Re-Examining Compliance Risks in Surveying and Mapping for ICVs

On October 16, 2024, the official WeChat account of the Ministry of State Security ("MSS") published an article titled The Secret Mapping and the Hidden Leaks[1]. This article attracted widespread social attention, especially in the automotive industry.

Geographic information of surveying and mapping is closely related to national security, and it is a key area under legal regulation in China. Raw surveying and mapping geographic information data, such as precise measurements of military bases and key locations, poses the risk of being used by foreign parties to mark critical national areas. According to Chinese law, entities engaged in surveying and mapping must obtain specific surveying and mapping qualifications, and the handling of surveying and mapping data is subject to strict confidentiality and security compliance obligations. Since intelligent connected vehicles ("ICVs") heavily rely on real-time high-precision coordinates and high-definition imagery data during testing, operation and service, which may involve the collection, storage, transmission and processing of geographic information related to road infrastructure, spatial locations and specific regions, they are also subject to strict regulations regarding Geographic information of surveying and mapping.

Under this background, this article aims to review Chinese legal requirements related to surveying and mapping, the determination of ICV surveying and mapping activities, compliance risks as well as the consequences of non-compliance (including criminal liabilities). It also offers relevant compliance recommendations to help companies in the ICV industry—including ICV manufacturers, autonomous driving system developers, and ICV hardware and software producers—conduct testing and development, operate and provide services in compliance with the law, avoiding violation of laws and regulations or even hitting the national security red lines.

1.General Requirements for the Surveying and Mapping Field

The general regulations in the Chinese surveying and mapping field encompass the following aspects:

（1）Basic Definition of Mapping

According to the Surveying and Mapping Law of the People's Republic of China (referred to as the "Surveying and Mapping Law"), surveying and mapping refers to "the activities of measuring, collecting and representing natural geographic features or man-made structures on the Earth's surface, including their shape, size, spatial location and attributes, as well as processing and providing the data, information and results obtained"[2].

（2）Qualification Requirements for Mapping Activities

China implements an administrative licensing system for entities engaging in surveying and mapping activities. Any entity conducting surveying and mapping in China must obtain the corresponding surveying and mapping qualifications or entrust a qualified entity to perform such activities.

2.Surveying and Mapping Provisions Related to ICVs

（1）Determination of Surveying and Mapping Activities in the ICV Industry

On August 25, 2022, the Ministry of Natural Resources ("MNR") issued the Notice on Promoting the Development of Intelligent Connected Vehicles and Maintaining the Security of Surveying and Mapping Geographic Information (MNR Reg. [2022] No. 1) (referred to as the "MNR 2022 No. 1 Notice"), which provided a clearer definition of ICV surveying and mapping activities. 

Before this notice, whether R&D and testing activities related to ICVs constituted surveying and mapping primarily depended on the interpretation of the definition of "surveying and mapping" in Article 2 of the Surveying and Mapping Law, as well as on regulatory documents and consultations with the natural resources authorities on a case-by-case basis.

Further clarification was provided by the MNR on July 26, 2024, with the issuance of the Notice on Strengthening the Administration of Surveying and Mapping Geographic Information Security of Intelligent Connected Vehicles (MNR Reg. [2024] No. 139) (referred to as the "MNR 2024 No. 139 Notice"), which further defined the determination and compliance requirements for surveying and mapping activities in the ICV industry.

（2）Surveying and Mapping Qualifications for Navigation Electronic Maps

The Measures on Surveying and Mapping Qualifications and the Classification Standards on Surveying and Mapping Qualifications, revised by the MNR and effect on July 1, 2021, reduced the levels of surveying and mapping qualifications from four to two (Class A and Class B), with significant integration. For the production of navigation electronic maps closely related to ICVs, a Class B qualification was added. Class A surveying and mapping qualifications are still approved by the MNR, while Class B qualifications are handled by provincial-level natural resources authorities.

Class A surveying and mapping qualifications for navigation electronic maps have no geographic limitations, but Class B qualifications are limited to the designated autonomous driving areas defined by government authorities. Evidently, Class A qualifications hold higher value, and about 19 map providers currently hold Class A surveying and mapping qualifications for navigation electronic maps.

