Smartphones on Wheels in Southeast Asia: A Crossroads for Data Governance

By Attamongkol Tantratian and Gunn Jiravuttipong October, 2025

While the transformation of automobiles into data-generating “smartphones on wheels” has revolutionized mobility, it has also raised critical concerns over data privacy and sovereignty. Equipped with sensors and connected technologies, smart vehicles collect vast amounts of data, including personal information, driving patterns, and biometric identifiers. While auto-exporting jurisdictions such as the United States, the European Union, and China have introduced regulatory measures to address these challenges, countries importing smart vehicles remain vulnerable due to their limited influence over the auto companies’ integrated technology and data policies.

This Article examines the regulatory and economic challenges faced by developing nations integrating foreign-designed smart vehicles, with a focus on Southeast Asia’s rapid adoption of Chinese electric vehicles. Using Thailand as a case study, it highlights the urgent need for regulatory frameworks that balance data protection with economic growth. By analyzing approaches from the three dominant auto-exporting jurisdictions, this Article explores how regional cooperation and adaptive regulatory strategies can help developing nations assert greater control over smart vehicle data governance.

I. Introduction

The transformation of automobiles from mechanical transportation to data-collecting and generating devices represents one of the most significant shifts in mobility. This evolution blurs the line between carmaker and technology firm, exemplified by what The Economist calls Tesla’s “identity crisis.”¹ The classification of this identity has profound implications: it determines whether companies are valued as traditional manufacturers or as tech platforms, which in turn shapes investor expectations on growth models and profit margins. This ambiguity also forces policymakers to grapple with how to regulate firms in this evolving industry—a decision affecting everything from foreign investment and supply chain security to data governance. Highlighting this shift, Tesla’s CEO Elon Musk asserted in 2024 that modern vehicles are essentially mobile computing devices.² Along these lines, the U.S. Commerce Secretary aptly describes these autos as smartphones on wheels,³ a characterization that underscores the profound data protection implications for both the industry and its consumers.

As 97 percent of vehicles globally now feature smart screens and sophisticated sensors, they collect unprecedented amounts of personal data—from driving patterns and location histories to biometric information and connected device data.⁴ A Mozilla study declared cars the “worst product category” reviewed for privacy and revealed that modern vehicles collect more personal data than many other consumer devices.⁵ With the global fleet of connected vehicles now exceeding 400 million, almost doubling the total from 2021,⁶ the stakes are only higher.

Countries that develop and design smart vehicles often benefit from greater awareness of the data-related implications and have begun implementing measures to address these concerns. For example, the United States (U.S.) has issued investigative orders to examine these issues, and a European Union (EU) data protection authority has flagged smart vehicles in their authoritative guidelines. China has enacted stringent measures, including restrictions on foreign vehicles in sensitive governmental areas and regulations mandating data localization.⁷

In contrast, countries that are not home to smart automakers, many of which are in the Global South, face distinct challenges. These nations typically have minimal influence over the technological design and data policies attached to the vehicles, despite increasingly relying on vehicles for economic development. As smaller economies, they hold limited bargaining power in negotiations with foreign auto corporations. This dynamic is particularly visible in Southeast Asia, especially Thailand, where the rapid expansion of Chinese automotive manufacturers has significantly reshaped the market. In Thailand, sales of Chinese smart vehicles surged nearly eightfold in 2023,⁸ yet the data governance implications of this automotive influx remain largely unexamined. Therefore, this Article examines the critical data privacy and sovereignty challenges confronting these vehicle-importing nations. It argues that to mitigate these risks, they must develop tailored regulatory frameworks designed to govern the cross-border flow of automotive data.

This Article is organized into four parts. Part II explores the rise of smart vehicles, with a particular focus on Southeast Asia, using Thailand as a detailed case study. Part III delves into the data protection challenges posed by smart vehicles, addressing both data privacy and sovereignty concerns. It also provides an overview of regulatory measures adopted by jurisdictions involved in the design and production of these vehicles, offering potential examples for importing countries to consider. Finally, Part IV provides recommendations for reimagining data governance frameworks to better align with the needs and priorities of developing nations.

