China Data Protection Law: What You Need to Know

China Enacts New Personal Data Protection Law

A new personal data protection law has been approved in China, as reported by Xinhua, the state news agency, through Reuters.

Officially named the Personal Information Protection Law (PIPL), the legislation is scheduled to become effective on November 1st.

Restrictions on Data Collection

This law was initially proposed last year, indicating a commitment from China’s leadership to address concerns regarding data collection practices within the commercial sector. It introduces legal limitations on how user data can be gathered.

The PIPL mandates that application developers provide users with control over their data usage. This includes options to opt-out of targeted marketing or to prevent marketing based on personal attributes, according to Xinhua.

Furthermore, the law stipulates that data processors must secure explicit consent from individuals before processing sensitive data categories. These include biometric information, medical records, financial details, and location data.

Consequences of Non-Compliance

Applications found to be illegally processing user data face potential service suspension or termination.

Western companies operating in China and handling the personal data of Chinese citizens will need to address the law’s extraterritorial jurisdiction. This entails fulfilling regulatory requirements, such as appointing local representatives and reporting to Chinese supervisory bodies.

Similarities to GDPR

The core principles of China’s new data protection framework closely resemble those established in European Union law. The General Data Protection Regulation (GDPR) grants EU citizens extensive rights concerning their personal data, including stringent consent requirements for processing ‘special category data’ like health information.

Like the PIPL, the GDPR also extends its reach beyond EU borders.

Contextual Differences and State Control

However, the operational context of China’s law differs significantly. The Chinese state utilizes extensive data collection for monitoring and regulating its citizens’ behavior.

Any limitations the PIPL places on government departments’ data collection capabilities – which were considered in draft versions of the law – may be largely symbolic. This could allow continued data gathering by the Chinese Communist Party (CCP) and reinforce centralized control.

Regulation of the Tech Sector

It remains to be seen how the CCP will leverage the new data protection rules to regulate the domestic technology industry.

The government has already been actively cracking down on the sector, employing regulatory changes as leverage against major companies like Tencent. Recently, Beijing initiated a civil suit against Tencent, alleging that WeChat’s youth mode fails to comply with laws protecting minors.

The PIPL provides the Chinese government with additional avenues to impose restrictions on local tech firms.

Algorithmic Targeting and User Consent

China is also swiftly addressing data-mining practices common among Western tech companies, which are now likely to encounter increased scrutiny within China.

Reuters reports that the National People’s Congress accompanied the law’s passage with an op-ed from People’s Court Daily. The op-ed praises the legislation and advocates for obtaining user consent before employing algorithms for “personalized decision making,” such as recommendation systems.

The op-ed emphasizes that personalization should be a user’s choice and that users must have the right to disable personalized recommendation features.

Global Concerns and Regulatory Trends

Concerns regarding algorithmic targeting are also growing outside of China.

In Europe, legislators and regulators are pushing for stricter regulations on behavioral advertising. The EU is currently negotiating new digital regulations, including the Digital Markets Act and Digital Services Act, to enhance its regulatory power over the sector.

The New Geopolitical Landscape

The regulation of the internet is increasingly becoming a key area of geopolitical competition, as regions strive to shape data flows in alignment with their economic, political, and social objectives.