The Data Sitting in Your Driveway

Selling a car used to mean cleaning out the glovebox, removing the toll tag and handing over the keys. Increasingly, there is another job on the list: clearing the data.

Connected vehicles are no longer limited to high-end electric cars. If a car can connect to the internet, either through a built-in connection or a paired phone, it's a connected vehicle, and many new petrol, diesel and electric models now come with this as standard.

What your car may be collecting

According to the Australian Signals Directorate’s cyber.gov.au, connected vehicles can collect location and navigation history, driving behaviour, call logs and contacts from paired phones, voice commands, camera images and data on how the car is used. The Privacy Commissioner has warned that many drivers do not realise how much is being collected, used or shared.

Why it makes headlines

In September, ABC’s Four Corners examined the privacy and cyber security risks of connected electric vehicles and showed a specialist remotely accessing some of a vehicle’s systems. BYD then updated its Australian privacy policy, removing references to China and surveillance. BYD says Australian data is stored locally and has not been handed to Chinese authorities, although the ABC noted the updated policy still allows data to be transferred overseas.

The broader question applies to every manufacturer: how much should a car collect, and how much control should drivers have over it? The federal government’s draft Privacy Act reforms, released in August, specifically acknowledge the risks posed by connected vehicles.

What it means for business fleets

Fleet and telematics data can be genuinely useful, but it also adds privacy, cyber and governance risk, along with more accounts and devices to secure. If your business runs connected vehicles, it is worth including them in your cyber security planning and talking to us about how your cyber cover would respond to an incident involving them.

Simple steps for owners

Cyber.gov.au recommends a few basic habits while you own a connected car:

• Read the manufacturer’s privacy and data collection policies

• Switch off connected services and data sharing you do not need

• Use strong, unique passwords and multi-factor authentication on vehicle apps and accounts

• Check regularly who has access through connected apps

Before you sell or trade in the car, remove paired phones, unlink apps and connected-service accounts and restore it to factory settings. Keep in mind that a reset may not remove data already sent to the cloud. If you are buying a used connected car, reset it too and make sure the previous owner no longer has access.

The modern car is still a car, but it is also a connected device. The sensible approach is the one we already take with phones and laptops: know what is being collected, secure the accounts and wipe what you can before it changes hands.

This article is general information only and does not take into account your objectives, financial situation or needs. Please speak with your broker about your specific circumstances.