Stricter regulations on car data drafted for public feedback

The Cyberspace Administration of China on Wednesday began to solicit public opinion on draft rules on regulating the handling of car data by manufacturers and service providers, aiming to strengthen the protection of personal and important data and safeguard public interests.

The rules will apply to the collection, analysis, storage, transmission, search, utilization and deletion of personal data and important data, as well as providing the information and data abroad, in processes of automobile design, production, sales, maintenance and management.

The automobile-related business operators in the rules cover carmakers, parts and software suppliers, dealerships, maintenance and online car-hailing service providers and insurance companies.

The term "personal information "in the rules includes the personal information of the car owner, driver, passengers and pedestrians, and the information that can help infer an individual's identity, and describes an individual's behavior.

The rules advocate that while handling the information and data, automobile-business operators should follow such principles as in-car handling, anonymity, minimum storage life and defaulting for the opting out of data collection.

The collection and provision by operators of sensitive personal information, including vehicle location, the audio and video of drivers and passengers and the data can be used to determine illegal driving, should meet corresponding requirements, according to the rules.

The requirements include that the information collection should be for the purpose of providing direct services to drivers and passengers such as enhancing driving safety, assisting driving and navigation; collection of information should be conducted with the driver's consent; and drivers should be allowed to terminate the collection conveniently at any time.

The rules require that biometric data such as fingerprints, voice recording, facial recognition and heart rhythms of drivers can be collected only for the purpose of promoting usability and enhancing the security of vehicles' electronic and information systems.

When handling important data, related business operators must report in advance specific information, including the data type, scale, scope and whether it is giving them to a third party, to provincial network and information authorities.

Personal information and important data must be stored in China. If it is necessary to provide them abroad, they must pass the security assessment organized by the country's Cyberspace Administration.

Where an operator provides personal information or important data abroad, it shall take effective measures to clarify and supervise the recipient's use of the data in accordance with the purpose, scope and method agreed by both parties, so as to ensure the security of the data.