China

What is the PIPL?

The Personal Information Protection Law of the People's Republic of China (Chinese: 中华人民共和国个人信息保护法; pinyin: Zhōnghuá rénmín gònghéguó gèrén xìnxī bǎohù fǎ), referred to as the Personal Information Protection Law or ("PIPL"), aims to protect personal information rights and interests, standardize personal information handling activities, and promote the rational use of personal information. It also specifically addresses the transfer of personal data outside China.

The PIPL was adopted on August 20, 2021, and is effective November 1, 2021. It is related to, and builds on top of both China's Cybersecurity Law ("CSL") and China's Data Security Law ("DSL"). A reference English version was published on December 29, 2021.

History and Background

On August 20, 2021, the Standing Committee of the 13th National People's Congress passed the Personal Information Protection Law. The law applies to the activities of handling the personal information of natural persons within the borders of China.

In comparison to countries in the West, China has developed its privacy laws over time at a slower pace. In recent years, though, China has more actively developed regulations, as the nation is considered a "global cyberforce." China's policies differ from Western nations in that their perception of privacy is different due to historical and cultural reasons. During the drafting process, the European Union's General Data Protection Regulation ("GDPR") was used as a model, and in some areas, PIPL closely tracks the GDPR.

Scope and Jurisdiction

The PIPL generally covers all organizations operating in China processing personal information.

Long-arm Jurisdiction

Some provisions also include long-arm jurisdiction over data collection and processes of organizations outside China. These apply when:

• The purpose is to provide products or services to natural persons inside the borders;
• Analyzing or assessing activities of natural persons inside the borders;
• Other circumstances provided in laws or administrative regulations.

This presumably applies to offshore or multi-national companies with Chinese customers in China, for example, Amazon who might be shipping goods to a Chinese buyer, or Apple who may have Chinese users in the American App Store. All such entities are required to establish a dedicated entity or appoint a representative within China.

Exemptions

There are few exemptions, but one that was added during late drafting provides a non-consent legal basis for handling employee data, though employee consent is still needed for overseas transfer, such as to a global corporate parent.

Key Themes and Definitions

Individual privacy, control, and consent are consistent themes throughout the law. The law defines several key terms:

• Personal Information: Any type of information that identifies or can identify natural persons recorded electronically or by other means, but does not include anonymized information.
• Sensitive Personal Information: Personal information that once leaked or illegally used can easily cause natural persons to suffer encroachments on their dignity or harms to their persons or property. This includes biometrics (including facial recognition), religious faith, particular identities, medical care and health, financial status, location tracking, and the personal information of minors under the age of 14.
• Individuals: People whose data is being collected or processed (similar to the GDPR's Data Subject).
• Personal Information Handlers: Organizations or individuals that independently make decisions about the purposes and methods of personal information handling.
• Entrusted Persons: External entities who Information Handlers entrust to handle personal information (third parties).
• Large Processors: Companies that process large amounts of data, as defined in Article 40, including Critical Information Infrastructure Operators ("CIIO").
• Handling of Personal Information: Includes personal information collection, storage, use, processing, transmission, provision, disclosure, deletion, etc.
• Automated Decision-Making: The use of computer programs to automatically analyze, evaluate, and make decisions on personal information on personal behavior habits, hobbies, or economic, health, credit status, and so forth.
• De-Identification: The process of handling personal information to make it impossible to identify a specific natural person without the help of additional information.
• Anonymization: The process in which personal information is handled so that it cannot be used to identify a specific natural person and cannot be restored after being so handled.

Legal Basis for Processing

All personal information collection and processing must have one of the following legal bases:

• Individuals' consent obtained;
• Where necessary to conclude or fulfill a contract in which the individual is an interested party, or where necessary to conduct human resources management according to lawfully formulated labor rules and structures and lawfully concluded collective contracts;
• Where necessary to fulfill statutory duties and responsibilities or statutory obligations;
• Where necessary to respond to sudden public health incidents or protect natural persons' lives and health, or the security of their property, under emergency conditions;
• Handling personal information within a reasonable scope to implement news reporting, public opinion supervision, and other such activities for the public interest;
• When handling personal information disclosed by persons themselves or otherwise already lawfully disclosed, within a reasonable scope in accordance with the provisions of this Law;
• Other circumstances provided in laws and administrative regulations.

Unlike in the GDPR, there is no legitimate interests basis. Therefore, most consumers will likely be covered by giving their direct consent (such as for cookies, newsletters, etc.) or by contract fulfillment (such as shipping goods to them or providing services).

Consent Requirements

Consent is a major concern of the PIPL and a key legal basis on which handlers can process personal information. If there is no other legal basis for processing data, handlers must get consent for data collection and processing, and this consent can be revoked by any individual at any time. Handlers are not allowed to refuse to provide products or services if an individual withholds or withdraws their consent for non-essential processing.