3.Surveying and Mapping Provisions Related to State Secrets

（1）Classification and Scope of State Secrets in Surveying and Mapping Geographic Information

According to the Provisions on the Scope of State Secrets in the Administration of Surveying and Mapping Geographic Information and the Catalogue of State Secrets in Administration of Surveying and Mapping Geographic information (referred to as the "2020 Catalogue of State Secrets in Surveying and Mapping Geographic Information") jointly revised by the MNR and the National Administration of Secrets Protection and effective as of July 1, 2020, surveying and mapping geographic information secrets are classified into top secret, confidential, and secret levels.

Among them, state secrets include "actual field measurement results of three-dimensional model, point cloud, oblique image, digital measurable image, navigation electronic map, etc. outside military prohibited zones with a continuous coverage exceeding 25 square kilometers, and with a plane accuracy of 10 meters or better or a terrain height relative accuracy of 5% or better", "point names and coordinates relating to military and national security authorities; point coordinates and name attributes of important national economic facilities in connection with military and national security with accuracy of ± 10 meters or better" and others. Except for specific surveying and mapping results that are known to the custodian unit and users, they shall not be disclosed to the public or transferred abroad without authorization.

（2）Use of Confidential Surveying and Mapping Results

In 2016, the National Administration of Surveying and Mapping issued the Notice on Strengthening the Administration of the Making, Testing, and Application regarding Maps for Autonomous Driving, which stated that maps used in autonomous driving trials and road tests should be treated as confidential surveying and mapping results (referred to the surveying and mapping results involving state secrets) and that effective measures must be taken to ensure data security. The map data shall not be provided to foreign organizations, individuals or foreign-invested enterprises without approval.

Additionally, the Measures for the Administration of Providing Confidential Surveying and Mapping Results to Foreign Parties issued by the MNR on July 26, 2024, further emphasized that confidential surveying and mapping results, as specified in the 2020 Catalogue of State Secrets of Surveying and Mapping Geographic Information, are subject to a tiered approval system when providing to foreign parties.

（3）Confidential Handling of Navigation Electronic Maps

According to the Public Map Content Presentation Specification, revised by the MNR and effective on February 6, 2023, and the Basic Requirements for Security Processes Technology for Electronic Navigation Maps (GB 20263-2006), navigation electronic maps containing surveying and mapping results involving state secrets must undergo technical processing to handle spatial locations before they are sold, distributed, displayed or used publicly[3].

4.Special Restrictions on Foreign Organizations, Individuals and Foreign-Invested Enterprises in the Surveying and Mapping Field

The Provisional Measures for the Administration of Surveying and Mapping in China Conducted by Foreign Organizations or Individuals stipulates that foreign organizations or individuals must establish joint ventures or partnerships with Chinese departments or entities to conduct surveying and mapping activities within China. For one-time surveying and mapping activities, the foreign entity may be exempt from setting up a joint venture but must still obtain approval from the MNR in conjunction with military surveying and mapping authorities and carry out the activities jointly with surveying and mapping personnel from relevant Chinese departments or entities. It also stipulates that parties engaging in surveying and mapping activities through joint ventures and cooperation shall not engage in activities such as navigation electronic map production, geodetic surveying, oceanographic surveying, aerial surveying, mapping and photography, and administrative boundary surveying and mapping. 

The Special Administrative Measures (Negative List) for Foreign Investment Access (Edition 2024) explicitly prohibits foreign investment in navigation electronic map production, geodetic surveying, oceanographic surveying, aerial surveying, mapping and photography, ground mobile surveying, and the surveying and mapping of administrative boundaries.

1.Determination of the Act of Surveying and Mapping

According to the MNR 2022 No. 1 Notice, the act of collecting, storing, transmitting and processing geographic information data—including spatial coordinates, images, point clouds, and their attributes—relating to vehicles and surrounding road infrastructure, during the operation, service, or road testing of ICVs equipped with satellite navigation receivers, inertial measurement units, cameras, LiDAR or other sensors, constitutes "surveying and mapping activities" as defined under the Surveying and Mapping Law[4].

