为进一步规范浙江省汽车数据处理活动，促进汽车数据合理开发利用和汽车行业健康有序发展，省委网信办、省发展改革委、省经信厅、省公安厅、省交通运输厅联合印发《浙江省汽车数据处理管理规定》，现予以公布。
浙江省汽车数据处理管理规定
第一条 为了规范省内汽车数据处理活动，保护个人、组织的合法权益，维护国家安全和社会公共利益，促进汽车数据合理开发利用，根据《中华人民共和国网络安全法》《中华人民共和国数据安全法》《中华人民共和国个人信息保护法》《汽车数据安全管理若干规定（试行）》等法律法规和国家有关规定，结合本省实际情况，制定本规定。
第二条 在本省行政区域内开展汽车数据处理活动，应当遵守本规定。
第三条 本规定所称汽车数据，包括汽车设计、生产、销售、使用、运维等过程中涉及的个人信息和重要数据。
汽车数据处理，包括汽车数据的收集、存储、使用、加工、传输、提供、公开等。
汽车数据处理者，是指开展汽车数据处理活动的组织，包括汽车制造商、零部件和软件供应商、经销商、维修机构以及出行服务企业等。
个人信息，是指以电子或者其他方式记录的与已识别或者可识别的车主、驾驶人、乘车人、车外人员等有关的各种信息，不包括匿名化处理后的信息。
敏感个人信息，是指一旦泄露或者非法使用，可能导致车主、驾驶人、乘车人、车外人员等受到歧视或者人身、财产安全受到严重危害的个人信息，包括车辆行踪轨迹、音频、视频、图像和生物识别特征等信息。
重要数据是指一旦遭到篡改、破坏、泄露或者非法获取、非法利用，可能危害国家安全、公共利益或者个人、组织合法权益的数据，包括：
（一）军事管理区、国防科工单位以及县级以上党政机关等重要敏感区域的地理信息、人员流量、车辆流量等数据；
（二）车辆流量、物流等反映经济运行情况的数据；
（三）汽车充电网的运行数据；
（四）包含人脸信息、车牌信息等的车外视频、图像数据；
（五）涉及个人信息主体超过10万人的个人信息；
（六）国家网信部门和国务院发展改革、工业和信息化、公安、交通运输等有关部门确定的其他可能危害国家安全、公共利益或者个人、组织合法权益的数据。
座舱数据，是指通过摄像头、红外传感器、指纹传感器或传声器等部件从汽车座舱采集的可能包含个人信息的数据，以及对其进行加工后产生的数据。
个人信息主体，是指个人信息所标识或者关联的自然人。
匿名化，是指通过对个人信息的技术处理，使得个人信息主体无法被识别或者关联，且处理后的信息不能被复原的过程。
去标识化，是指通过对个人信息的技术处理，使其在不借助额外信息的情况下，无法识别或者关联个人信息主体的过程。
第四条 汽车数据处理必须具有明确、合理的目的，处理的汽车数据类型应与实现产品或服务的业务功能直接关联，同时应遵守对重要数据处理的相关规定。
直接关联指的是没有上述汽车数据的参与，产品或服务的功能无法实现。
第五条 汽车数据处理者处理个人信息前，应通过用户手册、车载显示面板、语音、汽车使用相关应用程序等显著方式，告知处理个人信息的具体情境和必要性、各类个人信息的保存期限、精确到设区市的保存地点、用户权益事务联系人的姓名和联系方式等事项。
除法律法规另有规定外，汽车数据处理者处理个人信息前，应获得个人信息主体的授权同意，并向个人信息主体提供查阅、复制、删除等个人信息管理的方式和途径。
第六条 汽车数据处理者处理敏感个人信息，对每项敏感个人信息应取得个人信息主体单独同意，且不得一次性针对多项敏感个人信息取得同意，个人信息主体可自主选择同意期限。
汽车数据处理者收到敏感个人信息删除的请求，应当在十个工作日内删除。
第七条 汽车数据处理者通过车辆收集的车外视频、图像数据，如需向车外提供，应在车内对数据中的人脸、车牌等信息进行匿名化处理。
除法律法规另有规定和下列情况外，未经个人信息主体单独同意，汽车不得向车外传输包含个人信息的数据。
（一）道路运输车辆依据相关规定向所属运输企业监控平台、公共管理平台和监管机构传输数据。
（二）出租汽车、公共汽车和教练车辆等营运车辆向监管机构传输数据。
（三）道路交通事故发生后按执法部门要求传输数据。数字化转型网www.szhzxw.cn
第八条 除非个人信息主体主动选择，汽车应默认设定为不收集座舱数据的状态，包括不打开车内的摄像头、传声器、红外传感器和指纹传感器等部件。
为保证行车安全及人身安全，正在提供公路营运服务的道路运输车辆，以及提供出行服务的公共汽车，可不关闭传声器、摄像头等收集座舱数据的部件。
第九条 汽车数据处理者持续收集敏感个人信息，应通过车载显示面板图标或信号装置指示灯的闪烁或长亮等方式提示收集状态。
个人信息主体要求终止收集敏感个人信息的，汽车数据处理者应提供实体按键、语音控制、虚拟按键等多种方式，确保收集终止。
