Australian Shadow Minister Questions Didi About User Data Security

A logo of Chinese ride-hailing company Didi is seen at its headquarter in Beijing, China, on July 2, 2021. Jade Gao/AFP via Getty Images

An Australian senator has written to Chinese ride-hailing giant Didi, asking the company to ensure it complies with Australian privacy laws and adequately protects the cyber security of Australian users.

On Aug. 17, Liberal Senator, Shadow Minister for Cyber Security & Countering Foreign Interference James Paterson published on social media a letter to Maria Silos, Director of Government Affairs at Didi Australia.

“Following reports of a significant fine in China for privacy breaches, I’ve written to Didi Australia to seek their assurances they are compliant with our privacy laws and are adequately protecting Australian users’ cyber security,” Paterson wrote in a thread on Twitter.

Didi Fined in China for Data Security Breach

Founded in January 2013, Didi’s main products in China include online car-hailing, hitchhiking, two-wheeled vehicles, and car-making.

The Chinese regime fined the company 8.026 billion yuan (about $1.2 billion) for data security breach in July after a yearlong probe that forced Didi to delist from the United States.

The Cyberspace Administration of China (CAC) said that it found Didi violated the Cyber Security law, Data Security law, and Personal Information Protection law.

Didi illegally collected nearly 12 million customer cell phone screenshots, 107 million passenger facial identifiers, 153 million “home” and “company” taxi addresses, 53,509,200 age groups, 16,335,600 occupations, and nearly 1.4 million relational information, according to Chinese authorities.

Liberal Senator James Paterson in the Senate at Parliament House in Canberra, Australia, on Nov. 21, 2016. AAP Image/Mick Tsikas

In the letter sent on Aug. 12, Paterson asked Silos to list steps Didi had taken to ensure compliance with Australian privacy laws.

“What steps you have taken to ensure that you are compliant with each of the 13 Australian privacy principles contained in the Privacy act 1998?” he wrote.

“Whether you are currently compliant with your obligations under Australia’s privacy laws?”

The shadow minister further questioned a Didi policy that its users’ information may be shared with institutions and individuals in China.

“I noted that your privacy policy states Didi collects a large range of personal information of its users, Clause 10 of that policy states that Didi may disclose the personal information of it is users to bodies within the Didi group, business partners and related providers that may be located and operate in overseas locations, including in mainland China,” Paterson wrote.

“Can you please confirm if the personal information of Australian Didi users is stored or accessed in any way by entities operating in mainland china? If so, what is the precise nature of that personal information and which entities have access to that information?”

The download page for the TikTok app is displayed on an Apple iPhone in Washington DC, on Aug. 7, 2020. Drew Angerer/Getty Images

Paterson, who is also the chair of the Joint Parliamentary Committee on Intelligence and Security, wrote to TikTok Australia in July, questioning if Australian user data can be accessible in China.

The company later confirmed that employees in mainland China can access the data of millions of Australian users of the video-sharing app.

“By their very nature, ride-sharing apps collect sensitive personal information like home and work addresses,” Paterson wrote in another Twitter post on Aug. 17.

“Didi, like other Chinese tech companies, are subject to China’s national security legislation which compels them to covertly assist CCP intelligence agencies.”