On October 16, China's Ministry of State Security highlighted a case where a foreign company, in collaboration with a Chinese company, conducted illegal surveying and mapping within the territory of China under the guise of autonomous driving research. The mapping data which contains geographic information of specific areas, later identified as state secrets, was transferred overseas, raising significant concerns within the automobile industry. Major Chinese and international automobile companies have denied involvement.
The key issue is that unauthorized processing of mapping data may be considered to pose national security risks. Mapping data can contain sensitive information related to national security, such as high-precision measurements of military sites. In China, to legally conduct mapping activities, entities must: (i) obtain the necessary certificate when processing mapping data, (ii) obtain necessary approval before transferring mapping data overseas; and (iii) adhere to strict confidentiality and security protocols.
In recent years, China has intensified efforts to regulate illegal surveying and mapping activities, especially in the automobile industry. For example, in 2024, the Ministry of Natural Resources released many regulations, such as Strengthening the surveying, mapping and geoinformation security relating to intelligent connected vehicles (July 2024) and Security requirements for processing spatiotemporal data in intelligent connected vehicles (Draft, June 2024).
In light of the above, companies in the automobile industry should take immediate action to ensure compliance and protect national security.
- Conduct internal compliance assessments: Determine if operations involve mapping activities or data processing and identify if the data constitutes state secrets.
- Implement effective measures: If involved in mapping activities, ensure compliance by partnering with qualified companies, meeting security requirements, and obtaining necessary approvals.
- Improve internal compliance systems: Incorporate mapping-related compliance into the overall system, such as conducting data classification and grading, enhancing data security measures, and providing internal training to minimize risks.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