The MNR 2024 No. 139 Notice further clarified that the act of collecting, storing, transmitting and processing geographic information data—such as spatial coordinates, real-scene imagery (video and other environmental sensing data), point clouds, and their attributes, including road topology data—related to vehicles and surrounding road infrastructure, during the operation, service, or road testing of ICVs, constitutes "surveying and mapping activities" as defined under the Surveying and Mapping Law[5].

The MNR 2022 No. 1 Notice also clarifies that activities related to the manufacture, integration and sale of in-vehicle sensors and ICVs do not constitute the act of surveying and mapping.

2.Subject of Surveying and Mapping Activities

According to the MNR 2022 No. 1 Notice, an entity collecting, storing, transmitting and processing geographic information data, such as spatial coordinates, imagery, and point clouds, during the operation, service and road testing of ICVs is the subject of the surveying and mapping activities. The notice also points out that in the current market, entities collecting, storing, transmitting and processing such data are typically automakers, service providers and some intelligent driving software providers. However, drivers or passengers of ICVs receiving services like advanced driver assistance are not considered subjects of surveying and mapping activities.

3.Requirements for Managing Surveying and Mapping-Related Activities

The MNR 2024 No. 139 Notice specifies that base maps, advanced driver assistance maps, high-accuracy maps, and autonomous driving maps used by ICVs fall under the category of navigation electronic maps. The collection, storage, transmission, processing and production of geographic information data returned by ICVs should be handled by entities with the surveying and mapping qualifications, such as the navigation electronic map production qualification.

The notice also emphasizes that geographic information data collected by ICVs for navigation-related activities and map production or updating must be directly transmitted to entities with surveying and mapping qualifications for the production of navigation electronic maps. Other entities or individuals are not permitted to access this data.

4.Management of Confidential or Sensitive Geographic Information Data

The MNR 2024 No. 139 Notice also explicitly provides for the strengthened management of actual testing results (e.g. navigation electronic maps, real-scene images, point clouds) that constitute state secrets and of confidential or sensitive geographic information data (including scenario libraries) that is collected, stored, transmitted or processed by ICVs, and unauthorized provision of confidential or sensitive geographic information data is prohibited. Data processed with unapproved geographic information confidentiality processing techniques must not be classified with a lower secrecy level than its original classification.

5.Cross-Border Transfer of Surveying and Mapping Data

The MNR 2022 No. 1 Notice states that if companies that are currently providing ICV after-sales and operational services already transferred or plans to transfer surveying and mapping geographic information data (such as relevant spatial coordinates, imagery, point clouds, and their attributes) overseas, they must strictly comply with national laws and regulations and go through the cross-border provision approval (providing to foreign-invested enterprises may be considered as cross-border provision ) or the map review procedures, etc. Until such procedures are completed, cross-border transfer must be suspended.

With regard to the "the cross-border provision approval or the map review procedures, etc." mentioned in the notice, we understand that if the data involves confidential surveying and mapping results, it must follow the procedures outlined in the Promulgation of the Measures for the Administration of Providing Classified Surveying and Mapping Results to Foreign Parties. For the data involving non-secret surveying and mapping results, it should follow the map review procedures.

The MNR 2024 No. 139 Notice clearly requires that geographic information data must be stored domestically, and that storage devices, networks, cloud services and others that are used must meet the security and confidentiality requirements set by the state. Entities applying to provide geographic information data to overseas parties must strictly fulfill the cross-border provision approval or the map review procedures, and relevant provisions such as the security assessment of cross-border data transfer must be implemented.

6.Obtaining Surveying and Mapping Qualifications or Entrusting a Qualified Map Provider

The MNR 2022 No. 1 Notice stipulates that companies involved in data collection, storage, transmission and processing—including automakers, service providers and autonomous driving software developers—should obtain necessary surveying and mapping qualifications if they are domestic companies, or they should entrust a qualified entity to carry out these activities. Foreign-invested companies must entrust a qualified entity to handle corresponding surveying and mapping tasks, such as collecting, storing, transmitting and processing relevant spatial coordinates, imagery, point clouds, and their attributes, etc. and providing geographic information services and support.

