Two of Australia’s biggest car brands, Toyota and Hyundai, are under official investigation by the Office of the Australian Information Commissioner (OAIC) for potential breaches of the Privacy Act in their smart connected vehicles.
The revelations came after Nationals Senator Bridget McKenzie grilled OAIC in Senate estimate hearings earlier this year about privacy concerns relating to Chinese-made cars in Australia.
At the time, Privacy Commissioner Carly Kind revealed that two car companies were under investigation, however she declined to name the companies or the country they were from, saying only that they were from “Asia”.
In April, responding to formal Questions on Notice from the Senator, OAIC quietly revealed Toyota and Hyundai, Japanese and South Korean-based companies respectively, were the ones being investigated.
CHOICE understands there are three key pillars to the OAIC probe into the two car companies. The first line of enquiry is whether the personal data that is being collected is beyond what is required for the functions of the vehicle and the consent around that data’s collection.
The second line of interrogation is whether manufacturers are disclosing personal information for secondary purposes without consent (this could include sales and marketing purposes).
And finally, the probe will explore whether the car companies are taking reasonable steps to destroy or de-identify personal information they no longer need.
The first line of enquiry is whether the personal data that is being collected is beyond what is required for the functions of the vehicle
An OAIC spokesperson says they anticipate the findings would have broader implications for the Australian community beyond the practices of these two companies.
“The OAIC aims to complete investigations within 18 months, however this can and does change based on the findings and the nature of the investigation,” a spokesperson says.
In ranking the car manufacturers on their data privacy policies and sharing practices at the time, we found Hyundai among the most concerning companies, collecting and sharing driver’s biometric voice data with a third-party AI company. Toyota sat in the middle of the 10 car brands we analysed, with some concerning data practices such as sharing driver data – including braking patterns and speeds – with third-parties.
Toyota says they won’t comment while OAIC’s investigation is ongoing.
Hyundai also says they do not comment on investigations or ongoing regulatory matters.
“Hyundai takes privacy and data protection seriously,” the spokesperson says.
Smart connected cars come with big privacy concerns.
EVs electrifying concerns
Melbourne couple Gary and Sandy Buck swear by their two electric vehicles, a Korean-made Kia and Chinese-made Zeekr and say they can’t imagine ever going back to petrol cars.
“We bought our first EV over four years ago. We’ve put 70,000kms on it, it’s been so much better and easier than we could have even imagined,” Gary says.
But Gary, who used to work in cybersecurity, acknowledges that when it comes to personal data privacy, driving a new car comes with tradeoffs.
“It’s not about petrol or electric, it’s about new cars. I don’t think enough people are aware of the concerns and the tradeoffs. It’s important to be aware of it and to think about what you are giving away to have that extra functionality,” he says, before adding that it’s nice that he can get the car seat warm before he even comes to the garage.
Doesn’t matter if it’s a Korean car or a Chinese car or a European car, if you have good guardrails, then they apply to everyone.
EV owner, Gary Buck
Gary says people often ask him if he is concerned about owning a Chinese vehicle, but says the concerns for data privacy are not country-specific.
“Doesn’t matter if it’s a Korean car or a Chinese car or a European car, if you have good guardrails, then they apply to everyone. There is this bloke in America named Elon Musk who I wouldn’t exactly trust much more than anyone else,” he says.
Gary and Sandy Buck own a Korean-made Kia and a Chinese-made Zeekr.
Reforms long overdue
Johannes Lehmann from the Australian Electric Vehicles Association, which represents car owners, is calling on the government to adopt a regulatory framework similar to what is in place in the European Union, saying complying with the regulations of a larger international market should be relatively easy for global car companies.
“Australia is a small market. It makes sense to go with a good regulatory regime that already works for one of the biggest high-income markets, which is the European Union.”
He adds that it’s important the conversations moves away from the country of origin of the car company and towards what tailored and relevant guardrails can be applied across the industry.
Australians bought over 32,000 EVs in June, representing more than 23% of all new car sales.
Drivers of connected cars of all kinds should be able to easily turn the tracking features of the vehicle on and off
Vanessa Teague, CEO of Thinking Cybersecurity, says while people may be more aware of privacy concerns when it comes to electric cars, the issues are really the same as with new petrol vehicles.
She says drivers of connected cars of all kinds should be able to easily turn the tracking features of the vehicle on and off with the push of a button, but adds that car makers are intentionally not making it easy to do so.
“I don’t believe it is that hard to engineer. It’s deliberately not built into vehicles so that car companies can grab data to train their AI and do targeted advertising and all the other ways they monetise your data. Your driving data is tremendously valuable to the car company and they don’t want to lose that,” she says.
In 2024 the government passed the first tranche of reforms to the long-outdated Privacy Act.
It also promised to go further with the so-called “tranche two” reforms. Advocates have long called for the introduction of a “fair and reasonable use” test to govern data collection and usage, something that was left out in the first round of reforms. The government hasn’t indicated if this will be included.
The Attorney-General’s Department, who are responsible for the legislation, told CHOICE the new reforms were “now progressing”.
“Australians want their privacy respected. When Australians are asked to hand over their personal data, they expect it will be protected,” a spokesperson for Attorney-General Michelle Rowland says.
“The government continues to work carefully to ensure these reforms are workable and in the best interests of Australians.”
They did not specifically comment on a timeframe for the reforms.
Get the inside story on our investigations, campaigns and the difference they make.
Jarni Blakkarly is an award-winning Senior Investigative Journalist at CHOICE. Jarni has worked for news organisations such as SBS, Reuters, Al Jazeera English, ABC 730, Radio National, BBC World Service and Deutsche Welle.
Jarni won the Walkley Foundation's young journalist of the year student category award in 2016 and was the recipient of a Melbourne Press Club Michael Gordon fellowship in 2022. In 2023 he was a highly commended finalist in the Quill Awards and a winner at the 2024 Excellence in Civil Liberties journalism awards. In 2024 he was elected to serve on the Federal Council (National Media Section) of the MEAA. Jarni has a Bachelor of Communications (Journalism) from the Royal Melbourne Institute of Technology (RMIT).
Jarni Blakkarly is an award-winning Senior Investigative Journalist at CHOICE. Jarni has worked for news organisations such as SBS, Reuters, Al Jazeera English, ABC 730, Radio National, BBC World Service and Deutsche Welle.
Jarni won the Walkley Foundation's young journalist of the year student category award in 2016 and was the recipient of a Melbourne Press Club Michael Gordon fellowship in 2022. In 2023 he was a highly commended finalist in the Quill Awards and a winner at the 2024 Excellence in Civil Liberties journalism awards. In 2024 he was elected to serve on the Federal Council (National Media Section) of the MEAA. Jarni has a Bachelor of Communications (Journalism) from the Royal Melbourne Institute of Technology (RMIT).
For more than 60 years, CHOICE has been fighting the good fight for Australian consumers.
In the past year alone we've uncovered systemic issues with sunscreens, investigated shonky supermarket pricing, fought for stronger scam protections and helped make complex energy pricing fairer and clearer.
CHOICE is here to provide unbiased advice and independent testing in our world-class labs. We buy the products we test, just like you do, and our expert reviews are influence free. We’re here to help you choose smarter. Hopefully you’ll also save some money along the way.
Thanks to CHOICE, you’ll never be alone when a business treats you unfairly. You can support our work by joining or donating to our cause.
