Nearly 70 Car Brands In Australia Could Be Quietly Sending Drivers’ Data To 12 Countries

Australia’s car marketplace is comparatively small, with conscionable 1.24 cardinal vehicles sold crossed 2025, yet it remains extraordinarily competitive, location to astir 70 antithetic brands each warring for their portion of the sales. That benignant of density puts a batch of hardware, and a batch of software, into Australian driveways each year.

But arsenic the nation’s car marketplace has diversified, it appears the authorities has forgotten to support the delicate information that truthful galore caller cars collect. Now, the Australian Electric Vehicle Association (AEVA) is calling for action, noting the state does not person dedicated, vehicle-specific policies for cybersecurity and software-update management, arsenic galore different nations do.

Review: China’s 2026 GAC Aion UT Is A Budget EV That Doesn’t Feel Cheap

New vehicles are much connected than ever, peculiarly EVs, routinely collecting not lone determination information but besides uploading dependable recordings and images from in-car cameras to shaper unreality retention systems, often overseas. Of the astir 70 car brands successful Australia, they travel from conscionable 12 overseas countries, and these nations could beryllium collecting driving information from locals and doing with it arsenic they please.

Australia Needs To Follow Europe

The AEVA is calling connected the Australian authorities to follow a connected-vehicle cybersecurity model akin to Europe. This would necessitate manufacturers to support a certified cybersecurity absorption system, a bundle update absorption system, and “clear lifecycle processes for vulnerability management, incidental effect and unafraid bundle updates.

At present, the lone ineligible model helping support section information is the 1988 Privacy Act’s Australian Privacy Principals, which requires unfastened and transparent handling of idiosyncratic information. This, alongside voluntary standards from the Federal Chamber of Automotive Industries (FCAI), is each that’s used.

What Should Be Done?

The AEVA wants in-car information to beryllium processed successful the conveyance by default and that information collected is stored successful Australia by default. There should besides beryllium strict limits connected overseas information feeds from Australian vehicles to overseas manufacturers, and locals should person the rights to access, delete, and negociate conveyance data.

Even China is doing a amended occupation than Australia. Its 2021 automobile information provisions prioritize in-vehicle processing of information and a default non-collection principle. Important information besides needs to beryllium stored domestically and is taxable to information appraisal earlier it tin beryllium transferred abroad.

“A well-designed Australian authorities tin enactment innovation, alteration harmless software-defined vehicles, and inactive necessitate privacy-protective defaults, section processing, beardown cybersecurity and meaningful idiosyncratic control,” the AEVA noted. “It should besides guarantee that consumers and consumer-authorised 3rd parties are not locked retired of morganatic entree to conveyance data, functions and resources by manufacturer-controlled integer gatekeeping.”