II. The Rise of Smart Cars

The global automotive industry is undergoing a profound transformation, driven by advancements in digital connectivity. Consulting firm McKinsey projects that by 2030, 95 percent of all new vehicles sold will be connected, a sharp increase from 50 percent in 2021.⁹ This shift is particularly evident in the rise of electric vehicles (EVs), which increasingly function as software-defined vehicles, cars that rely on software for core operations and enhanced functionality.¹⁰ Connectivity and data-driven capabilities are now essential features of modern automobiles.

A. Smart Cars: Cars with Data and Connectivity

Two decades ago, most vehicles lacked built-in satellite navigation, let alone the updatable systems now standard in modern cars. The introduction of infotainment systems with integrated navigation marks a turning point, initially receiving live traffic data via radio signals and later through built-in data connections.¹¹ Today, many vehicles integrate a growing array of sensors with external services, enabling continuous data exchange between the car and external networks.¹²

Smart cars, or connected vehicles,¹³ are defined by two distinct characteristics: they are data-intensive and possess pervasive connectivity. First, these vehicles generate and process a vast amount of information. This includes external sensor data, such as images and ultrasonic readings from the car’s surroundings; internal diagnostic data, detailing everything from engine performance to tire pressure; and granular data about the driver’s behavior.¹⁴ Also, by collecting and synthesizing information on the user’s physical movements (location history), digital habits (in-app activity), and the outside world, modern data science can be used to further infer a significant amount of sensitive information about the driver.¹⁵

Second, connected vehicles use sensors and data recorders to link with the internet, other devices, and surrounding infrastructure, allowing them to integrate with a wide range of digital platforms and applications.¹⁶ Operating as Internet of Things (IoT) devices, smart vehicles are equipped with data transmission nodes that enable continuous internet connectivity.¹⁷ They facilitate communication across multiple channels, including vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and the broader vehicle-to-everything (V2X) framework, encompassing networks, devices, pedestrians, grids, and cloud systems.¹⁸ Additionally, connected vehicles transmit data to their owners or manufacturers, providing diagnostic insights and operational status updates.¹⁹

B. Market Trends in Southeast Asia

Southeast Asia is rapidly emerging as a pivotal battleground in the global EV industry supply chain. Chinese automakers have gained a significant foothold in the region, leveraging strategic advantages to outpace incumbent Japanese firms.²⁰ By 2024, Chinese manufacturers accounted for approximately 75 percent of Southeast Asia’s EV market.²¹ Reflecting the pressures of this shifting landscape, Japanese automakers Honda and Nissan entered merger discussions in 2024, citing “challenges from Tesla and Chinese rivals.”²²

The Southeast Asia region, and Thailand in particular, serves as an ideal case for examining how import-dependent developing nations navigate smart vehicle data governance challenges amid geopolitical tensions.²³ Thailand has become a key hub for Chinese automakers, driven by the government’s strategic push for EV adoption to maintain its status as the “Detroit of Southeast Asia.”²⁴ As a result, Chinese automakers have rapidly gained dominance in the Thai EV market, with their models accounting for approximately 80 percent of all EVs sold in the country by 2023.²⁵ Thailand now dominates regional EV sales with a 78.7% market share, supported by a well-established midstream and downstream market that includes vehicle manufacturing and retail networks.²⁶

Beyond sales, Chinese manufacturers are expanding their production footprint in Thailand. For instance, Great Wall Motor plans to source up to 90 percent of its auto components from local suppliers, while BYD has launched operations at its Thai plant—its first factory in Southeast Asia.²⁷ These investments solidify Thailand’s role as a regional base for Chinese EV production, although the government’s subsidies have faced some pushback from existing auto industry stakeholders concerned about oversupply and potential price wars.²⁸

