French MEP François Kalfon is asking the European Commission to examine security risks associated with BYD connected cars and consider restrictions covering sensitive infrastructure and public purchasing. His statement, published on 4 November 2026, describes a political request. It does not announce an EU ban on buying, selling or driving the cars.
The distinction matters because the proposed remedies reach different groups. An access rule at a military installation concerns vehicles entering a particular location. Exclusion from procurement concerns public buyers. Import restrictions would have a separate commercial scope. Kalfon advocates all of these approaches, but his announcement does not make any of them an EU-wide rule.
What the French MEP is seeking
Kalfon says he contacted the Commission with eight other MEPs and sent a letter to French Prime Minister Sébastien Lecornu. His concern is that cameras, microphones, GPS and laser sensors could collect sensitive information around military bases and strategic infrastructure. That is the risk argument advanced by the politician; the statement does not publish a technical audit of a named BYD model or software release.
Alongside access restrictions and exclusion from public contracts, he wants BYD classified as a high-risk supplier and calls for limits on European imports. His statement cites legislation under negotiation, including a text he calls Cybersecurity Act 2. Those references should not be mistaken for a completed European designation of BYD under the requested classification.
Public authorities and private owners therefore face different questions. The political initiative does not itself change a tender's eligibility conditions, cancel a vehicle's approval or order owners to disable connected functions. Any such measure would need its own competent decision and a defined scope. Treating a call for an assessment as the assessment's conclusion would skip the central unresolved issue.
BYD's documents describe several separate data flows
BYD's European Data Act notice provides a more detailed account of connected services than a general reference to cameras. It identifies BYD Europe B.V., based in Schiedam in the Netherlands, as the data holder. Its examples include door-lock and window status, tyre pressure, mileage, speed, gear selection, battery temperature and state of charge. The notice qualifies the data categories by the vehicle's actual functionality and service configuration.
Software updates have their own information requirements. BYD lists basic vehicle information, the system version, upgrade logs and the result of an update. Diagnostic information can include vehicle configuration, firmware, energy use and electronic-system status to help identify faults and carry out technical evaluations. These are the categories described by the manufacturer, rather than a finding about unauthorised access.
For the product and related-service data covered by that notice, BYD names Google Cloud storage with a data centre in Paris. That is a specific company disclosure with a defined scope. It should not be expanded into a claim that every service, camera or software component across the brand has been independently checked and found to use an identical architecture.
Local video processing is different from cloud telemetry
On its separate privacy-information page, BYD says cameras inside and outside the vehicle process data locally. It says the panoramic camera does not store captured data and uses real-time road information when the function is in use. The page expressly directs readers to the particular model version and instruction manual for the functions actually supplied.
This does not conflict automatically with the existence of cloud-connected services. A locally processed camera function and a diagnostic upload describe different operations. Neither the presence of sensors nor the existence of a data connection establishes that information has been used for espionage. Conversely, a statement about local camera processing does not establish that the vehicle sends no other information outside the cabin.
BYD also describes using its mobile app to check and close windows, with password confirmation. Connected-car security therefore involves commands coming into the vehicle as well as information leaving it. Evaluating those pathways would require attention to access permissions, authentication and the services involved, rather than drawing a conclusion solely from the country in which a data centre is located.
The owner's questions are more specific than the political slogan
The European Data Protection Board's connected-vehicle guidelines, adopted on 9 March 2021, favour local processing where possible and data collection limited to what is necessary. They also address privacy-protective defaults and users' ability to control processing. These are recommendations for the connected-car sector, not a security finding against BYD.
The guidelines explain why a car's manual, its account settings and its app privacy information need to be read together. A driver should be able to distinguish a camera used for a local manoeuvring function from voice activation or a remote diagnostic service. BYD says its voice assistant remains inactive until triggered by a physical button or a keyword, but the precise functions remain dependent on the model and version.
The Data Act notice gives privacy.eu@byd.com as the contact for access requests concerning product and related-service data held by the company. BYD says the data can be supplied free of charge in a structured, commonly used, machine-readable format. Its notice also describes asking for data to be sent to a third-party recipient and terminating that sharing. These mechanisms concern a user's access to data; they do not settle the separate national-security assessment Kalfon wants the Commission to undertake.
Archive image: BYD Seal, 14 July 2024. Photograph by Calreyn88, Wikimedia Commons. Resized and converted to WebP; the adapted image remains under CC BY-SA 4.0. It does not depict an identified security incident.
