Fourteen Members of the European Parliament have asked the European Commission to assess the cybersecurity risks that BYD’s connected vehicles from the Chinese manufacturer could pose and to examine possible measures regarding access to sensitive infrastructure or public procurement markets. At this stage, it is a parliamentary initiative: no European authority has established the existence of a vulnerability at BYD and no exclusion decision has been announced.
What is established at this stage
• 14 MEPs have sent questions to the European Commission.
• They request an assessment, notably for strategic infrastructures and public procurement.
• BYD says that no data processed or stored in its vehicles or in the European cloud can be remotely accessed from China.
• The European Commission generally has about six weeks to respond to parliamentary questions.
What the MEPs are Asking
The initiative is led by French MEP François Kalfon. The signatories want to know whether the Commission intends to evaluate BYD as a high-risk supplier, restrict Chinese vehicles’ access to certain strategic dual-use infrastructures, or consider excluding them from certain public markets.
The parliamentarians base their questions on the growing role of connected vehicles in data collection as well as on the Chinese legal framework. They notably cite the 2017 Chinese National Intelligence Law. They also mention measures taken or contemplated in several countries regarding Chinese connected vehicles.
These elements constitute the arguments advanced by the signatories. They do not, in themselves, constitute proof of unauthorized access to BYD vehicle data in Europe.
BYD’s Response
BYD told Reuters that no data processed or stored, whether in the cloud or inside a vehicle, can be accessed remotely from China. The manufacturer also states that customers remain in control of their data and that BYD Europe does not make this information available to BYD entities or third parties in China.
In its European Data Act documentation, BYD states that the data controller is BYD Europe B.V., based in the Netherlands. The manufacturer specifies that the data in question is stored on Google Cloud in a data center located in Paris.
What Data Can a Connected Car Generate?
The question goes beyond the case of a single manufacturer. A modern car can generate and transmit data related to its operation: the status of doors and windows, mileage, speed, tire pressure, battery, state of charge, diagnostics, software versions, and results of updates.
BYD notes, for example, that some operating data can be collected and sent to the cloud at regular intervals, notably every 30 or 60 seconds depending on the data categories and services used. Remote diagnostics can also transmit technical information. The available features depend on the model, configuration, and activated services.
The BYD app also enables certain remote commands, such as locking or unlocking the doors, starting the vehicle, or adjusting the climate control. This type of service illustrates the current level of connectivity typical in the automotive industry.
Europe already has automobile cybersecurity rules
Car cybersecurity is not a field devoid of regulation. The European regulation on general vehicle safety includes requirements related to connected vehicles and cybersecurity. The rules rely in particular on UN Regulation No. 155, dedicated to the cybersecurity of vehicles and to cybersecurity management systems.
This framework requires manufacturers to have risk management processes, measures for prevention and detection of cyberattacks, capabilities to monitor vulnerabilities, and tests designed to verify the effectiveness of the protections in place.
Why is the Debate Resurfacing Today
Cars are gradually becoming mobile software platforms. Cameras, sensors, driver assistance systems, navigation, apps, remote updates and cloud services multiply information flows. Public authorities are thus seeking to determine how to protect data and sensitive sites without conflating potential risk, demonstrated vulnerability, and actual non-compliance.
In BYD’s case, the next step will be the European Commission’s response to the questions from the 14 parliamentarians. This response, and any technical assessments or subsequent regulatory decisions, will determine whether the debate leads to concrete measures.
No automatic consequence for vehicles sold in Europe
The parliamentary démarche does not, on its own, alter the conditions of marketing BYD vehicles in the European Union. Reuters also notes that BYD has manufacturing operations in Hungary and plans further production capacity on the continent, a factor that could influence the application of future European rules related to public markets.
For motorists, the immediate question remains the same as for all connected vehicles: what data are collected, where are they stored, who can access them, and what regulatory controls apply. On these points, European law already imposes several obligations, and the Data Act strengthens users’ rights to access the data generated by their connected products.
