Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China【Research Article】

Characteristics of the Identification and Protectionof Personal Data and Privacy Rights in China
Mue I *
Contents
I.

Introduction.

II. Various protections of the right to privacy and personal data
III. Personal Information and Privacy Rights in China
IV. Analysis on reasons why there are differences between protections
V. SummaryI.

Introduction.
In recent years, with the accelerated informatisation and digitalisation of Chinese society, theChinese Government has accelerated its legislation on the protection of personal information andprivacy rights: the Civil Code has been in force since 1 January 2021, establishing the position of
personal information and privacy rights protection in the highest codes in the civil law field. In addition,
the Law on the Protection of Personal Data was adopted on 20 August 2021, which entered into force
on 1 November. Having a closer look at such changes, it can be determined that China is also aiming
to be one of the countries that is ruled by law. However, the content of personal data and privacy rightprotection reflected in these laws and the actual enforcement of the laws show that the individualistic 1
and democratic 2 nature of the original Western theories of personal data and privacy rights is
disappearing, and that the personal information protection and privacy rights in China are also
departing from Western theories and legal systems. It can be said that the personal information
protection and privacy rights in China have become one that mainly aims to solve issues related to*Faculty of Informatics, Shizuoka University, Assistant Professor.

1Charles Fried, “Privacy”, 77 YALE. L. J., pp. 475,482-484(1968); Alen Westin, Privacy and Freedom, Atheneum, p.7 (1967)
Alen Westin, Privacy and Freedom, Atheneum, p.7 (1967).

2

45

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

civil law and that prioritise the societal and national benefits under the umbrella of a Chinese-style
government, which has been adopted in Chinese society.
Indeed, the conflict within Chinese domestic academia on the extent to which this Western-styleprotection of personal information and privacy rights should be accepted has been raging for many
years and has not resulted in a unified conclusion. The result is that even though the Civil Code and
the Personal Data Protection Law have been legislated, the wording remains legally ambiguous andremains, and that personal information and privacy right protection is an unresolved issue that is still
debated among academics in China. Through an analysis of China's Civil Code and Personal Data
Protection Law, this paper takes a closer look at the definition and nature of personal data and privacy
right protection as well as how it is actually expressed in Chinese law.

II. Various protections of the right to privacy and personal data
The concepts of personal data and the right to privacy are defined differently in different countries.
Some countries interpret them as the same concept, while others define them separately. If they aredefined separately, each country's society, culture, politics and laws also have their own views on how
the boundary between the two should be drawn and what kind of protection they should be recognised
as. For example, in the USA, the birthplace of the right to privacy, the scope of the concept of the rightto privacy has gradually expanded over time to protect it as an individual right, while it has alsochanged to include information directly related to the individual, such as the individual's name andhonour, in response to social needs. In particular, as information technology has progressed, the US
has developed several privacy rights, such as the 'right to decisional privacy' 3, the 'right to physicalprivacy' 4 and the 'right to informational privacy' 5, to the point where the right to information privacy
has become the core of personal information and privacy rights protection, in response to theinformation age.
The right to information privacy in the US is regarded as "the right of individuals to control thepossession, disclosure and use of their personal information" (also referred to as the right to control

Griswold v. Connecticut,381 U.S. 479(1965).
Katz v. United States, 389 U.S. 347(1967).
5
Whalen v. Roe,429 U.S. 589(1977).
3
4