Thailand’s situation is particularly illustrative because it lacks a “national champion” automotive brand, unlike Vietnam’s VinFast—which has successfully entered global markets including the United States,²⁹ as supported by Vietnam’s national champion strategy³⁰—or Malaysia’s Proton which has recently launches its first EV car.³¹ Thailand has a history of supporting the expansion of foreign automotive manufacturing. In the 1980s, Thailand attracted substantial investment from Japanese automakers like Toyota and Nissan following the Plaza Accord, which compelled Japan to relocate manufacturing abroad.³² Thailand’s rise as an automotive manufacturing plant was driven by a combination of export-friendly policies, competitive labor costs, and a favorable geographic location that made it more attractive than its regional peers.³³ However, despite this long-standing manufacturing legacy, critical technological know-how—and, consequently, any associated influence over data and technology policymaking—has remained with the foreign corporations. This is best exemplified by Thailand’s lack of a domestic auto brand, indicating that decades of production have not translated into national ownership.

III. Data Governance Implications Posed by Smart Cars

Smart cars—vehicles equipped with internet connectivity—collect and generate an unprecedented volume of data through integrated features such as in-car applications, remote functionalities, GPS navigation, and Wi-Fi hotspots.³⁴ These capabilities allow for seamless user experiences but also result in the accumulation of extensive and sensitive datasets.

This vast collection of data raises significant concerns related to data governance. From a data privacy perspective, issues arise when the information pertains to identifiable or identified individuals, implicating personal privacy rights. Beyond privacy, the broader issue of data sovereignty becomes critical when data—whether personal or non-personal—collected within a jurisdiction ultimately falls outside the control of its governing authorities.

A. Data Privacy

Data privacy concerns have become an inevitable consequence of modern vehicles equipped with systems that collect vast amounts of personal information.³⁵ This extensive data collection poses significant privacy risks, particularly when drivers remain unaware of what information is being collected, how it is used, and to whom it is disclosed. The lack of transparency and corresponding absence of individual control (e.g., informed decision-making through the opt-in or opt-out options) exacerbate these risks. Individual control over personal information is central to the principles of autonomy and self-determination, and informational privacy emphasizes this control by framing privacy as the right to determine how one’s personal information is used and shared.³⁶ Control over personal data has long been regarded as a cornerstone of privacy,³⁷ forming the foundation of privacy regulations in jurisdictions such as the U.S., EU, and many other legal systems worldwide.³⁸

The principle of control is fundamentally undermined by the quiet yet extensive collection of personal data by smart cars, which ranges from precise location tracking and driving patterns to biometric information and data linked from other connected devices.³⁹ Notably, the connected car platform High Mobility identifies 57 categories of data collected by smart vehicles, including sensitive health information such as driver fatigue and heart rate.⁴⁰ Research conducted by Mozilla Foundation further highlights the breadth of this data collection, revealing that car manufacturers may access intimate details, including racial and genetic information, and even data related to sexual activity.⁴¹

Vehicle data collection extends far beyond operational needs, with much of this information often being utilized for unrelated purposes and disclosed to third parties, frequently without the knowledge or awareness of drivers.⁴² For instance, car companies can infer “driver scores” based on behaviors such as hard braking, acceleration, and phone usage. These scores are then sold to data brokers, who, in turn, provide this information to auto insurers.⁴³ Insurers may incorporate these scores into personalized coverage decisions, which, for some individuals, results in unexpectedly higher auto insurance rates.⁴⁴

B. Data Sovereignty

The proliferation of smart vehicles has transformed the once relatively straightforward realm of automotive regulation—focused on issues like road safety—into a far more complex matter of data sovereignty. Data sovereignty refers to a state’s authority over data generated within its jurisdiction, often exercised through data protection laws, competition regulations, and national security measures.⁴⁵ These powers enable states to safeguard their populations, foster digital economies, and, in certain instances, exert control over their citizens.⁴⁶

