It has been confirmed that the Personal Information Protection Commission (PIPC) is reviewing the cross-border transfer structure of personal data by Chinese electric vehicle manufacturer ZEEKR, which is about to launch in South Korea. Although ZEEKR initially listed "China" as the destination country for driver voice data in its privacy policy and later corrected it to "Singapore," the PIPC maintains that legality can only be determined after verifying the actual data collector and how Chinese companies access the data.
According to the PIPC on the 22nd, an official responsible for international cooperation at the commission recently initiated a review of ZEEKR's personal data processing structure. A PIPC official stated, "We must carefully examine how ZEEKR actually processes personal data." The government has determined it is necessary to verify whether the actual methods of collecting and processing personal data comply with current laws ahead of the domestic delivery of ZEEKR's 7X model.
The controversy began with ZEEKR's "Connected Service Privacy Policy." While ZEEKR listed China as the destination country for "voice recognition feature data" used by voice assistants, a footnote in the same document stated that data is transmitted directly to Singapore servers without passing through China. After Money Today began its investigation, ZEEKR changed the destination country from China to Singapore and added an application date for the privacy policy that had previously been left blank. ZEEKR's side maintains that it corrected content that did not match actual policies.
The PIPC holds that simply changing one country name is insufficient to resolve the cross-border transfer controversy. This is because the applicable law and responsible party may differ depending on whether ZEEKR's Korean subsidiary collects domestic user information for overseas transmission, or whether Chinese headquarters or overseas subcontractors collect data directly from vehicles in South Korea. Even if information is stored on Singapore servers, if Chinese companies or research organizations can remotely view or process it, this could constitute a separate cross-border transfer.
The subcontracting structure is also under review. ZEEKR's personal data processing involves multiple overseas entities, including a Chinese voice recognition company, a Singaporean subsidiary, a cloud operator affiliated with Huawei, and ZEEKR's headquarters research and development organization. The PIPC plans to examine which companies have access to what information and whether such details were properly disclosed to users.
This is not the first time controversies have arisen over personal data access by Chinese smart devices. Previously, Chinese robot vacuum manufacturer Roborock faced controversy due to its privacy policy allowing Chinese headquarters to access Korean user information. At that time, the target was a robot vacuum moving around homes; now, the scope has expanded to vehicles that generate real-time location and travel routes.
The PIPC intends to determine whether laws were violated after verifying actual data transfer paths and each company's access rights. If violations of cross-border personal data transfer requirements are confirmed, corrective measures, fines, and legally enforceable orders to halt cross-border transfers may be imposed.
ZEEKR began pre-orders for its first domestic model, the mid-size electric SUV 7X, last June. Pre-orders exceeded 1,500 units this month, and vehicles are scheduled for sequential delivery starting in September.
in TECH
