By Nikesh Murali
Australia is investing heavily in the future of transport. Connected vehicles, electric vehicles and emerging autonomous technologies promise safer roads, smarter infrastructure, more efficient transport networks and improved mobility for millions of Australians. Yet while much of the discussion focuses on physical and digital infrastructure, another form of infrastructure will ultimately determine whether these technologies succeed: public trust.
Trust is not often discussed alongside charging networks, telecommunications systems or vehicle-to-everything communications. But if Australians do not have confidence that their data is being handled fairly, securely and transparently, the adoption of connected transport technologies will face significant challenges. As the NRMA’s recent policy paper on secure and connected vehicles argues, strong privacy protections, cyber security standards and consumer rights should not be viewed as obstacles to innovation. They are essential enablers of public trust and long-term success.
Modern vehicles are no longer simply mechanical products. They are increasingly connected to telecommunications networks, cloud services, mobile applications, charging infrastructure and broader digital ecosystems.
Connected vehicles can provide real-time hazard warnings, navigation updates, remote monitoring and automatic emergency assistance after a crash. Governments and researchers can also use appropriately anonymised and aggregated vehicle data to improve transport planning, congestion management and road safety.
However, the same connectivity that creates these benefits also generates vast amounts of information.
Connected vehicles can collect vehicle performance information, location and route history, driving behaviour, event data records, images, audio, in-cabin activity, information from connected devices and, increasingly, biometric information in highly automated vehicles. Different data streams create different privacy, cyber security and access risks, requiring careful management and oversight.
Many motorists still think of their vehicle primarily as a mode of transport rather than as a sophisticated data-generating platform. Yet an expanding ecosystem of manufacturers, service providers, cloud platforms, telecommunications networks, charging providers and digital applications can receive or transmit vehicle-related data. As connectivity expands, so does the importance of governance and accountability.
One of the most striking findings in the NRMA’s member research is the gap between data collection practices and consumer understanding.
The survey found that 69 per cent of members with connected vehicles lack an understanding of how their data is collected and used. More than a quarter reported that they did not read the terms and conditions associated with their vehicle purchase. At the same time, 54 per cent said manufacturer data collection and retention practices would influence their choice of vehicle brand.
This suggests Australians care about privacy but often lack visibility into how connected vehicle ecosystems operate.
The report highlights concerns that privacy disclosures are frequently complex, fragmented, difficult to locate or poorly suited to explaining sophisticated data practices. Connected vehicles may gather information through sensors, cameras, microphones, diagnostics systems, mobile applications and cloud services, while disclosures about these activities can be buried within lengthy terms and conditions.
In Australia, connected vehicle data is largely controlled by manufacturers and service providers rather than vehicle owners. While some brands offer opt-out mechanisms, consumers are often enrolled into connected services automatically and may face practical barriers if they wish to restrict data sharing. The report argues that where consumers cannot distinguish between essential and non-essential data collection, consent is unlikely to be meaningful.
If trust is to be maintained, Australians must understand what is being collected, why it is being collected, how long it is retained and who it may be shared with.
Technology adoption is not determined solely by technical capability. Community confidence matters.
The NRMA survey found that 95 per cent of members identified either remote hacking, unauthorised access or control of vehicles, or the sale and sharing of data without consent as a major concern. 84 per cent said they would be somewhat or very likely to avoid a vehicle brand following a major cyber security incident.
These findings show that cyber security and privacy directly influence consumer behaviour.
As connected vehicle technologies become more sophisticated, the consequences of poor data governance become more significant. The report notes that privacy risks are no longer hypothetical. Connected vehicles may collect information that reveals where people live, work and travel. In some circumstances, connected vehicle data and associated applications have been used to unlawfully track movements, restrict vehicle access and facilitate controlling or abusive behaviour.
Risks can also extend beyond vehicle owners to passengers, pedestrians and vulnerable individuals who may have little visibility into how information about them is collected.
Without strong safeguards, transparency and accountability, public confidence may struggle to keep pace with technological advancement.
One of the strongest themes throughout our report is that privacy and cyber security should not be retrofitted after deployment. They should be built into systems from the outset.
The report advocates privacy-by-design as a baseline requirement for connected vehicle services. Data collection should be proportional and limited to what is reasonably necessary to provide the connected service. Manufacturers and service providers should be required to assess risks, minimise unnecessary collection and embed safeguards throughout the data lifecycle.
Cyber security requires a similarly proactive approach.
Connected vehicles increasingly rely on software, remote updates, wireless connectivity and complex digital supply chains. Potential attack surfaces include communication systems, mobile applications, cloud platforms, infotainment systems, vehicle control systems and charging infrastructure.
International best practice increasingly emphasises secure-by-design principles, lifecycle security management, software verification, supply-chain assurance and continuous monitoring. Security must extend beyond the design phase to include ongoing maintenance, rapid incident response and secure decommissioning at the end of a vehicle’s life.
Our report also argues that strong privacy and cyber protections should not prevent socially beneficial uses of properly anonymised and aggregated data. Data can still support road safety research, infrastructure planning, congestion management and public policy where appropriate safeguards prevent re-identification or misuse.
The goal is not to stop innovation, but to ensure it occurs in a way that earns and maintains public confidence.
As Australia’s transport system becomes increasingly digital, we may need to rethink what constitutes critical infrastructure.
Traditionally, infrastructure has meant roads, bridges, ports and railways. More recently, it has expanded to include charging networks, communications systems and digital platforms. Yet the success of connected transport also depends on public confidence that these systems are secure, transparent and operating in the interests of consumers.
Trust influences whether consumers embrace connected services, feel comfortable sharing information and have confidence in vehicle manufacturers, digital services and emerging autonomous technologies. It also affects whether the benefits of connected transport can be realised at scale.
The NRMA’s recommendations provide a practical roadmap. They include stronger consumer rights over vehicle data, meaningful and transparent consent mechanisms, privacy-by-design requirements, nationally consistent cyber security standards, stronger incident response frameworks and improved consumer education. Taken together, these measures help create a transport system where trust is not assumed, but actively earned.
Australia has a significant opportunity to become a leader in secure, trusted and resilient connected transport systems. But achieving that future will require recognition that public trust is not a by-product of technological progress. It is a prerequisite for it.
To learn more, access the NRMA’s Secure and Connected Vehicles policy paper here.
We’re here to help. If you’d like to learn more about CCAT, explore partnership or membership opportunities, or simply have a question about our work, we’d be happy to hear from you. Reach out to connect with our team and discover how you can be part of shaping the future of transport in Australia and New Zealand.