According to the Special Administrative Measures (Negative List) for Foreign Investment Access (Edition 2024), ground mobile surveying and navigation electronic map production are prohibited areas for foreign investment. Domestic companies that have obtained qualifications in these professional categories must strictly comply with national regulations.

In practice, many companies have questions on which qualification to apply for or which qualified map providers to entrust. While relevant documents do not specify this in detail, current understanding suggests that with respect to products such as navigation electronic map with certain secrecy level formed through aggregation, integration or processing of large-scale spatial and temporal data collected by ICVs, declassification and desensitization of relevant data shall be handled by entities with surveying and mapping qualifications for navigation electronic map production, and depending on the scope of data required, companies can choose either Class A or Class B qualified entities accordingly.

1.Administrative Liabilities

According to the Surveying and Mapping Law, if any foreign organization or individual, without approval, engages in surveying and mapping activities, the organization or individual shall be ordered to desist from the violation, and the unlawful gains, surveying and mapping results and tools of the organization/individual shall be confiscated. The organization/individual shall be fined not less than 100,000 yuan but not more than 500,000 yuan; if the circumstances are serious, it shall be fined not less than 500,000 yuan but not more than one million yuan and shall be ordered to leave the country within a specified time limit or expelled from the country[6].

Acquisition, possession, provision or making use of the geographic information that constitutes state secrets in violation of the Surveying and Mapping Law will result in warnings, being ordered to desist from illegal activities, confiscation of illegal gains, and fines of up to two times the illegal gains. The person directly in charge and other persons directly liable will also face sanctions. If damages are caused, the violator must compensate for the losses[7].

According to the Surveying and Mapping Law, entities leaking state secrets will face administrative penalties such as suspension of operations for rectification, as well as downgrading of surveying and mapping qualifications or revocation of surveying and mapping qualification certificates[8].

Under the Guarding State Secrets Law, if government agencies or entities violate this law by causing major cases of leaking state secrets, sanctions will be imposed against the person directly in charge and other persons directly liable therefor. Enterprises and institutions with secrecy qualifications that violate national secrecy laws or regulations will be ordered to rectify the situation by the state secrecy administrative authorities and will receive warnings or public criticism, and any illegal gains will be confiscated. In serious cases, they may face suspension of secret-related business operations, downgrading of qualifications. Where the circumstances are extremely serious, the secrecy qualifications of such enterprises or institutions shall be revoked[9].

2.Criminal Liabilities

As mentioned earlier, surveying and mapping geographic information or handling secrets-related surveying and mapping results is closely tied to national security and state secrets. Violations of the Surveying and Mapping Law and the Guarding State Secrets Law, if serious, can lead to criminal liabilities.

Illegally providing state secrets to overseas parties may constitute the crime of "stealing, spying, buying or illegally providing state secrets or information for overseas parties"[10]. Based on the secrecy level and the quantity of state secrets illegally provided as well as the degree of damage caused, the following criminal liabilities may apply:

Overseas individuals who steal, spy or buy state secrets may be charged with the crime of "illegally acquiring state secrets", which can result in the sentence of fixed-term imprisonment of up to three years, criminal detention, public surveillance or deprivation of political rights. In serious cases, the fixed-term imprisonment will be more than three years but not more than seven years[15]. 

Additionally, the revised Counterespionage Law enacted on April 26, 2023, updated the definition of espionage activities to include "other documents, data, materials, and items related to national security and interests", placing them under the same protection as "state secrets" and "intelligence". Subject to the provisions of the Criminal Law, relevant violations may also constitute the "crime of espionage", punishable by imprisonment for more than ten years or life imprisonment, together with potential concurrent confiscation of property; in less severe cases, relevant individuals will be sentenced to imprisonment for three to ten years with probable confiscation of property[16]. In addition, if the above-mentioned acts cause exceptionally severe harm to the nation and people, and the circumstances are extremely serious, death sentence may be imposed concurrently with confiscation of property[17].

