Security Risks and Compliance Recommendations for Cross-Border Flow of Automotive Data

Recently, the Ministry of State Security issued a security alert, pointing out that some foreign enterprises are luring domestic personnel to illegally collect sensitive geographic information data through virtual currency rewards and other means. Such behavior may endanger national security. At the same time, some map projects based on blockchain technology are developing rapidly, such as Hivemapper, which has created a large number of road maps in a short period of time. Although these projects improve map accuracy, they also increase the risk of sensitive information leakage.

This article will take Hivemapper as an example to analyze its operating principles and potential data security risks, and in conjunction with the existing laws and regulations in our country, to provide relevant enterprises with suggestions for data export security Compliance.

The Operating Mechanism of Hivemapper

Hivemapper is a blockchain-based mapping network. Users can collect street view images by installing a dedicated dashcam, and after uploading the data, they can earn HONEY token rewards. This model is similar to "Drive to Earn," encouraging global users to collaboratively build a detailed world map.

Compared to traditional mapping services, Hivemapper has the following advantages:

1. Lower costs - Collect data from everyday drivers.
2. Faster updates - Many contributors, high collection frequency at the same location
3. Higher quality - High collection frequency, obtaining more high-quality images.

Hivemapper incentivizes users to participate through the HONEY token. This token is the only way to obtain map data, thus it has real value.

The data security risks involved in the Hivemapper project

Vertical Risk

The data that projects like Hivemapper may collect during their operation involves security risks on multiple levels:

1. Personal information security aspects: may involve information that directly or indirectly identifies individuals, such as driver identity, vehicle usage behavior, etc.

2. Business Development Level: Data analysis is crucial for companies to understand customer needs and enhance competitiveness, often involving trade secrets.

3. National security aspect: Geospatial information data contains sensitive information, and once leaked, it may threaten national security. Illegal collection and cross-border transmission of such data may violate relevant laws.

Horizontal Risk

The cross-border flow of data involves multiple stages, and the main risks include:

1. Data Collection Phase: Unauthorized collection, unclear classification and grading, unclear identification of sensitive data, etc.

2. Data transmission storage: risks of data damage, tampering, leakage, etc.

3. Data Application Stage: Risks of data abuse, unauthorized access and modification, etc.

Recommendations for Compliance with Automotive Data Export Security

Establish a data classification and grading inventory table

Enterprises should classify and grade automotive data, including:

• Personal Information: General personal information and sensitive personal information
• Important data: data that may affect national security and public interest.
• National core data: Implement stricter management

Set corresponding outbound conditions based on data security levels.

Establish a data export security assessment mechanism

Enterprises should:

• Establish a data export security assessment system
• Establish an evaluation team
• Establish internal self-assessment tools
• Make a good plan for data outbound.

Establish a dynamic risk monitoring mechanism

Enterprises should:

• Establish a self-assessment mechanism for data export risks
• Regularly conduct risk assessments
• Conduct compliance self-examination and rectification in a timely manner
• Pay attention to regulatory dynamics and respond in a timely manner.

In addition, the overseas recipient is required to provide data security protection capabilities and the local legal environment situation to assist in completing the assessment declaration work.