Information Security Standardization Committee: Data collected by connected cars must not be used indiscriminately

The Secretariat of the National Information Security Standardization Technical Committee released the draft standard "Security Requirements for Data Collected by Connected Vehicles Using Information Security Technology".

The basic requirement states that data processing activities unrelated to vehicle management and driving safety shall not be carried out based on the data collected by connected vehicles and the data obtained through their processing; if the national administrative department has other requirements for vehicle data processing, such requirements shall be followed.

The draft specifically stipulates the following points:

Data shall not be transferred without the separate consent of the person being collected

The draft stipulates that in terms of data transmission, connected cars shall not transmit data containing personal information to the outside of the car through the network or physical interface without the separate consent of the person being collected. Except for video and image data whose clarity has been converted to less than 1.2 million pixels and whose face, license plate and other information that can identify personal identity have been erased; connected cars shall not transmit audio, video, image and other data collected in the car cabin and the data obtained through their processing to the outside of the car through the network or physical interface.

Data storage time does not exceed 7 days

In terms of data storage, the vehicle location and trajectory-related data collected by connected vehicles must not be kept in the vehicle's storage devices or the telematic service platform (TSP) for more than 7 days.

Data cannot leave the country

In terms of cross-border data, data such as roads, buildings, terrain, traffic participants, etc. collected by connected cars from the external environment through sensors such as cameras and radars, as well as data related to vehicle location and trajectory, shall not be allowed to leave the country. If data such as driving status parameters and abnormal alarm information of connected cars need to be exported, they must comply with relevant national regulations on data export; when connected cars transmit data across borders in an encrypted manner, when the regulatory authorities conduct spot checks and verifications, they should provide information such as the format of the transmitted data and the encryption method, and provide relevant data content in plain text as required.

At present, the draft has begun to solicit public opinions, and the deadline is 24:00 on May 15, 2021.