It is noteworthy that although such crimes that endanger national security are only punishable against natural persons and do not take the form of corporate crimes, this does not mean that when companies, enterprises or other organizations instruct employees to engage in such activities, the management and employees are exempt from criminal liability. The Interpretation of the Standing Committee of the National People's Congress on Article 30 of the Criminal Law of the People's Republic of China by the Standing Committee of the National People's Congress (issued and implemented on April 24, 2014) explicitly states: "When companies, enterprises, public institutions, government agencies or other organizations commit socially harmful acts as stipulated under the Criminal Law, and the specific sections of the Criminal Law or other laws do not provide for criminal liability against the organization, those who organize, plan or carry out such socially harmful activities shall be held criminally liable according to law."

1.For Map Providers with Surveying and Mapping Qualifications for Navigation Electronic Maps

（1）Strengthen Internal Compliance Assessments

Companies are recommended to conduct internal compliance reviews to identify potential compliance risks, especially for matters involving secret-related surveying and mapping results and national security issues, and conduct prompt rectification if needed. Furthermore, it is also advised that companies should strengthen the implementation and development of compliance systems, taking necessary measures to strictly manage the actual testing results (e.g. navigation electronic maps, real-scene images and point clouds) that constitutes state secrets and other geographic information data (including scenario libraries) involving confidential or sensitive content and collected, stored, transmitted or processed by ICVs. Special care must be taken to avoid the unauthorized provision of confidential or sensitive geographic information to any third party.

（2）Strictly Follow Laws and Regulations for Cross-Border Data Transfer

Companies must strictly adhere to the requirements for storing geographic information data domestically, using storage equipment, networks, and cloud services that meet national security and confidentiality standards. Before providing geographic information data overseas, companies must follow the necessary approval procedures and complete data cross-border transfer security assessments as required by law.

（3）Strictly Enforce Measures to Manage the Security and Confidentiality of Surveying and Mapping Geographic Information

Companies should strictly comply with the nationality requirements for  personnel engaging in secret-related surveying and mapping business, and establish and maintain an effective security and confidentiality management system for surveying and mapping geographic information, keeping records of the acquisition, possession, provision and use of geographic information that belongs to state secrets and maintain such records in a long-term for the purpose of traceability. Additionally, companies should establish a security and confidentiality management system for confidential surveying and mapping field activities and ensure that supervisory personnel and confidentiality responsibilities are in place.

2.For Companies in the ICV Industry

（1）Conduct Internal Compliance Assessments

Companies are recommended to conduct internal compliance reviews and carry out a comprehensive compliance assessment of their current ICV-related research and development, testing, operations, and services to determine whether existing business activities involve surveying and mapping-related activities. Foreign-invested enterprises, in particular, should enhance the examination of compliance in their R&D and operational activities concerning ICVs, including whether these activities involve Geographic information of surveying and mapping and whether cross-border data transfer complies with relevant laws and regulations.

（2）Ensure Lawful Operations

If the internal assessment reveals involvement in surveying and mapping activities, corrective measures should be taken immediately. Companies should quickly entrust qualified map providers to handle surveying and mapping activities. For domestic companies involved in ICV development, parts supply or software development, they may choose from applying for necessary qualifications and entrusting a qualified map provider. For foreign-invested companies, considering the restrictions on foreign investment in the field of surveying and mapping, even if they have already entrusted a map provider to carry out relevant surveying and mapping activities, it is recommended to further verify whether there are any compliance flaws or loopholes in the specific implementation process, including whether the entrusted map provider holds the appropriate surveying and mapping qualifications, in order to further minimize the compliance risk.

（3）Improve Internal Compliance Systems and Strengthen National Security Risk Prevention

Companies should further enhance their compliance systems, integrating surveying and mapping-related compliance requirements into their overall compliance frameworks, categorize and grade relevant data accordingly, strengthen the full life-cycle data compliance, and establish emergency response mechanisms to quickly identify and eliminate violations. Additionally, companies should provide internal training on Geographic information of surveying and mapping compliance, raising awareness of national security risks within the companies and ensuring the implementation of relevant policies.

Thanks to Ange Li for the contribution to this English version of the article.

转载声明：好文共赏，如需转载，请直接在公众号后台或下方留言区留言获取授权。