第十条 汽车数据处理者不得存储原始个人生物识别信息，使用个人生物识别特征信息完成身份识别、认证等功能后，应以不可逆方式删除可提取个人生物识别信息的原始图像。
第十一条 汽车数据处理者停止运营其产品或服务时，应通知个人信息主体，并及时停止继续收集个人信息，对其所持有的个人信息进行销毁或匿名化处理。
第十二条 汽车数据处理者进行商业营销推送，应取得个人信息主体授权同意，并提供拒绝接收商业营销推送的便捷方式。
第十三条 汽车数据处理者接入具备收集个人信息功能的第三方产品或服务时，应核验其实现方式，落实数据安全管理责任。
第十四条 汽车数据处理者未取得个人信息主体单独同意之前，不得公开其处理的个人信息和敏感个人信息。
除非个人信息主体拒绝，汽车数据处理者可以在合理的范围内处理已公开的个人信息。
第十五条 涉及显示屏幕、纸面等界面展示个人信息的，汽车数据处理者应对需展示的个人信息采取去标识化处理等措施。
第十六条 汽车数据处理者设置个人信息保护方面的用户权益事务联系人，应对外告知联系人准确有效的姓名和联系方式，联系方式包括电话号码、邮箱地址、网址或即时通信平台账号等。
第十七条 汽车数据处理者因合并、分立、解散、被宣告破产等原因，需要转移个人信息，应向个人信息主体告知接收方的名称或者姓名和联系方式。
接收方变更原先的处理目的、处理方式的，应当重新取得个人信息主体同意。数字化转型网www.szhzxw.cn
第十八条 汽车数据处理者向境外提供汽车数据，应根据《数据出境安全评估办法》通过省网信部门向国家网信部门申报数据出境安全评估。
第十九条 汽车数据处理者不得公开披露个人生物识别特征信息，以及我国公民的种族、民族、政治观点、宗教信仰等敏感个人信息的分析结果。
第二十条 汽车数据处理者处置个人信息安全事件，个人信息泄露事件可能会给个人信息主体的合法权益造成严重危害的，应及时将事件相关情况以邮件、信函、电话、推送通知等方式告知受影响的个人信息主体。
第二十一条 汽车数据处理者应制定数据安全事件应急预案，并每年至少组织一次内部人员的应急响应培训和应急演练，内容包括记录事件内容、采取控制措施、上报事件情况等。
第二十二条 汽车数据处理者开展数据处理活动，应与行业组织、教育和科研机构、有关专业机构等在数据安全风险评估、防范、处置等方面开展协作，组织数据安全教育培训，落实数据安全管理责任。
第二十三条 汽车数据处理者开展重要数据处理活动，应当按照规定开展风险评估，并向省网信部门和有关部门报送风险评估报告。
风险评估报告应当包括处理的重要数据的种类、目的、数量、范围、保存地点与期限、使用方式，开展数据处理活动情况以及是否向第三方提供，面临的数据安全风险及其应对措施等。
第二十四条 开展重要数据处理活动的汽车数据处理者，应当在每年十二月十五日前向省网信部门和有关部门报送年度汽车数据安全管理情况。
第二十五条 汽车数据处理者违反本规定的，由省级网信、经信、公安、交通运输等有关部门依照《中华人民共和国网络安全法》《中华人民共和国数据安全法》《中华人民共和国个人信息保护法》等法律、行政法规的规定进行处罚；构成犯罪的，依法追究刑事责任。
第二十六条 本规定自2023年11月1日起施行。
数字化转型网www.szhzxw.cn
英文翻译：
In order to further standardize the automobile data processing activities in Zhejiang Province, promote the rational development and utilization of automobile data and the healthy and orderly development of the automobile industry, the Provincial Network Information Office, the Provincial Development and Reform Commission, the Provincial Economy and Information Department, the Provincial Public Security Department, and the Provincial Transportation Department jointly issued the “Regulations on the Management of Automobile Data Processing in Zhejiang Province”, which are hereby published.
