'Urgent' calls for greater transparency on data collection following report on Chinese car hacking

The peak body for new-car dealers in Australia is calling for car companies to work together with the Australian Government to address concerns over how new 'connected' vehicles collect and store data.

The CEO of the Australian Automotive Dealer Association (AADA), James Voortman, said new-car dealers are increasingly facing questions from customers about what information new vehicles collect and what functions or information can be accessed remotely – and what safeguards are in place to keep vehicles secure.

"Australian car buyers are asking legitimate questions about connected vehicle technologies and deserve clear answers,” said Mr Voortman in a press release, calling for greater collaboration between automakers, regulators, security agencies and other stakeholders.

"Those questions are not limited to privacy and data collection. Customers also want to understand how these technologies operate, what protections are in place and how manufacturers and regulators are managing potential cybersecurity and safety risks.

"We need an urgent debate on this issue informed by the facts, so that as an industry we can provide car buyers with confidence. We also need a thorough understanding of what the future regulatory landscape looks like.

"Manufacturers are responsible for the technologies they introduce to the Australian market, while government agencies and regulators play a critical role in ensuring appropriate oversight and public confidence.

"If Australians are expected to embrace increasingly connected vehicles, there must also be a coordinated effort to ensure clear and accessible information is available to both industry and the public."

It follows a report from the ABC’s Four Corners program, which exposed the vulnerabilities of modern connected vehicles – making an example out of BYD and Xpeng, given the rise of not only these brands but Chinese vehicles in general on the Australian market.

“An electric vehicle made by a company headquartered in China is subject to the laws of China, and particularly the national security laws, which oblige them to assist China's intelligence agencies,” Shadow Minister for Defence James Paterson told Four Corners.

“So, a connected EV vehicle from China is the highest-risk product in the marketplace, and right now there's nothing that says to that brand what data you can collect on Australians, how it can be stored, when it can be transmitted.”

An Xpeng insider demonstrated to the program that the company can remotely access the vehicle’s location, speed, steering wheel angle, seat position, passenger occupancy, and whether the vehicle is braking or accelerating.

However, the company confirmed to the ABC that it can’t remotely immobilise or disable a customer’s vehicle in Australia, and there’s no capability for this to be done from China or by any third party. It also confirmed it has never provided Australian customer data to Chinese authorities.

When asked whether he was happy with the Chinese brand having information on his comings and goings, Xpeng G6 owner and federal energy minister Chris Bowen said: “Car manufacturers do have access to those sorts of information increasingly because every car now is basically connected.

“Every new car, whether it's an electric car, it's made in China, Korea, the United States, they're connected to the grid,” added Mr Bowen.

This connectivity allows vehicles to receive over-the-air software updates that can affect battery management systems, steering and lights, among other vehicle functions – and this isn’t exclusive to Chinese EVs.

Elsewhere in the program, cyber security expert Dan Hreszczuk tapped into the CAN bus of a BYD Shark 6 and spent two weeks hacking the plug-in hybrid (PHEV) ute, demonstrating to Four Corners how he could remotely access the vehicle while it was being driven and eavesdrop on phone calls, track its location, and even turn off its headlights.

Until a recent update to its privacy policy – which the ABC says was made within hours of the company responding to its questions – BYD’s fine print said: “We may collect, hold, use and disclose your information for the following purposes: through surveillance activities undertaken to assist in the protection of people, property and company assets and resources (including ICT assets), information which may also be used to gather operational data, in connection with suspected illegal or improper activities and as part of disciplinary investigations.”

The privacy policy on BYD’s website was subsequently replaced with a more limited one covering only customer data transmitted via the BYD website, and not via the vehicles themselves.

“As a global EV company we, first of all, respect all the policies and rules in every country,” BYD Asia Pacific managing director Liu Xueliang told Australian media, including CarExpert, at the Melbourne motor show in April.

“Before we entered the Australian market, we've been constantly communicating with different government divisions and to discuss about the compliance and the rules. In the car, you know, improve car approval, and all these things. So, to make sure that we respect the rules and compliance requirements here.

“We always believe that we, in terms of the storage of data and the server, we only use it locally, that information.

“So, as an enterprise, a business-style party in the society, by all means we respect and stick to the rule in the local country."

The company also confirmed all data is stored in Australia on Telstra servers.

BYD told Four Corners this month it had “formally responded to preliminary inquiries” from the Office of the Australian Information Commissioner (OAIC), which confirmed in August that Privacy Commissioner Carly Kind was investigating two automakers over potential breaches of Australia’s privacy laws.

Toyota and Hyundai are being investigated over how they collect, use and obtain consent for customers’ personal data.

The Australian Government last month released draft legislation to update the Privacy Act, and is seeking feedback on proposed measures to address privacy issues arising from – among other things – connected vehicles.

BYD told Four Corners it would welcome new laws that take into account connected cars.

"At the moment the industry is applying elements of the Australian Privacy Act from 1988, together with other regulations that almost certainly did not foresee a scenario with connected vehicles almost 40 years on," the company said.

Leapmotor was another Chinese brand featured by Four Corners, specifically for its use of cameras from Dahua.

This firm’s cameras were banned from federal government buildings in 2023, following similar bans in the US and UK over spyware fears.

Senator Paterson has said Dahua has been directly implicated in human rights abuses and mass surveillance of Uyghur people in China.

"It's extraordinary to me that we've ripped out [many] Dahua cameras from defence bases… but we've allowed that same technology in a connected vehicle to drive around those bases with all their cameras, all their sensors, all their data collection,” Senator Paterson, the former chair of the parliamentary committee on security and intelligence, told the ABC.

Leapmotor didn’t respond to questions from Four Corners.

Connected vehicles have come under heightened scrutiny in recent years.

Tesla vehicles have been banned from various government and military facilities in China, while Chinese vehicles have in turn been banned from military facilities in countries such as the UK, Israel and Poland.

The US Government cited national security concerns in blocking Chinese connected vehicle technology, and banned the further sale of new Polestar vehicles under its Connected Vehicle Rule earlier this year.

American automaker General Motors was also accused in 2024 of gathering customers' driving data and selling it on without their consent, and earlier this year it was banned by the US Federal Trade Commission from supplying geolocation and driver behaviour data to consumer reporting organisations for five years.

MORE: Toyota and Hyundai under investigation over connected-car data privacy