A state’s data sovereignty includes the ability to compel and control the means of compliance with its domestic laws.⁴⁷ Digitally, states can assert significant control largely because they govern the physical infrastructure of networks within their borders,⁴⁸ as the physical location of servers and the storage of data will likely determine which jurisdiction’s laws apply,⁴⁹ granting states substantial leverage over data governance within their territories. For this reason, the concept for data localization emerges. Data localization is justified on grounds of national security, law enforcement access, and individual privacy protection. Retaining data within national borders mitigates cyber espionage risks, ensures jurisdictional control for law enforcement access, and prevents the circumvention of domestic data protection laws by restricting transfers to less-protective jurisdictions.⁵⁰

The issue of data sovereignty has gained urgency as foreign-manufactured smart vehicles, now functioning as mobile data-collecting devices, operate across other jurisdictions. This concern is amplified when considering data ownership; if ownership is defined by the practical ability to control data, then auto manufacturers become the de facto owners.⁵¹ They can maintain near-total control over vehicle data, facing few restrictions on how they use it or to whom they sell it.⁵²

For many nations, particularly in the Global South, however, smart vehicles on their roads rarely originate as domestic products. The data policies governing these vehicles are thus likely drafted overseas, and while they may be influenced by local regulations through domestic compliance enforcement, these policies are not typically shaped by the importing countries from the outset.

Concerns about data sovereignty in a broader context have even been raised even by developed economies, like the EU. The European Parliament, particularly in the context of online platforms, has argued that the dominance of foreign internet platforms within the EU represents a significant erosion of European sovereignty, depriving Member States of control in areas such as copyright, data protection, taxation, and transportation.⁵³ In response, Professors Anupam Chander and Haochen Sun have countered that these concerns regarding platform dominance are “misplaced.”⁵⁴ They argue, “It is like arguing that because people drive Toyota cars on U.S. roads, we no longer control our streets. As long as the cars are regulated by local law, the fact that they might be built abroad should not undermine sovereignty.”⁵⁵

However, with the increasing implementation of active measures in dominant digital jurisdictions such as the U.S., EU, and China, it is evident that the dynamics surrounding smart vehicles have shifted, particularly as cars have evolved into data-intensive machines. The following section will examine the administrative and legislative measures related to smart vehicles that have been introduced in these jurisdictions.

C. Survey of Measures in Auto-Exporting Jurisdictions

Major automotive regions have implemented measures to protect their strategic interests in the global competition over smart vehicles. In this study, the jurisdictions examined—the U.S., the EU, and China—are also referred to as the “Digital Empires” by Professor Anu Bradford for their extraterritorial influence in digital regulation.⁵⁶

Before diving into their regulatory resources around data privacy and sovereignty, larger trade and economic measures issued by these jurisdictions provide some useful background. Notably, government subsidies followed by the mass production of Chinese EVs has sparked and intensified price wars and aggressive export strategies raising global overcapacity concerns.⁵⁷ The EU has responded with targeted anti-subsidy tariffs on Chinese EVs, despite strong opposition from Germany and its automotive industry. ⁵⁸ The U.S. has implemented even more aggressive measures. The Biden administration has sharply increased tariffs on Chinese EVs while also initiating an investigation into “connected-vehicles” that treats data-rich automobiles as critical infrastructure, potentially barring China-linked digital components.⁵⁹ Furthermore, new rules for U.S. EV purchase subsidies, which restrict eligibility for vehicles with Chinese battery components, may incentivize Chinese manufacturers to seek new export opportunities abroad.⁶⁰ The trade measures from tariffs, subsidies, and market access restrictions reflect the larger context of the weaponization of economic interdependency.⁶¹

Alongside this trade and industry-centered narrative, a parallel focus on privacy and security has also emerged. Each of these jurisdictions has introduced measures—from orders and regulations to public awareness campaigns—to govern the collection, use, and cross-border transfer of data generated by smart vehicles.

