The original privacy policy, which was in place when Four Corners began its inquiries, gave BYD broad discretion to collect data from its vehicles, including through 'surveillance activities' in connection with 'suspected illegal or improper activities'. It also named China as one of 16 countries where Australians' data could be sent.
When Four Corners asked about the policy, BYD responded two days later saying it had 'undergone a review and been updated'. The new policy was uploaded to BYD's Australian website just 76 minutes before the company sent it to the program. All mentions of China and surveillance were removed.
However, UNSW privacy law expert Katharine Kemp described the original policy as containing 'highly concerning indications about the potential data practices of the company'. She said the new version still allows data to be transferred overseas, including to China, as long as BYD complies with applicable data protection laws.
'So many privacy policies that don't provide good privacy protections start with exactly those words, and I would never pay any attention to them,' Kemp said of the policy's opening statement that BYD respects customer privacy. 'It's privacy fluff. It's nothing.'
BYD told Four Corners it had not and would not transfer any data of Australians to Chinese authorities. However, China's national security laws obligate companies to cooperate with authorities if requested.
The Australian Privacy Act does permit data to be transferred to China. Both the old and new policies state that data collected from Australian vehicles is stored in Australia.
Kemp noted that she could not recall reading a connected car privacy policy that 'consistently meets requirements of fairness and reasonableness'. The Office of the Australian Information Commissioner has been making inquiries.