Separate consent is specifically required in a number of situations:

• Transfer of personal data by data controllers to third parties (Article 23);
• Publication of personal data (Article 25);
• Publication or provision of personal data collected by equipment installed in public places for security purposes, such as personal images (Article 26);
• Processing of sensitive personal data (Article 29); and
• Cross-border transfers of personal data (Article 39).

Consent for these situations cannot be "bundled" and must be obtained separately. Where a change occurs in the purpose of personal information handling, the handling method, or the categories of handled personal information, the individual's consent shall be obtained again.

Individual Rights

Individuals have several specific rights under the PIPL – they can:

• Know & Decide: Refuse and limit how their data is handled.
• Access & Copy: View and copy their data.
• Correct or Complete: Request to correct inaccurate data.
• Erasure: Request their information be deleted and/or revoke consent.
• Explanation: Request handlers explain their handling of an individual's personal information.
• Portability: Request moving their data to another handler.

Automated Decision Making and Facial Recognition

There are specific rules for automated decision making in the PIPL, including the right of individuals to opt-out, such as disabling product recommendations. The law specifically requires "transparency of the decision-making and the fairness and justice of the handling result shall be guaranteed, and they may not engage in unreasonable differential treatment of individuals in trading conditions."

Companies pushing delivery or commercial sales to individuals through automated decision-making methods shall simultaneously provide the option to not target an individual's characteristics, or provide the individual with a convenient method to refuse.

Facial recognition: The PIPL specifically covers the use of facial recognition in public spaces, including that it can only be used for public security reasons unless each individual separately consents. The installation of image collection or personal identity recognition equipment in public venues shall occur as required to safeguard public security and observe relevant State regulations, with clear indicating signs installed.

Handler Obligations & Impact Assessments

Personal information handlers have several specific obligations, including formulating internal management structures, implementing categorized management of personal information, adopting technical security measures (encryption, de-identification), determining operational limits, conducting security training, and formulating incident response plans. All handlers must "regularly engage in audits of their personal information handling and compliance."

Under certain circumstances (handling sensitive data, automated decision-making, providing data abroad, etc.), handlers must perform a personal information protection impact assessment. These assessments must include whether the handling purpose is lawful and necessary, the influence on individuals' rights and risks, and whether protective measures are effective.

Data Localisation and Security

The PIPL has specific requirements on data localization, the storage and processing of personal information in China. Information handlers must take measures to ensure personal information handling conforms to provisions and prevents unauthorized access, leaks, distortion, or loss. Agreements are required when a handler entrusts personal data handling to another handler.

Breach Notification

All data leaks must be reported internally, and if "harm may have been created," they may be required to notify the individuals affected. Notification details must include:

• The information categories, causes, and possible harm caused by the leak, distortion, or loss that occurred or might have occurred;
• The remedial measures taken by the personal information handler and measures individuals can adopt to mitigate harm;
• Contact method of the personal information handler.

Large Handlers

Large-scale handlers, such as those "providing important Internet platform services, that have a large number of users, and whose business models are complex," also have specific obligations:

• Establish and complete personal information protection compliance systems and structures according to State regulations, and establish an independent body composed mainly of outside members to supervise personal information protection circumstances;
• Abide by the principles of openness, fairness, and justice; formulate platform rules; and clarify the standards for intra-platform product or service providers;
• Stop providing services to product or service providers on the platform that seriously violate laws or administrative regulations;
• Regularly release personal information protection social responsibility reports, and accept society's supervision.

Overseas Transfers

Moving personal information outside China is only allowed if one of these conditions is satisfied:

• Passing a security assessment organized by the State cybersecurity and information department according to Article 40 of this Law;
• Undergoing personal information protection certification conducted by a specialized body;
• Concluding a contract with the foreign receiving side in accordance with a standard contract formulated by the State cyberspace and information department;
• Other conditions provided in laws and administrative regulations.

All such transfers require each individual's separate consent and notification about "the foreign receiving side's name, contact method, handling purpose, handling methods, and personal information categories."

In March 2024, the Provisions on Promoting and Regulating Cross-Border Data Flows became effective. These provisions aim to integrate obligations across the Cybersecurity Law, Data Security Law, and PIPL, and require a CAC-led review of data exports across China's borders in certain circumstances.

Sharing Data with Foreign Governments

Information handlers are prohibited from sharing any personal information with foreign judicial or law enforcement agencies without approval. This has raised concerns among law firms about how multi-national corporations would respond to judicial inquiries in other countries.

Government Departments (State Organs)

The PIPL includes a legal basis for how government ("State Organs") can collect and process data. Generally, the government must follow the same rules as non-government entities, including notifications. There are some exceptions, such as when notification "shall impede State organs' fulfillment of their statutory duties and responsibilities."