46

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

personal information) 6, and the right to control when, to what extent and in what manner their personal
information is disclosed to others, which is recognised as a right to be held by the individual 7. The
Information Infrastructure Task Force Principles for Providing and Using Personal Information,
promulgated by the US Government, link identifiable personal information with the right to privacy 8.
On the other hand, unlike the US, Europe separates privacy rights and personal data and defines
each separately. For example, the General Data Protection Regulation (GDPR) separates personal dataprotection from the right to privacy and establishes personal data as 'any information about an
identified or identifiable natural person (data subject)' (Article 4). Article 8 of the European
Convention on Human Rights and Article 7 of the Charter of Fundamental Rights also state thateveryone has the right to have their private and family life, home and correspondence respected, andArticle 8 of the Charter of Fundamental Rights says that everyone has the right to the protection of
their personal data, with a specific and clear purpose of use and with their consent or the Charter
regulates that personal data can only be processed impartially, with a specific and clear purpose of use
and with the consent of the person or with a legitimate basis in law. It also stipulates that everyone has
the right to know and the right to delete the content of their personal data and that these principles
must be observed under the supervision of an independent supervisory authority.
In comparing the situation in Europe and the US, Juliane Kikitt & Christoph Sobotta note that'given the existence of different regulations, Europe considers personal data and privacy rights as
separate concepts, and merely It does not distinguish between the two as purely symbolic concepts" 9.
Of course, there is not a complete unanimity of opinion on this point of view in the academic field, as
there are still various points of contention against it, especially given the intrinsic connection between
the right to privacy and personal data, and the confusion between the two concepts in dealing withvarious actual cases. In many cases, for example, in the analysis of Paul De Hert & Serge Gutwirth,the European Court of Human Rights also adopted the European Court of Human Rights claim toprotect personal data in 'private life', equating the protection of personal data with the right to privacy

Daniel J. Solove, Paul M. Schwartz, Information Privacy Law, Wolters Kluwer, (2017), p.36.
Westin & Alan F, Privacy and Freedom, Washington and lee law Review 25.1 (1968) p.166.
8
Privacy Working Group, Information Infrastructure Task Force: Principled for Providing and Using Personal Information (1995);
Xu Ke, Sun Mingxi, "The Re-clarification of Personal Information - From the Relationship between Privacy and Personal
Information", Chinese Applied Law, Vol. 1, (2021), pp. 3-9.
9Juliane Kokott & Christoph Sobotta, “The Distinction Between Privacy and Data Protection in the Jurisprudence of the CJEU andthe ECtHR”, International Data Privacy Law, Volume 3, Issue 4, (November 2013), pp.222-228.
6
7

47

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

and equating the violation of the right to privacy with the violation of the right to personal data (data)protection Directive as unlawful processing 10.
Given this situation, it is challenging to distinguish between personal data and privacy rights
protection, both in the USA, where personal data and privacy rights are unified and in Europe, where
they are dualistic 11. However, although both the US and Europe differ in the way they define theconcepts of personal data and privacy rights, both are unified in protecting them as individual rights,
i.e. they have evolved and continue to change from basic civil rights to constitutional rights, withdemocracy and individualism as their fundamental basis. In this sense, the protection of personal
data and the right to privacy in Europe and the US are united in the protection of individual 'rights',
which have been diversified by the development of modern information technology, and which aroseto avoid conflicts between the public and the government, besides disputes in the private sector.

III. Personal Information and Privacy Rights in China
In light of this situation, the paper will delve into what personal data and privacy rights protectionin China is like and what are the characteristics of the Chinese style. As already mentioned in the paper,
Personal Data Protection and Privacy Rights in China's COVID-19 Measures 12, as a result of theinfluence of traditional Chinese cultural thought and morality, in the past, the individual right to The
idea of privacy protection was almost non-existent and, as the Chinese jurist Wang Limin pointed out,
due to the influence of thousands of years of Chinese culture, until around the 1980s, 'hidden private'
was perceived as a word with negative connotations and considered disgraceful13. For Chinese society,personal information and the 'right to privacy' was an unknown concept, and there had been little