1. United States

The U.S., despite lacking comprehensive federal privacy legislation, has made notable strides in regulating smart car data.⁶² Domestically, the Federal Trade Commission (FTC) has been actively investigating data practices within the U.S. auto industry since March 2024.⁶³ In a recent investigation concluded in January 2025, the FTC determined that General Motors had collected and sold data from millions of vehicles—sometimes as frequently as every three seconds—without adequately notifying consumers or obtaining their affirmative consent.⁶⁴ The investigation resulted in a settlement prohibiting the company from disclosing geolocation and driver behavior data to consumer reporting agencies for a period of five years.⁶⁵

Beyond the domestic auto industry, the Department of Commerce, under Executive Orders first issued in 2019 and expanded in 2024,⁶⁶ has initiated investigations into vehicle data control issues, including potential restrictions on connected vehicle imports, particularly those utilizing Chinese or Russian technology. Historically, the U.S. has benefited from a de facto digital sovereignty, as the geography of the Internet has largely been centered within its jurisdiction. The domestic storage of American data has traditionally allowed for judicial oversight, and even when such data is stored abroad, Congress has amended laws to grant prosecutorial authority over such overseas data.⁶⁷

2. European Union

As early as 2010, the French government raised concerns about the erosion of sovereignty in the face of foreign technology firms, particularly in the realm of cloud computing. The observation was made that North American companies was dominating the market, highlighting its critical importance to the sovereignty of European nations.⁶⁸ In the regulatory context, the European Union has expressed its commitment to digital sovereignty most fully through its comprehensive data protection law.⁶⁹ The General Data Protection Regulation (GDPR), enforced in 2018, exemplifies this commitment, not only protecting personal privacy but also reinforces data sovereignty by imposing strict restrictions on cross-border data transfers.⁷⁰ Notably, distinct from the other two jurisdictions in this analysis, the EU’s framework for cross-border data transfers establishes an adequacy test. This test aims to serve as a “model,” incentivizing other jurisdictions to align with EU standards to facilitate smoother data flows. To date, only a limited number of countries have received an adequacy decision from the European Commission.⁷¹

Moreover, the EU has fostered an ecosystem that amplifies the voice of civil society in shaping its digital framework. In the context of smart cars data more specifically, since 2016, initiatives like the “My Car My Data” campaign⁷² have raised awareness about privacy concerns associated with connected vehicles. These efforts have influenced the European Data Protection Board to issue authoritative guidelines on connected vehicle data collection and disclosure.⁷³ Furthermore, the EU’s 2023 Data Act proposal⁷⁴ builds upon this foundation by establishing clear rules for data sharing in connected products and services while maintaining strong personal data protections.⁷⁵ This comprehensive approach demonstrates how robust data protection legislation can evolve to address emerging technological challenges.

3. China

China has established a state-centric digital policy framework that underscores how digital governance is rooted in state sovereignty.⁷⁶ The modern concept of data or digital sovereignty,⁷⁷ may in fact have its roots in China’s 2010 white paper, which declared, “Within Chinese territory, the Internet is under the jurisdiction of Chinese sovereignty. The Internet sovereignty of China should be respected and protected.”⁷⁸ Six years later, The Chinese President emphasized the urgency of addressing technological dependence, stating that “[the internet’s] core technology being controlled by others is our greatest hidden danger.”⁷⁹

In line with this philosophy and to further reinforce its “Great Firewall,” a mechanism designed to control access to the internet within Chinese borders, China enacted the 2017 Cybersecurity Law, requiring corporations operating within China to domestically store data collected abroad⁸⁰ and mandates that critical infrastructure operators conduct security assessments before transferring data overseas.⁸¹ This framework was further strengthened by the Protection of Personal Information Law (PPIL), which imposes stringent restrictions on the export of personal data, underscoring China’s commitment to maintaining control over data flows.⁸²

