Buying A Car Should Not Mean Surrendering Your Privacy
The Australian Automotive Aftermarket Association (AAAA) is calling on the Federal Government to use its current privacy reforms to protect Australians from the collection and misuse of vehicle data, following disturbing findings aired by ABC’s Four Corners.
AAAA Chief Executive Officer Stuart Charity said the investigation exposed risks requiring urgent privacy, cybersecurity and Right to Repair protections.
“Buying a car should not mean surrendering your privacy,” Mr Charity said.
“Australians should be able to drive to work, take their children to school or have a conversation in their car without wondering who is collecting that information, who can access it and how it might be used.
“The Government is rewriting Australia’s privacy laws now. Connected vehicles must be explicitly addressed in those reforms.”
AAAA lodged its privacy reform submission before the Four Corners broadcast, warning that the draft reforms did not adequately protect people using connected vehicles.
While welcoming stronger general protections, the submission identified major gaps, including no general requirement for affirmative consent to collect vehicle-generated personal information, inadequate safeguards for passengers and secondary drivers, and incomplete rights to delete vehicle data.
“Recognition of connected vehicles as an emerging technology is not protection,” Mr Charity said.
“We need enforceable rules governing what data vehicles collect, why, who receives it and how people can say no. A privacy policy buried in an app does not give every driver and passenger meaningful control. Nor should someone have to accept unnecessary collection of their personal information just to use the ordinary functions of their car.”
Mr Charity said manufacturers must remain accountable for software systems throughout a vehicle’s working life.
“Independent workshops maintain and repair vehicles long after their original sale. As vehicles change hands and software security becomes essential to vehicle safety, manufacturers’ obligations cannot end with the warranty or the owner’s relationship with the original dealer,” he said.
“Australia needs clear requirements for secure updates, timely vulnerability fixes and transparency about how long support will continue, including for vehicles already on our roads.”
AAAA said vehicle ownership must include control over vehicle data and the freedom to choose who repairs the vehicle. As diagnostic and service functions move to manufacturer-controlled remote systems, Australia’s Right to Repair protections must keep pace.
AAAA’s submission calls for a secure pathway allowing consumers to authorise their chosen repairer or automotive data intermediary to access information needed for diagnosis, maintenance and repair. Access should be limited to the required work, recorded and able to be withdrawn.
“Privacy, cybersecurity and Right to Repair must be designed together,” Mr Charity said.
“Consumers should not be told privacy prevents their trusted workshop from accessing information while a manufacturer’s dealer network can use it. The consumer’s authorisation should count.”
Privacy protections must follow the vehicle when ownership changes, including resets that remove previous owners’ accounts and personal information. They must also cover everyone who uses the vehicle, including passengers, employees, borrowers, renters and subsequent owners.
Information collected for vehicle operation or repair should not become a blank cheque for profiling, marketing, insurance or other decisions affecting consumers, Mr Charity said.
AAAA is calling for enforceable connected-vehicle privacy rules; genuine consent and accessible controls over non-essential data collection; control over data and its disclosure, including access and deletion rights; restrictions on secondary use; mandatory cybersecurity and software updates; and secure access for consumers’ chosen repairers.
Mr Charity said these protections should apply to every connected vehicle sold in Australia, regardless of its country of origin or powertrain.
“The principle is straightforward: consumers should control who accesses their information, manufacturers should be accountable for protecting it, and owners should retain the right to choose who maintains and repairs their vehicle,” Mr Charity said.
“The Government has the reform process in front of it. It should use it to deliver enforceable protections that last as long as the vehicles Australians drive.”