Cybersecurity Laws for Connected Vehicles

 

Subject: 

Re: New Cybersecurity Laws for Connected Vehicles: A Policy Framework Proposal

===================================================

Respected Gadkariji,

I hope this email finds you well.

I am writing to share my thoughts on the

Ministry of Road Transport and Highways' recent announcement regarding the introduction of new cybersecurity and software update management laws for vehicles.

As you are aware, I have long advocated for an integrated "Internet of Vehicles" (IoV) framework for India. While this new regulatory focus on cybersecurity is a critical step forward, I believe it presents a unique opportunity to simultaneously define a robust data privacy and integration architecture.

To that end, I have drafted a Connected Vehicle Data Privacy & Integration Act framework. This proposal seeks to balance the immense public benefits of deep vehicle data integration—such as automated emission tracking and safety management—with stringent safeguards for individual privacy.

The framework proposes:

1. A Privacy-Zone Firewall: Explicitly prohibiting the acquisition of private in-cabin data.
2. Purpose-Driven Data Flows: Permitting only anonymized, aggregated data for insurance and regulatory reporting.
3. Local Intelligent Processing: Mandating that metrics like the HARM QUOTIENT and TRANS-SCORE be computed locally on-board, transmitting only the final scores to the VAHAN ecosystem for automated TRANS-TAX billing.

I have attached a summary of this framework for your kind consideration. I believe that by building these privacy standards into the new cybersecurity laws from the ground up, India can lead the world in developing a sovereign, secure, and smart mobility stack.

Looking forward to your thoughts.

With warm regards,

Hemen Parekh

---

Reference Archives:

• Internet of Vehicles ( IoV )? - March 2017
• IoT ; IoV ; Cars Stealing Your Data - Sept 2023
• Shri Jyotiraditya Scindiaiji, : Use of V2V Spectrum - April 2026
• FW: THIS COULD SAVE THOUSANDS OF LIVES - June 2025

=========================================================================

Proposed Framework: Connected Vehicle Data Privacy & Integration Act

This framework adopts a "Privacy-by-Design" approach, categorizing data based on its utility for public infrastructure versus personal privacy.

1. Prohibited Data (The "Private-Zone" Firewall)

To ensure occupant privacy, the law must explicitly prohibit manufacturers from acquiring, storing, or passing to third parties any data that identifies personal habits, private conversations, or location history outside of necessary operational and regulatory requirements.

• Prohibited Categories:
  • In-Cabin Audio/Video: Any persistent recording or streaming of private conversations or occupant activities within the vehicle cabin.
  • Personal Behavioral Profiling: Psychological or personal lifestyle insights (e.g., shopping habits, personal interests) inferred from in-vehicle activity.
  • Sensitive Location History: Detailed, granular historical trip-maps that could reveal a user's private life, except where mandated for secure emergency services or ROTE-related emission audits.

2. Permissible Data Transfers (Functional Categorization)

Manufacturers and software developers must have clear guidelines on what they can transmit, to whom, and in what format.

• To Insurance Companies (Aggregated/Anonymized):
  • Permitted Data: Vehicle-specific risk metrics (e.g., braking frequency, average speed, historical collision data) strictly in anonymized, aggregated format.
  • Constraint: No individual-level location data or occupant identifiers. The data must be used solely for calculating actuarial risk, not for intrusive marketing.
• To Traffic Police / Road Safety Authorities:
  • Permitted Data: Real-time traffic density, road surface condition, or accident reporting (being hit/theft) as envisioned in your IoV model.
  • Constraint: Data must be transmitted via secure, authenticated channels (V2V/V2I spectrum) to assist in emergency response and traffic flow optimization, not for unwarranted surveillance.

3. Integration with Transport Authorities (The Digital Mobility Stack)

Integration with state and central authorities must be purpose-driven, leveraging India's indigenous stack (NaVIC/Aadhaar/UPI/FASTag).

• RTO & VAHAN Portal:
  • Scope: Standard vehicle registration, ownership status, and technical health data (as requested for ROTE).
  • Protocol: Automating the transition from static to dynamic records—specifically updating vehicle health status and "Active/Inactive" status automatically via sensors.
• State & Central Transport Authorities:
  • Scope: The TRANS-SCORE and HARM QUOTIENT metrics.
  • Mechanism: Data should be processed locally (within the vehicle's "intelligent cockpit") and only the resulting safety/emission scores should be transmitted to the central cloud for automated TRANS-TAX billing via FASTag/UPI.

---

Key Policy Recommendations for the Ministry

1. Mandatory Certification: Any IoT sensor or software update pushed to a vehicle must undergo a "Data Privacy Impact Assessment" (DPIA) to prove that it does not circumvent the prohibited data firewall.
2. Local Data Processing: Encourage (or mandate) that sensitive analytics—such as determining the vehicle's location or calculating the HARM QUOTIENT—happen within the vehicle's onboard "Intelligent Cockpit." Transmit only the output (the score/tax), not the raw input (the journey map).
3. V2V Spectrum Security: Ensure that the 30 MHz of spectrum allocated for V2V communication is reserved for non-proprietary, safety-critical data, preventing it from being used for commercial data harvesting by private manufacturers.