With regard to smart car data regulation, China has taken a cautious approach to allowing foreign vehicles to operate freely within its borders. For example, restrictions were imposed on Tesla, banning its vehicles from critical government functions⁸³ and certain governmental areas.⁸⁴ Only recently did a provincial government approve Tesla for inclusion on its purchase list,⁸⁵ and this was contingent upon negotiations and the approval of Tesla’s data security measures,⁸⁶ including a requirement for domestic data storage within China.⁸⁷ Ultimately, the Chinese government permits only domestically manufactured Tesla vehicles to operate within the country,⁸⁸ reinforcing its commitment to strict data governance and subsequent national security.

To debrief, the U.S. utilizes a bifurcated, enforcement-led strategy, relying on agencies like the FTC to police the industry. Externally, the U.S. addresses the issue through a national security lens, with the DOC investigating potential restrictions on connected vehicle imports from geopolitical rivals. The EU has focused on a more comprehensive rights-based model centered on its GDPR. The GDPR functions as a tool of both privacy protection and data sovereignty, leveraging a strict adequacy test that effectively exports its high standards to other jurisdictions seeking seamless data transfers. This regulatory environment is also benefitted by robust civil society engagement, with campaigns that influence guidelines and new legislation. Finally, China’s approach is explicitly state-centric, prioritizing national security and an uncompromising vision of digital sovereignty first articulated more than a decade ago. This doctrine is enforced through a powerful legal framework mandating that data collected in China be stored domestically, leveraging its regulatory power to ensure state control over data flows and mitigate perceived technological dependencies.

IV. Data Governance Considerations for Southeast Asia

As Southeast Asia embraces smart vehicles, data governance challenges—particularly in privacy and sovereignty—become increasingly urgent. This section examines the risks posed by foreign-designed vehicles, using Thailand’s rapid adoption of Chinese EVs, along with Chinese digital infrastructure as case studies. While these vehicles drive economic growth, their data policies remain externally shaped, raising concerns over security and regulatory gaps. The discussion then explores strategies to balance data protection with economic benefits, drawing lessons from the U.S., EU, and China on investigative action, regulatory oversight, and selective data localization, before arguing that ASEAN-wide cooperation could enhance regional bargaining power, ensuring smart vehicle adoption aligns with both national and regional digital governance priorities.

A. Acknowledge the Potential Data Governance Harms

For countries without domestic champions in smart vehicle design, the data governance concerns, encompassing both data privacy and data sovereignty, raised by major auto-exporting jurisdictions such as the U.S., the EU, and China warrant serious examination. These issues should not be dismissed as mere geopolitics and trade rhetoric but rather recognized as grounded concerns that merit further investigation.

Thailand exemplifies this dilemma. The rapid influx of affordable and technologically advanced Chinese smart vehicles has been widely celebrated. There is a strong political consensus across both government and opposition parties⁸⁹ on the role of EVs in achieving sustainable development goals.⁹⁰ However, this enthusiasm should not preclude scrutiny. The recent backlash against aggressive discounting strategies employed by BYD dealers illustrates the complexities of this market shift. In early 2024, the Thai Consumer Protection Board received approximately 70 complaints from consumers who felt disadvantaged by sudden price reductions following their purchases, prompting an official investigation.⁹¹

Beyond market dynamics, concerns over data governance deserve greater attention. As also previously discussed,⁹² China enforces strict data localization requirements, requiring that data collected overseas by Chinese corporations be stored within its jurisdiction and made available to government authorities upon request. In response to concerns that American data collected from Chinese products may be stored in China,⁹³ for instance, the U.S. has implemented measures aiming at addressing both data privacy and sovereignty risks.