Zhejiang Province automobile data processing management provisions
Article 1 In order to regulate automobile data processing activities in the province, protect the legitimate rights and interests of individuals and organizations, safeguard national security and social and public interests, and promote the rational development and utilization of automobile data, These Provisions are formulated in accordance with the “People’s Republic of China Network Security Law”, “People’s Republic of China Data Security Law”, “People’s Republic of China Personal Information Protection Law”, “Several Provisions on Automobile Data Security Management (Trial implementation)” and other laws and regulations and relevant national provisions, combined with the actual situation of this province.
Article 2 The automobile data processing activities carried out within the administrative area of this province shall comply with these provisions.
Article 3 The term “automobile data” as used in these Provisions includes personal information and important data involved in the process of automobile design, production, sales, use, operation and maintenance.
Automobile data processing, including automobile data collection, storage, use, processing, transmission, provision, disclosure, etc.
Automobile data processors refer to organizations that carry out automobile data processing activities, including automobile manufacturers, parts. And software suppliers, dealers, maintenance agencies, and travel service enterprises.
Personal information refers to all kinds of information recorded electronically or by other means relating to identified or identifiable car owners, drivers, passengers, persons outside the car, etc.. Excluding information after anonymization.数字化转型网www.szhzxw.cn
Sensitive personal information refers to personal information that, once leaked or illegally used, may cause owners, drivers, passengers, people outside the vehicle, etc., to be discriminated against or seriously endanger personal and property safety, including vehicle whereabouts and tracks, audio, video, images, biometric characteristics and other information.
Important data refers to data that, once tampered with, destroyed, leaked or illegally obtained or illegally used, may endanger national security, public interests or the legitimate rights and interests of individuals and organizations, including:
(1) Geographical information, personnel flow, vehicle flow. And other data of important sensitive areas such as military administrative areas, national defense scientific. And industrial units, and party and government organs at or above the county level;
(2) Vehicle flow, logistics and other data reflecting economic operation;
(3) Operation data of the vehicle charging network;
(4) video and image data outside the vehicle, including face information and license plate information;
(5) Personal information involving more than 100,000 personal information subjects;
(6) Other data that may endanger national security, public interests or the legitimate rights and interests of individuals and organizations as determined by the national cyberspace administration and the relevant departments of development and reform, industry and information technology, public security and transportation under The State Council.
Cockpit data refers to data that may contain personal information collected from the cockpit of a car through components such as cameras, infrared sensors, fingerprint sensors or microphones. And data generated after processing it.
Personal information subject refers to the natural person identified or associated with personal information.
Anonymization refers to the process of technical processing of personal information so that the subject of personal information cannot be identified or associated. And the processed information cannot be recovered.
De-identification refers to the process of technical processing of personal information . So that it cannot identify or associate with the subject of personal information without the help of additional information.
Article 4 Automobile data processing must have a clear and reasonable purpose, the type of automobile data processed should be directly related to the realization of the business function of the product or service, and should comply with the relevant regulations on the processing of important data.
Direct correlation refers to the fact that the functionality of the product or service cannot be realized without the participation of the aforementioned vehicle data.
Article 5 Before processing personal information, the automobile data processor shall inform the specific situation and necessity of processing personal information, the storage period of various types of personal information, the storage location accurate to the district city, the name and contact information of the user’s rights and interests contact person, and other matters through the user manual, the vehicle display panel, voice, car-use related applications, and other prominent ways.
Unless otherwise provided for by laws and regulations, the automobile data processor shall obtain the authorization. And consent of the personal data subject before processing personal information. And provide the personal data subject with ways and means to manage personal information such as access, copy and deletion.
Article 6 When processing sensitive personal information. The automobile data processor shall obtain the individual consent of the personal data subject for each sensitive personal information. And shall not obtain the consent for multiple sensitive personal information at one time . And the personal data subject may independently choose the consent period.
The car data processor shall delete sensitive personal information within ten working days after receiving a request to delete it.
Article 7 The automobile data processor collects the video and image data outside the vehicle through the vehicle. If it needs to be provided outside the car, the face, license plate and other information in the data should be anonymized in the car.数字化转型网www.szhzxw.cn
Except as otherwise provided by laws and regulations and in the following cases, without the individual consent of the personal data subject, the car shall not transmit data containing personal information outside the car.
(A) road transport vehicles in accordance with the relevant regulations to the transport enterprise monitoring platform, public management platform and regulatory agencies to transmit data.
(b) The transmission of data by operational vehicles such as taxis, buses and coach vehicles to regulatory authorities.
(3) Transmission of data as required by law enforcement departments after a road traffic accident.
Article 8 Unless the personal data subject actively chooses, the car shall be configured by default to not collect cockpit data, including not turning on the camera, microphone, infrared sensor and fingerprint sensor components in the car.
In order to ensure driving safety and personal safety, road transport vehicles that are providing road operation services. And buses that provide travel services may not turn off components that collect cockpit data such as microphones and cameras.数字化转型网www.szhzxw.cn
Article 9 If the vehicle data processor continues to collect sensitive personal information. It shall indicate the collection status by the icon of the vehicle display panel or the indicator light of the signal device.
