The Personal Information Protection Law of the People's Republic of China (Chinese: 中华人民共和国个人信息保护法; pinyin: Zhōnghuá rénmín gònghéguó gèrén xìnxī bǎohù fǎ) referred to as the Personal Information Protection Law or ("PIPL") protecting personal information rights and interests, standardize personal information handling activities, and promote the rational use of personal information. It also addresses the transfer of personal data outside China.
The PIPL was adopted on August 20, 2021, and is effective November 1, 2021. It is related to, and builds on top of both China's Cybersecurity Law ("CSL") and China's Data Security Law ("DSL").
A reference English version was published on December 29, 2021.
History On August 20, 2021, the Standing Committee of the 13th National People's Congress passed the Private Information Protection Law or ("PIPL"). The law, which took effect on November 1, 2021, applies to the activities of handling the personal information of natural persons within the borders of the China.
In comparison to countries in the West, China has developed its privacy laws over time at a slower pace. In recent years, though, China has more actively developed regulations, as the nation is considered a "global cyberforce." China's policies differ from Western nations, in that their perception of privacy is different due to historical and cultural reasons.
During the drafting process, the European Union's General Data Protection Regulation ("GDPR") was used as a model and in some areas, PIPL closely tracks the GDPR.
Provisions
Scope The PIPL generally covers all organizations operating in China processing personal information.
Long-arm jurisdiction Some provisions also include long-arm jurisdiction over data collection and processes of organizations outside China. These apply when:
The purpose is to provide products or services to natural persons inside the borders; Analyzing or assessing activities of natural persons inside the borders; Other circumstances provided in laws or administrative regulations.
This presumably applies to offshore or multi-national companies with Chinese customers in China, for example Amazon who might be shipping goods to a Chinese buyer, or Apple who may have Chinese users in the American App Store.
All such entities are required to establish a dedicated entity or appoint a representative within China.
Exemptions There are few exemptions, but one that was added during late drafting provides a non-consent legal basis for handling employee data, though employee consent is still needed for overseas transfer, such as to a global corporate parent.
Key themes Individual privacy, control and consent are consistent themes throughout the law, which lays down key principles including:
Personal Information – Defining personal information, including sensitive information; Legal Basis – All data collection must have a legal basis for collection. There are several bases, but unlike in the GDPR, there is no legitimate interests basis; Consent – A key legal basis is consent, which, unlike in the GDPR, must be obtained for each type of data processing activity, especially for transferring an individual's data overseas. Consent must also be "informed" with various types of notification and required content specified in the law; Sensitive Data – Some types of personal information is sensitive, and the law provides an open-ended list of examples (unlike the GDPR's specific list of "special categories"), including biometrics, religion, specially designated status, medical health, financial accounts, and location tracking; Protecting Children – All personal information of minors under the age of 14 is sensitive, and specific consent is required from parents to process this information. This is much stricter than in the GDPR; Individual Rights – The PIPL gives individuals several key rights over their information, such as the right to correct, delete, and view or transfer the data collected about them. Responsibilities – Several articles lay out the various responsibilities of various parties collecting, transferring, and handling personal information; Government Use of Personal Information – The PIPL includes when and how government agencies can collect and process data on individuals, including for national security, emergency, and other purposes; Overseas Transfers – Specific restrictions on transfer of personal data outside China; Enforcement – Severe penalties for violations.
Definitions The law defines the following:
Personal Information – Any type of information that identifies or can identify natural persons recorded electronically or by other means, but does not include anonymized information. Sensitive Personal Information – Personal information that once leaked or illegally used can easily cause natural persons to suffer encroachments on their dignity or harms to their persons or property; including information such as biometrics (including facial recognition), religious faith, particular identities, medical care and health, financial status, and location tracking, as well as the personal information of minors under the age of 14.
