The "Several Provisions on Automobile Data Security Management (Trial)" (hereinafter referred to as the "Regulations") came into effect on October 1, 2021. As soon as the May release of the "Several Provisions on Automotive Data Security Management (Draft for Comments)" (hereinafter referred to as the "Draft for Comments") was released, it sparked heated discussion. At that time, we also interpreted the Draft for Comments. If interested, please click: Analysis of the Several Provisions on Automotive Data Security Management (Draft for Comments) (Part 1).
After three months of feedback and revisions, what changes and compliance challenges in the "Regulations" are worth noting? Let's learn together:
1. Applicable Subjects
The "Regulations" further clarify the principle of territoriality. According to Article 2: Automobile data processing activities and their safety supervision within the territory of the People's Republic of China must comply with relevant laws, administrative regulations, and the requirements of these provisions.
In Article 3, the concept of "operator" in the "Draft of the Opinion" is changed to "automotive data processor":
Concept
Definition
Automotive data processor
Refers to organizations engaged in automotive data processing activities, including automakers, parts and software suppliers, dealers, repair institutions, and mobility service companies.
Analysis:
- Whether white or black, as long as they engage in automotive data-related activities within China, they are subject to regulation. Therefore, many foreign-invested enterprises are quite anxious about the introduction of the "Regulations";
- All operators in the automotive industry chain are included within the scope of the "Regulations." In addition to common automakers, parts suppliers, dealers, after-sales companies, and ride-hailing companies, a large number of software service providers are included in the regulatory scope, such as those involved in navigation, autonomous driving, in-car entertainment system providers, and so on;
- Compared with the Draft Opinions, the Provisions delete insurance institutions. It's not that insurance institutions can be exempted; rather, after consideration, legislators believe that insurance and banking institutions are, after all, children of the financial system, and that it would be more appropriate for the financial industry to oversee them. This is a coordination between departmental laws.
2. What is the important data?
According to Article 3 of the "Regulations," automotive data includes personal information data and important data. The definition of important data is as follows:
Concept
Definition
Key data
(1) Geographic information, personnel flow, vehicle flow, and other data from important sensitive areas such as military management zones, national defense science and technology units, and party and government organs at or above the county level;
(2) Data reflecting economic operations, such as vehicle flow and logistics;
(3) Operational data of the vehicle charging network;
(4) Exterior video or image data containing facial information, license plate information, etc.;
(5) Personal information involving more than 100,000 personal information subjects;
(6) Other data determined by the national cyberspace administration and relevant departments of the State Council for development and reform, industry and information technology, public security, transportation, and other relevant departments that may endanger national security, public interests, or the legitimate rights and interests of individuals or organizations
Analysis:
- Compared to the Draft Opinions, the removal of high-definition map mapping data does not mean these data are unimportant; on the contrary, they are very important. Various sensors in smart cars (such as millimeter-wave radar and cameras) collect road conditions and exterior data, combine it with high-definition maps, and then feed it back to the car for decision-making. This process may be considered surveying and mapping, and the processed data may involve Guo Jia's secrets.
Guo Jia has a strict set of legal regulations and procedures for surveying data, so it is estimated that the "Regulations" will no longer restrict the requirements for surveying data;
- Added a clause for "Personal information involving more than 100,000 personal information subjects."
3. Principles of Data Processing
According to Article 6 of the "Regulations," automotive data processors must adhere to the following principles when conducting automotive data processing activities:
Principle
Specific content
Principles for handling inside the vehicle
Unless absolutely necessary, do not provide it outside the vehicle
Default is not to collect the principle
Unless the driver sets it themselves, the default setting is to no collection each time you drive
Principles for applying accuracy ranges