without authorization. How to balance the need to collect relevant information for new energy vehicles due to their onboard functions and the need to protect the privacy rights of new energy vehicle owners? Wang Yegang said that for car companies, they should take into account the protection of users' personal information when developing related functions
Edit：Rina Responsible editor：Lily
Source：
Special statement: if the pictures and texts reproduced or quoted on this site infringe your legitimate rights and interests, please contact this site, and this site will correct and delete them in time. For copyright issues and website cooperation, please contact through outlook new era email：lwxsd@liaowanghn.com
Recommended Reading Change it 
Home
