Toyota and Hyundai under investigation by privacy watchdog

Australia's privacy watchdog is investigating Toyota and Hyundai over how their connected vehicles collect, use and retain customer data, as the Federal Government says it is working to ensure upcoming privacy reforms better protect Australians. Advocacy groups in Australia such as the Australian Electric Vehicle Association (AEVA) has recently started lobbying the government to strengthen data privacy laws for cars that could be spying on owners.

The Office of the Australian Information Commissioner (OAIC) is investigating whether Toyota and Hyundai are collecting, using and managing customer data from connected vehicles in accordance with Australian privacy laws.

The investigation was first revealed by privacy commissioner Carly Kind during Senate estimates earlier this year, when she confirmed two unnamed Asian vehicle brands were under investigation.

The OAIC later identified Toyota and Hyundai in response to questions from Nationals Senator Bridget McKenzie.

According to a report by consumer advocacy group Choice, investigators are examining whether the two manufacturers are collecting more personal information than is necessary for connected vehicle functions.

It’s also looking at whether customer data is being shared with third parties for purposes including marketing without adequate consent, and whether personal information is properly destroyed or de-identified when it is no longer required.

An OAIC spokesperson told Choice the office "aims to complete investigations within 18 months", although the timeframe may vary depending on the complexity of the findings.

The investigation comes as the Federal Government continues work on the next stage of Privacy Act reforms.

A spokesperson for Attorney-General Michelle Rowland told Choice that "Australians want their privacy respected," adding that people handing over personal data "expect it will be protected".

The spokesperson also said the government is working to ensure the next round of privacy law reforms is "workable and in the best interests of Australians", although no timeframe has been provided for when the legislation will be introduced.

Neither Toyota nor Hyundai has commented on the specifics of the investigation.

Hyundai said only that it "takes privacy and data protection seriously", while Toyota referred to its connected services privacy policy, which states customers are provided with "the highest level of transparency, peace of mind and confidentiality".

Toyota previously told carsales that its new operating system that debuted in the new-generation Toyota RAV4 keeps all data within Australia.

The scrutiny follows Choice's 2024 assessment of data privacy practices across 10 automotive brands, which ranked Toyota around the middle of the field, but identified Hyundai as one of the more concerning manufacturers.

The report highlighted Hyundai's sharing of drivers' biometric voice data with a third-party artificial intelligence company.

Industry groups, including the AEVA, have also called for Australia to adopt stronger connected vehicle privacy protections similar to those introduced in overseas markets.

With the OAIC investigation potentially taking up to 18 months to conclude, motorists may have to wait some time before receiving definitive answers about how connected vehicle data is collected and managed.

Likewise, the second tranche of the Federal Government's Privacy Act reforms is yet to be introduced, meaning any strengthened protections for connected vehicle owners are unlikely to arrive in the immediate future.

The news come off the back of lobby groups requesting more transparency and stronger privacy laws around what data cars can collect and how they store it and share it.

Connected cars could even pose a national security risk according to AEVA.

Join the conversation at our Facebook page
Or email us at editor@carsales.com.au