GB/T 41871-2022Information security technology—Security requirements for processing of motor vehicle data (English PDF)

Foreword

This document is drafted in accordance with the rules given in GB/T 1.1-2020, Directives for standardization - Part 1: Rules for the structure and drafting of standardizing documents.

1 Scope

This document specifies the general security requirements, off-vehicle data security requirements, cabin data security requirements and management security requirements for motor vehicle data processors to collect and transmit motor vehicle data.

This document is applicable to motor vehicle data processing activities carried out by motor vehicle data processors, to the design, production, sales, use, operation and maintenance of automobiles, and also to the supervision, management and evaluation of motor vehicle data processing activities by competent regulatory authorities and third-party evaluation agencies.

2 Normative references

The following documents are normatively referenced in this document and are indispensable for its application. For dated references, only the version corresponding to that date is applicable to this document; for undated references, the latest version (including all amendments) is applicable to this document.

GB/T 35273, Information security technology - Personal information security specification

GB/T 40660, Information security technology - General requirements for biometric information protection

3 Terms and definitions

The following terms and definitions are applicable to this document.

4 General security requirements

4.1 The processing of personal information by the motor vehicle data processor shall comply with the following requirements.

4.2 The processing of sensitive personal information by the motor vehicle data processor shall comply with the following requirements.

4.3 Continuous collection of sensitive personal information by motor vehicle data processors shall comply with the following notification requirements.

4.4 The processing of biometric feature information such as face, voiceprint or fingerprint by the motor vehicle data processor shall comply with the following requirements.

4.5 The contact person for user rights affairs set up by the motor vehicle data processor in terms of personal information protection shall meet the following requirements.

4.6 For cabin data, location track data, off-vehicle video and off-vehicle image data, as well as personal information involving more than 100 000 personal information subjects, motor vehicle data processor shall store it within the territory of the People's Republic of China according to law.

4.7 Motor vehicle data processors shall generally perform other processing after completing desensitization processing when processing important data, and shall generally perform other processing after anonymization or de-identification when processing personal information.

5 Off-vehicle data security requirements

The processing of anonymization of off-vehicle data by motor vehicle data processors shall comply with the following requirements. […]

6 Cabin data security requirements

6.1 Unless voluntarily set by the motor vehicle driver, the motor vehicle shall be set to the state of not collecting cabin data by default, including not turning on the camera, microphone, infrared sensor, fingerprint sensor and other components in the motor vehicle.

6.2 The motor vehicle shall not provide cabin data to the outside of the vehicle, except for the following circumstances.

6.3 Motor vehicle data processors shall provide convenient ways to terminate the collection of cabin data, including physical buttons, voice control, touch buttons, and motor vehicle use-related applications, etc. In the case of ensuring driving safety and personal safety, the driver, after choosing to terminate the collection, shall turn off the components that collect cabin data such as the microphone and camera in the motor vehicle.

7 Management security requirements

7.1 Motor vehicle data processors shall carry out motor vehicle data risk assessments.

The assessment content generally includes motor vehicle data identification, data processing activity identification, motor vehicle data security risk identification, risk analysis and evaluation, etc., which can be carried out in the form of self-assessment or third-party assessment.

7.3 Motor vehicle data processors shall establish and improve the emergency response mechanism for security incidents, carry out emergency drills at least once a year, and should support evidence collection analysis after security incidents through mechanisms such as vehicle data storage and vehicle data traceability.

7.4 The motor vehicle data processors shall accept the motor vehicle data security complaints by means of telephone or instant messaging platform, and generally complete the processing within 10 working days after receiving the complaints, and make a complete record of the processing process and processing results.

8 Special cases

Unless necessary, the requirements of this document do not apply to the following data processing activities. […]