Thailand’s increased reliance on Chinese digital infrastructure suggests a broader pattern of limited regulatory scrutiny in this domain. The Thai government has welcomed Chinese investment in cloud infrastructure, with the Ministry of Digital Economy and Society—home to Thailand’s Personal Data Protection Committee itself—openly supporting Chinese tech giant Huawei’s involvement in the country’s cloud ecosystem.⁹⁴ Whereas the U.S. continues its campaign against the company for its alleged role in facilitating Chinese surveillance activities overseas,⁹⁵ most of the leading enterprises, government ministries, and financial institutions in Thailand today rely on Huawei’s services.⁹⁶ While Thailand’s Personal Data Protection Act (PDPA) was modeled after the EU GDPR⁹⁷ and therefore includes similar strict provisions on cross-border data transfers,⁹⁸ there has been no scrutiny against the large-scale data storage in China, particularly in light of the Chinese cyber laws requiring localization of data collected overseas.

B. Balancing Data Governance and Economic Benefits

As developing countries integrate smart vehicle technology into their economies, they must navigate complex intersections of data protection, digital sovereignty, and economic development. Countries like Thailand, which lack home-grown smart vehicles but serve as a major automotive plant, face unique challenges in balancing economic benefits, regulatory capacity, and negotiating power with multinational corporations. While foreign direct investment (FDI) in the EV sector can be crucial for economic growth, it also raises significant concerns regarding data governance. A well-calibrated regulatory approach must account for both the opportunities and risks associated with increased vehicle connectivity.

A critical step is strengthening data protection governance to ensure a non-discriminatory approach to vehicle data collection. While concerns over Chinese smart vehicles dominate global discourse, a broader, brand-neutral approach is necessary—one that acknowledges that all modern connected cars collect and transmit data. U.S.-style investigative mechanisms could be instrumental in assessing both the economic benefits and potential threats posed by EV adoption. Thorough studies, conducted independently or in collaboration with civil society organizations as demonstrated in the EU, would provide a fact-based foundation for regulatory interventions.

Building on the EU data protection authority’s work, Thailand’s data protection authority may also take a more proactive role in enforcing the existing data protection law and issuing sector-specific guidelines on smart vehicles data collection. While the Thai PDPA mirrors the EU’s GDPR, enforcement efforts remain underdeveloped due to both manpower and budget constraints.⁹⁹ For this reason, smart vehicle data governance should not be left to reactive enforcement alone; instead, multi-stakeholders including privacy non-governmental organizations, independent think tanks, and investigative news outlets need to get involved more actively in raising awareness of emerging technologies, enriching a healthier data protection ecosystem.¹⁰⁰

On China’s data localization framework, other nations could also consider it as a model, particularly for national security purposes. While complete data localization may not be practical for every developing country,¹⁰¹ targeted restrictions—such as limiting data access in sensitive geographic areas or for specific government personnel—could serve as an effective safeguard. This approach allows governments to balance maintaining an open market with ensuring that sensitive data categories, such as geolocation, images of military installations, and biometric identifiers, remain under national jurisdiction. A Comparison between Thailand’s PDPA with China’s PIPL illustrates the point. The justifications for allowing cross-border data transfers under the PDPA are relatively flexible, permitting transfers based on consent or contractual necessity—grounds not recognized under Chinese law.¹⁰² Critically, these legal bases can be illusory in practice, as data subjects rarely provide truly informed consent,¹⁰³ and service providers can arbitrarily necessitate data sharing in the name of providing services.¹⁰⁴

Furthermore, China’s PIPL is even more stringent when a cross-border transfer involves “important data” (defined as data that may endanger national security or public interest) or pertains to critical information infrastructure operators, such as those in the transportation sector. In these circumstances, any data transfer out of China must undergo a mandatory security assessment that details the recipient, the legality of the transfer, and the safeguards and risks involved.¹⁰⁵ Therefore, the transfer of smart vehicle data out of China is highly likely to be subject to these stringent requirements, providing a clear regulatory model that Southeast Asian countries could adapt for their own national security needs.