If the personal data subject requests the termination of the collection of sensitive personal information, the vehicle data processor shall provide physical keys, voice control, virtual keys and other means to ensure the termination of the collection.
Article 10 The automobile data processor shall not store the original personal biometric information, and after using the personal biometric characteristic information to complete identity identification, authentication and other functions, the original image that can extract the personal biometric information shall be deleted in an irreversible manner.
Article 11 When an automobile data processor stops operating its products or services. It shall notify the personal data subject, stop collecting personal information in a timely manner. And destroy or anonymize the personal information it holds.
Article 12 The automobile data processor shall obtain the authorization. And consent of the personal data subject for commercial marketing push . And provide a convenient way to refuse to receive commercial marketing push.
Article 13 When an automobile data processor accesses a third-party product or service with the function of collecting personal information, it shall verify its implementation method and implement the responsibility of data security management.
Article 14 A motor vehicle data processor shall not disclose the personal information and sensitive personal information it processes without the individual consent of the personal data subject.
Unless the personal data subject refuses, the automobile data processor may process the disclosed personal information within a reasonable scope.
Article 15 Where personal information is displayed on display screens, paper and other interfaces, the automobile data processor shall take measures such as de-identification processing of the personal information to be displayed.
16th automobile data processors set up personal information protection of user rights and interests affairs contacts, should inform the contact accurate and effective name and contact information, including telephone number, email address, website or instant messaging platform account.
Article 17 If an automobile data processor needs to transfer personal information due to merger, division, dissolution, or bankruptcy, it shall inform the personal data subject of the recipient’s name or name and contact information.
If the receiving party changes the original purpose or method of processing, it shall obtain the consent of the personal data subject again.
18th automobile data processors to provide overseas automobile data, should be in accordance with the “data exit safety assessment Measures” through the provincial network information department to the national network information department data exit safety assessment.
Article 19 Automobile data processors shall not publicly disclose personal biometric characteristics information and the analysis results of sensitive personal information such as race, ethnicity, political views and religious beliefs of Chinese citizens.
20th automobile data processing personal information security incident, personal information disclosure incident may cause serious harm to the legitimate rights and interests of personal information subject, should promptly inform the relevant situation of the incident by mail, letter, telephone, push notification and other means of the affected personal information subject.
Article 21 An automobile data processor shall formulate an emergency plan for data security incidents, and organize at least one emergency response training and emergency drill for internal personnel every year, including recording incident content, taking control measures, reporting the incident, etc.
22nd automobile data processors to carry out data processing activities, should cooperate with industry organizations, educational and scientific research institutions, relevant professional institutions in data security risk assessment, prevention, disposal, etc., organize data security education and training, and implement data security management responsibilities.
Article 23 Automobile data processors to carry out important data processing activities, shall carry out risk assessment in accordance with the provisions, and submit the risk assessment report to the provincial network information department and relevant departments.
The risk assessment report shall include the type, purpose, quantity, scope, storage location and duration of the important data to be processed, the way of use, the data processing activities carried out, whether the data is provided to third parties, the data security risks faced and the countermeasures.
Article 24 The automobile data processors who carry out important data processing activities shall submit the annual automobile data safety management situation to the provincial network information department and relevant departments before December 15 of each year.数字化转型网www.szhzxw.cn
25th automobile data processors in violation of these provisions, by the provincial network information, economic information, public security, transportation and other relevant departments in accordance with the “People’s Republic of China Network Security Law”, “People’s Republic of China Data Security Law”, “People’s Republic of China Personal Information Protection Law” and other laws and administrative regulations to punish; If the case constitutes a crime, criminal responsibility shall be investigated according to law.
Article 26 These provisions shall come into force as of November 1, 2023.
本文由数字化转型网（www.szhzxw.cn）转载而成，来源于国脉数据资产；编辑/翻译：数字化转型网小汤圆。
免责声明: 本网站(http://www.szhzxw.cn/)内容主要来自原创、合作媒体供稿和第三方投稿，凡在本网站出现的信息，均仅供参考。本网站将尽力确保所提供信息的准确性及可靠性，但不保证有关资料的准确性及可靠性，读者在使用前请进一步核实，并对任何自主决定的行为负责。本网站对有关资料所引致的错误、不确或遗漏，概不负任何法律责任。
本网站刊载的所有内容(包括但不仅限文字、图片、LOGO、音频、视频、软件、程序等) 版权归原作者所有。任何单位或个人认为本网站中的内容可能涉嫌侵犯其知识产权或存在不实内容时，请及时通知本站，予以删除。
