Brief Review of the Notice of the Ministry of Natural Resources on Strengthening the Administration of Surveying, Mapping and Geoinformation Security of Intelligent Connected Vehicles

Authors: Kevin DUAN丨Yuting WANG丨Jin ZUO

On July 26, 2024, the Ministry of Natural Resources ("MNR") promulgated the Notice of the Ministry of Natural Resources on Strengthening the Administration of Surveying, Mapping and Geoinformation Security of Intelligent Connected Vehicles ("Notice 139"), reiterating the importance of the security of surveying, mapping and geoinformation.  This is the second time within a two-year period for the MNR to clarify certain difficulties in the monitoring of surveying and mapping compliance of intelligent connected vehicles ("ICV") and the compliance focus in relation to geographic information data processing following the issuance of the Notice on Promoting the Development of Intelligent Connected Vehicles and Maintaining the Security of Surveying, Mapping and Geoinformation ("Notice 1").

In summary, we believe that Notice 139 does not impose compliance obligations beyond the existing regulatory framework.  Compared with Notice 1, Notice 139 puts forward more detailed requirements in terms of the scope of geoinformation data, types of surveying and mapping licenses, and whole-process supervision.  However, the compliance obligations are traceable under the existing surveying and mapping laws and regulations.

In this article, we interpret the key compliance points that are closely related to surveying and mapping license holders ("License Holders"), vehicle companies, autopilot companies, and other industry players.

Exterior images of vehicles and road topological data

Article 1 of Notice 139 restates the definition of surveying and mapping activities relating to ICV, i.e., surveying and mapping activities are "the collection, storage, transmission and processing of ICV's spatial coordinates, real sense images (including video, image and other environment perception data), point clouds and their attribute information and other geographic information data (including road topological data) of vehicles and their surrounding road facilities in the course of their operation, service and testing".  This definition is basically the same as in Notice 1, indicating that the two documents maintain the same regulatory approach.  Meanwhile, based on the types of data that would be collected in the surveying and mapping activities conducted by vehicle companies, Notice 139 further refines the meaning of ICV-related surveying and mapping geoinformation.

Specifically, on the basis of Notice 1, Notice 139 clarifies that real sense images, including environment perception data such as videos and images, and road topological data are also geoinformation in surveying and mapping activities.  With the wide use of various types of vehicle-mounted cameras, image data has become the most common type of geoinformation data second only to GPS coordinates in some vehicle companies.  To clarify the meaning of image data of surveying and mapping activities, Notice 139 reiterates "real sense images" as a general term in the field of surveying and mapping, and further clarifies that all environmental perception data such as exterior video and images may also fall within the scope of geoinformation data.  Similarly, Article 1 of Notice 139 also specifies that road topological data is a type of geographic information data.  For subsequent identification of geographic information data, enterprises should follow Notice 139 to avoid omission of any image or road topological data.

Surveying and mapping qualification for digital navigation maps

Articles 2 to 4 of Notice 139 emphasize the requirements for obtaining the proper surveying and mapping licenses for data processing activities related to the production of ICV navigation electronic maps, processing requirements regarding confidential and sensitive data, and map review requirements.  Among them, Article 2 specifies the category of digital navigation maps; that is, digital navigation maps include "basic maps, advanced driving assistance maps, high precision maps, autonomous driving maps".  Notice 139 also requires that activities such as the collection, storage, transmission, and processing of geographic information data transmitted back by intelligent connected vehicles and the production of maps must be conducted by entities that have the licenses for producing navigation electronic maps or other surveying and mapping licenses.

We note that the Regulations of Beijing Municipality on Autopilot Cars (Draft for Comment), released in June 2024, also set out similar requirements, which stipulate in Article 34 that "entities that use autopilot cars to carry out map surveying and mapping activities shall obtain the corresponding grade of qualification for producing navigation electronic maps in accordance with the law".

Before the issuance of Notice 139, because Notice 1 did not specify the types of surveying and mapping licenses and only mentioned the license for producing navigation electronic maps when the data was transmitted overseas, there were still many enterprises that relied on license for geographic information system engineering or other surveying and mapping licenses to process geographic information data collected by ICVs for use in navigation activities.  However, since ICVs feature wide driving range, large amount of data with high precision and sensitive types of data, such business activities usually fall beyond the licensed scope of the geographic information system engineering license and such license holders may not be capable of ensuring data security.  We believe that after the issuance of Notice 139, it will become more common knowledge in the industry that ICVs which carry out navigation-related activities should obtain the license for producing navigation electronic maps.

It is worth noting that not all geographic information processing activities relating to ICVs are related to navigation or map production, and some business activities may fall within the scope of Internet map services.  In this scenario, the surveying and mapping licenses of all participants will be determined comprehensively based on overall data collection and processing.

Whole-process compliance of geographic information data

Article 5 of Notice 139 requires all regions to strengthen the whole-process supervision of geographic information data, and clearly states that "geographic information data collected by ICVs and used in navigation-related activities, map production, and updating shall be directly transmitted to and managed by entities that are qualified for producing navigation electronic maps, and shall not be accessed by other entities or individuals".