Individuals – People whose data is being collected for processed (similar to the GDPR's Data Subject). Personal Information Handlers: – Organizations or individuals that independently make decisions about the purposes and methods of personal information handling in personal information handling activities. Entrusted Persons – External entities who Information Handlers entrust to handle personal information, essentially third parties. Large Processors – Companies that process large amounts of data, as defined in Article 40, including Critical Information Infrastructure Operators ("CIIO") from the China's Critical Infrastructure Regulations. Handling of Personal Information: Personal information handling includes personal information collection, storage, use, processing, transmission, provision, disclosure, deletion, etc. Automated Decision-Making: The use of computer programs to automatically analyse, evaluate, and make decisions on personal information on personal behavior habits, hobbies or economic, health, credit status, and so forth. De-Identification: The process of handling personal information to make it impossible to identify a specific natural person without the help of additional information. Anonymization: The process in which personal information is handled so that it cannot be used to identify a specific natural person and cannot be restored after being so handled.
Legal basis All personal information collection and processing must have one of the following legal bases:
Individuals' consent obtained; Where necessary to conclude or fulfill a contract in which the individual is an interested party, or where necessary to conduct human resources management according to lawfully formulated labor rules and structures and lawfully concluded collective contracts; Where necessary to fulfill statutory duties and responsibilities or statutory obligations; Where necessary to respond to sudden public health incidents or protect natural persons' lives and health, or the security of their property, under emergency conditions; Handling personal information within a reasonable scope to implement news reporting, public opinion supervision, and other such activities for the public interest; When handling personal information disclosed by persons themselves or otherwise already lawfully disclosed, within a reasonable scope in accordance with the provisions of this Law. Other circumstances provided in laws and administrative regulations.
Unlike in the GDPR, there is no legitimate interests basis. Therefore, most consumers will likely be covered by giving their direct consent (such as for cookies, newsletters, etc.) or by contract fulfillment (such as shipping goods to them or providing services).
Consent Consent is a major concern of the PIPL and a key legal basis on which handlers can process personal information.
If there is no other legal basis for processing data, handlers must get consent for data collection and processing, and this consent can be revoked by any individual at any time. Handlers are not allowed to refuse to provide products or services if an individual withholds or withdraws their consent for non-essential processing.
Separate consent is also specifically required in a number of situations:
Transfer of personal data by data controllers to third parties (Article 23); Publication of personal data (Article 25); Publication or provision of personal data collected by equipment installed in the public places for security purposes, such as personal images (Article 26); Processing of sensitive personal data (Article 29); and Cross-border transfers of personal data (Article 39).
Consent for these situations cannot be "bundled" and thus must be obtained separately from the individual.
Where a change occurs in the purpose of personal information handling, the handling method, or the categories of handled personal information, the individual's consent shall be obtained again.
Individual rights Individuals have several specific rights under the PIPL – they can:
Know & Decide - Refuse and limit how their data is handled. Access & Copy – View and copy their data. Correct or Complete – Request to correct inaccurate data. Erasure – Request their information be deleted and/or revoke consent. Explanation – Request handlers explain their handling of an individual's personal information. Portability – Request moving their data to another handler.
Automated decision making There are specific rules for automated decision making in the PIPL, including the right of individuals to opt-out, such as disabling product recommendations.
The law specifically requires "transparency of the decision-making and the fairness and justice of the handling result shall be guaranteed, and they may not engage in unreasonable differential treatment of individuals in trading conditions such as trade price, etc."
For companies pushing delivery or commercial sales to individuals through automated decision-making methods shall simultaneously provide the option to not target an individual's characteristics, or provide the individual with a convenient method to refuse.
When the use of automated decision-making produces decisions with a major influence on the rights and interests of the individual, they have the right to require personal information handlers to explain the matter, and they have the right to refuse that personal information handlers make decisions solely through automated decision-making methods.
Automated Decision Making is defined as "refers to the activity of using computer programs to automatically analyze or assess personal behaviors, habits, interests, or hobbies, or financial, health, credit, or other status, and make decisions."
Facial recognition The PIPL specifically covers the use of facial recognition in public spaces, including that it can only be used for public security reasons unless each individual separately consents:
"The installation of image collection or personal identity recognition equipment in public venues shall occur as required to safeguard public security and observe relevant State regulations, and clear indicating signs shall be installed. Collected personal images and personal distinguishing identity characteristic information can only be used for the purpose of safeguarding public security; it may not be used for other purposes, except where individuals' separate consent is obtained."
Handler obligations Personal information handlers have several specific obligations:
Formulating internal management structures and operating rules; Implementing categorized management of personal information; Adopting corresponding technical security measures such as encryption, de-identification, etc.;