As more foreign vehicle manufacturers enter the domestic market and vehicles using sensitive information, such as connected cars (vehicles capable of accessing various information via wireless networks), increase, the methods used by manufacturers to process and transfer personal data have emerged as a new issue. While ZEEKR was designated for review by the Personal Information Protection Commission after stipulating that it would transfer Korean users' personal data to China, BYD, another Chinese brand previously embroiled in similar controversy, has drawn attention for resolving the issue.
When BYD entered the Korean market last January, it faced suspicions that it could transfer personal data to its headquarters in China. In response, the Personal Information Protection Commission inquired about the facts with BYD in March of the same year. BYD responded, "We have already begun improving our privacy policy and user manuals, and we plan to fully reflect the Personal Information Protection Act before launching domestic products."
In April of the same year, BYD strengthened transparency by establishing measures such as 'Personal Information Security Assurance Measures' and 'Detailed Status of Third-Party Provision of Personal Information' in its vehicle privacy policy. A representative example is the explicit statement that "personal data of Korean users will be stored on Tencent Cloud located in Korea, and Tencent Cloud in China cannot access this information."
BYD does transfer some information to China. However, it explicitly states the purposes of transfer, including warranty claims, recall implementation, maintenance history management, quality improvement, and activation of connected services. The transferred information is limited to names, vehicle license plate numbers, vehicle identification numbers (VINs), and email addresses. Users sign a delivery confirmation form, after which data is transmitted remotely via a private dedicated network (VPN).
The most sensitive location data is collected by the domestic subsidiary 'BYD Korea Auto' and entrusted to 'BYD Korea' for processing. The terms of service for location information services state only that location data is collected for services such as service center reservations and remote monitoring, with no mention of transferring data overseas to China or other countries. Location data collected for service center reservations is deleted immediately after the request is processed. As a general rule, personal location data used for remote monitoring is processed in real time and not stored.
ZEEKR, which recently entered the Korean market, also faced similar issues. ZEEKR stipulates that it may transfer mobile-related data of Korean drivers—including real-time vehicle location, parking location, driving routes, and driving distance—to its Chinese affiliates and parent company Geely Group. The purposes of transfer are broadly set to include the establishment, operation, maintenance, management, and improvement of connected services such as platform construction.
As ZEEKR prepares to enter the Korean market, it has begun undergoing verification to ensure its personal data processing structure aligns with domestic regulations and user expectations. An industry official stated, "From the perspective of Korean consumers, there is no choice but to be concerned about whether their personal data is transferred to China," adding, "ZEEKR, which passed the preliminary review, now faces its first test."
in TECH