We understand that Article 5 is intended to solve the phenomenon where after the issuance of Notice 1, some enterprises cooperated with License Holders in name only.  Notice 1 only generally requires that enterprises without surveying and mapping licenses entrust License Holders to carry out the relevant surveying and mapping activities, and License Holders were required to undertake the business of geographic information processing and provide geographic information services and support.  However, Notice 1 does not set out specific requirements on the scope of entrustment or the details of cooperation; thus, in practice, an enterprise without surveying and mapping licenses could still have access to geographic information even after entering into a cooperation agreement with a License Holder.  Article 5 of Notice 139 expressly prohibits this phenomenon and requires that geographic information data be directly transmitted from the vehicle terminal to the License Holder for handling.

Cross-border transfer of geographic information data

With regard to the cross-border transfer of geographic information data, Article 5 of Notice 139 reiterates the requirement of Notice 1 that enterprises must, prior to transmitting geographic information data to overseas parties, "strictly comply with all procedures for data export approval or map review".  We understand that relevant detailed requirements may apply as set out in the Surveying and Mapping Law of the People's Republic of China, the Regulations on the Administration of Surveying and Mapping Results, the Circular on Strengthening the Administration of Production, Testing and Application of Autopilot Maps, and the Regulations on the Administration of Maps.

In addition to the requirement that surveying and mapping results be examined and approved, Notice 139 further emphasizes that the cross-border transfer of geographic information data must "comply with relevant provisions on security assessment for data cross-border transfer".  In other words, even if geographic information that has gone through the map review procedure, the security assessment for cross-border data transfer may still be conducted before such data is provided to overseas parties.  Given that the Provisions on Promoting and Regulating the Cross-border Flow of Data allow pilot free trade zones to formulate their own data lists to facilitate the cross-border data flows, enterprises may be able to carry out relevant data cross-border activities through local pilot free trade zone policies.

Application pilot projects

Article 7 of Notice 139 calls for encouraging the exploration of geographic information security applications within the framework of "pilot application projects".  It provides that "relevant regions shall, based on the high-precision maps application pilot projects and the application projects of vehicle, road and cloud integration of ICVs, support the efforts of vehicle enterprises and service providers to explore safety and compliance technical routes including data collection, real-time updating, online distribution and safe transmission of the geographic information data of ICVs, speed up the development of standards and specifications, organize and carry out geographic information services and tests needed for high-level autonomous driving, and promote the development of new business forms and new applications of geographic information on the premise of ensuring safety and compliance".  It is thus clear that Notice 139 and Notice 1 have the same purpose.  Both of them essentially aim to encourage and promote the orderly development of ICVs on the basis of security.

Due to the absence of relevant laws, regulations and technical standards, some of the business activities of interest to enterprises are likely to have compliance deficiencies to some extent, such as crowdsourced collection, real-time map updating, and geographic information data transfer via public cloud.  For example, Article 4 of Notice 139 reiterates that "maps shall only be available for use after they pass map review.  New geographic information added to maps shall be subject to security review and record-filing in a timely manner".

According to Notice 139, relevant enterprises may consider participating in local pilot projects and carry out relevant technology R&D and application activities within a secure and controllable scope.  It is worth noting that enterprises may still be subject to regulatory penalties if they illegally conduct relevant geographic information data processing beyond the scope of the pilot programs.

Regulatory trends

In general, Notice 139 clarifies issues arising in the practical surveying and mapping activities relating to ICVs, emphasizes the need to tighten the administration of red-line issues that affect national security, such as the qualification for ICV surveying and mapping, confidential and sensitive information and cross-border data transmission, and also gives consideration to the rapid development of the automobile industry, and proposes opinions such as encouraging exploration, optimizing services, and creating a favorable atmosphere

With respect to tightening administration, Article 6 of Notice 139 points out the need to tighten the supervision of geographic information security, requiring that "local authorities make more effort to improve the risk prevention and control system for geographic information security of ICVs, organize the R&D of technologies such as confidential handling, timely warning and handling of geographic information, and establish and improve management systems such as classification and grading, and security risk assessment, as well as the monitoring and early warning system for geographic information security.  Specifically, local authorities are to monitor and follow up geographic information security risks and investigate and handle relevant cases in a timely manner".

In terms of encouraging development, Article 9 of Notice 139 advocates the creation of a good atmosphere for secure development and requires that "all regions timely revise local regulations and policies on the management of surveying, mapping and geographic information relating to intelligent connected vehicles, further effectively interpret policies, enhance the awareness of the policies, and stabilize all parties' expectations.  Strengthen publicity and education, and further raise the awareness of geographic information security of practitioners".

We believe that the release of Notice 139 does not necessarily imply that regulatory authorities will launch large-scale law enforcement activities, but industry practitioners should be aware that the red line of geographic information data security will not be relaxed, and any compliance flaws in the processing of geographic information data may at any time become a compliance hazard that triggers regulatory investigations and punishment.

Conclusion

Based on our observations, a portion of industry players had taken stricter measures to interpret and fulfill enterprise compliance obligations under the Surveying and Mapping Law and other relevant laws and regulations, even before the promulgation of Notice 1.  However, a portion of enterprises remained indifferent to the principle requirements set out in Notice 1.  With the release of Notice 139, we recommend that enterprises conduct self-inspections on their compliance of geographic information data, including:

• Make an inventory of data assets and identify geographic information data, identify data that may fall within the scope of geographic information data, and check whether geographic information data has been transmitted overseas;

• Examine the collaborative projects between License Holders and non-License Holders, sort out data flows, and make sure the business arrangements and technical measures for data collection, transmission, storage, and use meet the whole-process regulatory requirements for geographic information data;

• Prepare or amend relevant agreements or other legal documents related to geographic information data processing, and clarify the relationship of rights and obligations with cooperating parties.