Finally, Southeast Asian countries may leverage the Association of Southeast Asian Nations (ASEAN) as a platform to develop a coordinated approach to data localization policy.¹⁰⁶ Through ASEAN, member states can establish regional standards that balance the need for data sovereignty with broader economic integration, ensuring that data localization requirements reflect both regional priorities and legitimate concerns about cross-border data flows.¹⁰⁷ In recent years, ASEAN has increasingly focused on data governance and cross-border data flows, leading to the emergence of important instruments. The adoption of the 2016 ASEAN Framework on Personal Data Protection established guiding principles for member states, while the 2018 ASEAN Framework on Digital Data Governance set forth principles to facilitate cross-border data flows, aiming to maximize the free flow of data within ASEAN while ensuring adequate protection.¹⁰⁸ In 2021, the member states adopted the ASEAN Model Contractual Clauses (MCCs), a voluntary mechanism that businesses can incorporate into binding contracts to govern the transfer of personal data across borders within the region.¹⁰⁹

It is important to note that the MCCs are not a mandatory legal instrument but a recommended guide that businesses are encouraged to follow.¹¹⁰ Beyond simply facilitating the implementation of the MCCs, another area for improvement is the development of a more defined regional standard for data localization. Such a mandate—for example, requiring a local copy of certain data to be maintained—would establish a baseline for data sovereignty. As of 2020, this aspect remained largely unstandardized across the region, with only Indonesia and Vietnam having domestic laws containing such a requirement.¹¹¹ As smart vehicles from third-party countries become more prevalent in ASEAN, member states could leverage the legal mechanisms examined here to develop a unified data governance policy. A coordinated approach would enhance the region’s collective leverage in negotiations, strengthen regulatory standards, and align smart vehicle adoption with broader digital governance objectives, thereby reducing the need for fragmented national policies.

V. Conclusion

The rise of smart vehicles represents not only a technological shift but also a fundamental challenge to data governance. As connected and data-driven automobiles become prevalent, countries without domestic automakers face a difficult balancing act—embracing economic opportunities while safeguarding data privacy and sovereignty. The world’s leading automotive and regulatory powers, the U.S., the EU, and China, have each leveraged their regulatory influence and economic weight to shape data governance frameworks. However, smaller economies, particularly in Southeast Asia, lack the same negotiation power, leaving them more vulnerable to externally imposed data policies attached to foreign smart vehicles. For instance, a major economic power like China has negotiated with leading automakers such as Tesla,¹¹² resulting in Tesla recently becoming the only foreign recipient of China’s “Auto Privacy Protection” mark¹¹³—a privilege that smaller economies cannot easily secure.

Thus, rather than relying on bilateral negotiations with automakers, Southeast Asian countries must explore alternative strategies to strengthen their regulatory position. A regional approach through ASEAN could provide greater collective leverage, allowing member states to set common data governance standards and negotiate with foreign manufacturers as a unified economic bloc. Additionally, adopting a hybrid regulatory model—drawing from the U.S.’s investigative oversight, the EU’s enforcement-driven data protection framework, and China’s selective localization policies—could help balance economic benefits with national security and data sovereignty concerns. As smart vehicles continue to reshape global mobility, Southeast Asia should move beyond passive adoption and actively shape data governance frameworks that serve both economic and regulatory interests.

Attamongkol Tantratian is a Lecturer in Law, at the Faculty of Social Sciences and Humanities, Mahidol University. We would like to thank Uduak Ekott and Che Zhe for their invaluable contributions to the early stages of this project, which resulted in the publication of Uduak Ekott, Zhe Che & Attamongkol Tantratian, Connected Vehicles and Data Privacy & Sovereignty in the Global South, Tech Pol. Press (Oct. 23, 2024), https://www.techpolicy.press/connected-vehicles-and-data-privacy-sovereignty-in-the-global-south.

Gunn Jiravuttipong is a J.S.D. Candidate at the University of California, Berkeley School of Law.