Big data analytics for many companies is crucial to identify personal consumption characteristics and increase sales. However, many consumers may oppose such practice since companies can mishandle personal information.
Personal Information Protection Law
The Personal Information Protection Law of the People’s Republic (“PIPL”) takes effect from 1 November 2021 and is the first law to address misuse of personal data. Companies engaged in processing the personal information of individuals located in China are obliged to implement necessary measures.
Below, we highlight the mandatory requirements for foreign companies under the PIPL.
User Consent
Under PIPL, companies may only collect personal information when the individual’s consent is obtained. The consent shall be voluntary and the individual shall be explicitly informed. Individuals can request how their personal information is collected, stored, and require such information to be corrected and deleted.
Companies processing personal information (‘the processors’) are obliged to allow the individual to decline. When users withdraw their consent, the processors shall halt the collection or promptly delete the collected personal information.
Companies outside of China are not exempted from PIPL. Any company outside of China and processing the personal information data of individuals in China can be subject to PIPL. Specifically, PIPL outlines the following circumstances for companies outside of China:
- Where the purpose of the activity is to provide a product or service to an individual located within China;
- Where the purpose of the activity is to analyze or assess the behavior of an individual within China; or
- Any other circumstance as provided by law or administrative regulations.
Practically, companies outside of China should conduct a risk assessment of their personal information database.
Equal Treatment for Consumers
PIPL forbids companies from utilising automated decision-making functions to increase online sales. A company cannot implement unreasonable differential treatment of individuals – such as prices or terms. In other words, special discounts for new customers cannot be utilised, without reasonable grounds. Individuals shall also have the option to withdraw from any push marketing based on automated decision-making.
Stricter Stance to Sensitive Personal Information
The PIPL classifies the following as sensitive personal information and companies may only process such data for a specified purpose.
- Religious beliefs;
- Biometrics;
- Specific identities, medical and health;
- Financial accounts, whereabouts and other information of a natural person;
- Personal information of minors under the age of fourteen
Companies shall adopt strict measures to protect such data and inform the individual of the necessity and the impact on their rights and interests. For personal information of a minor under the age of fourteen, processors shall obtain the consent of a parent or guardian of the minor.
The stricter stance towards data collection of sensitive personal information significantly affects human resources and educators (minors under the age of fourteen). We advise such departments to align data management policies under the PIPL provisions, without any further delay.
Cross-border Data Transfers
Under PIPL, companies may only transfer personal information outside of mainland China by meeting one of the following conditions:
- Where a security assessment organised by the national cyberspace authority has been passed;
- Where a certification of personal information protection has been provided by a professional institution, under the regulations of the national cyberspace authority;
- Where a contract in compliance with the standard contract provided by the national cyberspace authority has been concluded with the overseas recipient, establishing the rights and obligations of both parties; or
- Where any other condition prescribed by law, administrative regulations, or the national cyberspace authority are met.
For companies, especially multinationals working with the personal information of employees and suppliers located in China, implementing the provisions to transfer personal information is essential to avoid penalties.
PIPL shall significantly affect businesses processing the personal information of individuals located in mainland China. Particularly, PIPL stipulates specific rights of individuals in activities related to the processing of personal information, including the right to access and make copies of the personal information processed.
Violators can face fines up to RMB 50 million (US$7,74 million), or up to five percent of annual turnover. Violators located outside of mainland China may be included in a blacklist and publicly announced.
Therefore, we recommend companies doing business in or with China to conduct a data mapping assessment including a thorough review to identify which data is collected, stored, process, and employee access to such data. Data management policies should be revised and relevant training provided to employees, so that PIPL is correctly implemented into the company.
Contact Us
If you are looking for professionals to evaluate whether your data management is compliant with the PIPL and the Data Security Law, please contact Horizons at country.partners@horizons-advisory.com and our Partner in charge will be in touch.