May 13, 2021 08:10 AM

Automakers Face New Limits on Collecting User Data

China’s new draft rules stipulate that important data and personal information collected from vehicles should be stored within China.
China’s new draft rules stipulate that important data and personal information collected from vehicles should be stored within China.

Automakers in China need to seek customer approval before collecting data on driving, and personal information and important data should not be collected unless absolutely necessary, according to draft rules issued Wednesday by the Office of the Central Cyberspace Affairs Commission.

Tesla Inc.’s controversial handling of auto data related to crashes generated considerable debate on who owns the data after a Tesla owner staged a dramatic protest last month at the Shanghai auto show. The protestor, whose father was involved in a February Tesla crash, climbed atop a Tesla car at the auto show, shouting “Tesla brakes fail.”

Tesla originally rejected the vehicle owner's request for access to the vehicle’s data but then disclosed it under pressure from regulators. On Chinese social media platform Weibo, Tesla said Wednesday that it supports the auto industry's further regulated development and will work together to promote tech innovation.

In addition to automakers, the rules apply to other vehicle data operators, including software suppliers, car dealers, auto repair shops, ride-hailing platforms and insurance companies.

Protected personal data includes information concerning car owners, drivers, passengers and pedestrians. Important information involves traffic data from sensitive zones such as military administrative areas, high-resolution mapping data, operating data from the vehicle charging network, data about vehicle models and road traffic, and audio and video data collected outside vehicles that display human faces, voices and license plates.

Under the draft rules, operators need to inform drivers through display panels or user manuals about the types of data, purposes and places where data is collected and how long the data is stored. User authorization on data collection will automatically expire after each driving trip. Operators must delete the data within two weeks if drivers request them to do so.

Car data collectors should process personal information and important data inside the vehicle. When providing information outside the vehicle if necessary, anonymization and desensitization should be carried out as far as possible, according to the rules.

The draft rules also stipulate that important data and personal information should be stored in China, and if it is necessary to provide such data abroad, it needs to undergo a security evaluation by the Cyberspace Administration of China.

Operators that handle personal information involving more than 100,000 individuals or important data shall also submit annual data security management information to authorities every year.

Contact reporter Denise Jia ( and editor Bob Simison (

Download our app to receive breaking news alerts and read the news on the go.

Get our weekly free Must-Read newsletter.

You've accessed an article available only to subscribers
Share this article
Open WeChat and scan the QR code
Get our CX Daily, weekly Must-Read and China Green Bulletin newsletters delivered free to your inbox, bringing you China's top headlines.

We ‘ve added you to our subscriber list.

Manage subscription
China Stories: How a Rich Child Rapist Bribed His Way Off Death Row