LGPD and cybersecurity on the automotive industry agenda

Every year, on-board technology gains relevance when consumers choose a vehicle. At the beginning of the last decade, when multimedia centers began to equip entry vehicles, this equipment was practically used to listen to music. Applications to control functions such as opening doors or knowing where the vehicle is located were not common and few models had an internet connection through 4G/LTE, 5G and Over-The-Air (OTA) software updates. 

At that time, the LGPD also did not exist and most people were not concerned about how their data would be used or the risk of this information being leaked. Currently, through sensors and internet connection, vehicles can generate various data such as the locations traveled, driving style and even images and biometrics of drivers. This demands consumer attention on how this data will be used, who it can be shared with and whether there are cybersecurity measures. 

Information such as driving patterns through truck telemetry are already used by companies to increase the safety of drivers and cargo, as it allows managers to observe whether a route deviation has occurred due to theft. The technology also helps the driver improve their driving by saving fuel and saving brake components, as it allows them to know if a steep climb is approaching and it is necessary to accelerate or reduce acceleration if a descent is approaching. 

Telemetry can also be an ally for good amateur drivers and is already used to benefit from insurance bonuses and discounts. And what started in the insurance sector, through sensors on the driver's cell phone, has been adopted by some automakers. In the case of insurance companies, the driver has the option of choosing this insurance format. However, when purchasing a vehicle, the driver does not always know whether a particular model can capture this information and needs to be aware that they can request correction of information, request deletion and prevent sharing of information with third parties. Owners also need to be careful when reading the use contract for applications or internet connection systems and check how their data can be used before accepting the terms of use. 

Automakers that capture the information need to store and share the data in accordance with the LGPD and although it is not mandatory in the country, many companies follow the TARA (Threat Analysis and Risk Assessment) of the ISO/SAE 21434 standard, which determines ways to assess the potential cybersecurity risks of vehicles and promotes the implementation of effective protection measures throughout the product's entire life cycle.  

At the national level, the cybersecurity of vehicles with an internet connection is regulated by Anatel Act No. 77/2021, which establishes cybersecurity requirements for telecommunications equipment. And Bill 298/2024, which amends art. 103 of the Brazilian Traffic Code and deals with vehicle cybersecurity and prohibits charging consumers for electronic operating system updates. 

The PL also determines that CONTRAN must establish procedures for the technical assessment of possible vulnerabilities arising from intrusions or cyber attacks, including providing for types of integrity tests for electronic systems and the schedule for incorporating security measures into new projects. 

Although Brazil has the LGPD, Act No. 77/2021, and many companies have already adopted ISO/SAE 21434, attention is needed to regulate cybersecurity. Themes covered in PL 298/2024 were already present in PL 2958/2015, filed at the end of the last decade. Since then, technology and the fleet of connected vehicles has gradually increased. For these technologies to maintain data security and generate benefits without risks, it is necessary to strengthen cybersecurity in the automotive sector from project conception to the end of the life cycle. 

TÜV Rheinland: 150 years of making the world safer  

TÜV Rheinland is one of the world's leading providers of testing and inspection services, with annual revenue in excess of €2.7 billion and around 26,000 employees in more than 50 countries. Its highly qualified experts test technical systems and products, enable innovation and support companies in the transition to more sustainable operations. The company trains professionals in various areas and certifies management systems according to international standards. With recognized expertise in areas such as mobility, energy supply and infrastructure, TÜV Rheinland ensures independent quality at every stage, including in emerging technologies such as green hydrogen, artificial intelligence and autonomous driving. In this way, it contributes to a safer and better future for everyone. Since 2006, TÜV Rheinland has been a signatory to the UN Global Compact, which promotes sustainability and combats corruption. To find out more, visit: https://tuv.com 

ByGuilhermePorazzaDias, Local Mobility Field Manager at TÜV Rheinland do Brasil