China Data Protection Legislation in the Making: Implications Beyond China’s Borders
Privacy In Focus®
China has proposed a Personal Information Protection Law (PIPL) that establishes a comprehensive data protection structure for the collection, use, and disclosure of the personal information of individuals located in China. The proposed law tracks closely to the protections and obligations set out in the European Union’s General Data Protection Regulation (GDPR), including its extra-territorial reach. The public comment period on the second version of the draft law closed on May 21, 2021.
Five key elements of the proposed law are summarized below. For a deeper review and analysis of the proposed law, please click the "Listen on-demand" link below to hear an informative webinar, with special guest Jingyuan Shi, a partner with Simmons & Simmons, on the proposed PIPL.
*This link will bring you to a registration page. Once registered, you should expect to receive an automatic confirmation email from ON24 with a playback link of the webinar.
Draft PIPL – 5 Key Elements
Scope and Data Protection Principles: The draft PIPL has extra-territorial reach. It can apply to entities located outside of China if they are processing the personal information of individuals located in China for the purpose of providing products or services or analyzing or profiling the behavior of individuals located in China. The draft PIPL sets out seven data protection principles that will govern the processing of personal information. These include legality, explicit purpose, minimum necessary, transparency, accuracy, accountability, and data security.
Consumer Rights: The draft PIPL provides consumers with a host of rights. These include (i) the right to know, (ii) the right to decide on and limit or object to the processing of their personal information, (iii) the right to access, (iv) the right to a copy of their information, (v) the right of correction, and (vi) in limited circumstances, the right of deletion. Additionally, a consumer has the right to withdraw previously granted consent to process personal information.
Legal Basis to Process Personal Information: A covered entity must have a legal basis to process the personal information of an individual. The contemplated legal bases include consent, executing or performing a contract, performing a legal obligation or duty, responding to a public health event or protecting the safety of an individual’s life or property, or publication of news and supervision of public opinion for the public interest (within reasonable scope).
Processors and Sub-Processors: If the processing of personal information is delegated to a third-party, the parties must have an agreement that stipulates the purpose of the processing, the types of information being processed, protection measures, and allocation of liability. Upon conclusion of the processing, the information must be returned or deleted.
Cross-Border Data Transfer: The draft law provides three mechanisms for cross-border data transfer. These methods are (i) the use of a cross-border transfer agreement that ensures the transfer/processing provide equivalent safeguards to the PIPL, (ii) the transfer is certified by a recognized institution, or (iii) when the processor is a critical information infrastructure operator or the volume of the data exceeds a certain level, the transfer must be approved by the regulatory agency.
While the law is not yet final, once adopted, it is expected to have a significant impact on how the personal information of Chinese residents is collected, used, and shared. If you do business in China, we recommend that you track this law closely.
© 2021 Wiley Rein LLP