10
Paul De Hert & Serge Gutwirth, “Privacy, Data Protection and Law Enforcement. Opacity of the Individual and Transparencyof Power” in Erik Claes and others(eds), Privacy and the Criminal Law, Intersentia, (2006).
11
Maria Tzanou, “Balancing Fundamental Rights: United in Diversity? Some Reflections on the Recent Case Law of the European
Court of Justice on Data Protection”, 6 Croatian Yearbook of European Law & Policy, (2010) pp.53-59.
12
Mue I, Personal Data Protection and Privacy Rights in China’s COVID-19 Measures, The Hitotsubashi journal of law andinternational studies Vol.20, No.1, (March 2021), pp.561-567.
13
Wang XiuZhe, Study on the Public Law Protection of Individual Privacy in the Information Society, China Democratic Legal
System Press, (2017) pp.327-394; Wang XiuZhe, A study on the constitutional protection of the right to privacy in China, Legal
Publishing, (2011) p.19; Yao-Huai lu, “Privacy and Data Privacy Issues in Contemporary China”, Ethics and Information
Technology: Vol.7, (2005) p.12; Mue I, Personal Data Protection and Privacy Rights in China’s COVID-19 Measures, The
Hitotsubashi journal of law and international studies Vol.20, No.1, (March 2021), pp.561-567; Daniel J. Solove, Understanding
Privacy, Harvard University Press (2008).

48

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

thought of protecting it as an individual right 14. Of course, amid this ideology and awareness, Chinese
legal protections were also barely in place 15.
Only in 2010 the Liability Act explicitly protected the right to privacy (Article 2, paragraph 2) 16.
The initial definitions were similar to that of the USA, Taiwan and other countries and regions, which
equated the definition of personal information with the definition of the right to privacy and adopted
an ambiguous and centralised method of protecting personal information as part of the right toprivacy 17. However, with the development of the times and the information society and laws that havebeen developed, China began to express personal information and privacy rights as different concepts
according to the community's needs 18. Nevertheless, as there were no strict definitions of privacy
rights and personal information at that time, the rationale for the division between the two definitions
remained vague 19. As a result, there was a heated debate among scholars in China over the right to thenature of the concept of privacy and personal information 20. In particular, each debater argued his or
her own view on whether the right to personal information and privacy is a protection of private or
public rights, or a fundamental right. Therefore no unifying opinion can be reached even nowadays.
Furthermore, there was considerable conflict among scholars as to whether personal data and privacy
rights should be incorporated into the personality rights section of the Civil Code.
The Civil Code implemented on 1 January 2021 finally compiled the concepts of privacy rights
and personal information into the Pact of Personality Rights and clearly defined each. However, it canbe said that this concept has become quite Chinese in nature and has almost lost its original Westernstyle colours of personal information, democracy and individualism inherent to the right to privacy

Reference to the speech given by Wang Liming at the 2017 International Conference on Big Data and Privacy Protection in Hong
Kong (written by Huang Yasheng, https://mp.weixin.qq.com/s/Jn9ec61iIPduj5SFdtfoQw, (2017)).
14

15
Zhang Xinbao, “Limits to the application of the 'informed consent' principle to the collection of personal information”,
Comparative Law, Vol. 6, (2019) p.7.
16
The 2005 Law on the Protection of Women's Rights and Interests has provisions for the protection of the right to privacy (Article
42). Scholars have their own arguments and reasons for the breakthrough in the protection of personal data and privacy rights in
China, and this paper, based on the opinions of many Chinese scholars, considers the 2010 Tort Liability Law to be a very importantboundary.
17
Ma Te, Privacy Studies - Centered on Systemic Constructs, Renmin University of China Press, (2014), pp. 66-78.
18
For example, the Criminal Code was amended in 2015 to introduce the offence of infringement of personal data (Article 253no.1), while the General Provisions of the Civil Code and the Cyber Security Act were legislated in 2017, thus clearly separating theconcepts.
19
Zhang Xinbao, “Limits to the application of the 'informed consent' principle to the collection of personal information”,
Comparative Law, Vol. 6, (2019) p.1-20.
20
Lv Bingbin, "The Protection of Personal Information: The Function of the System and its Relationship with Special Legislation",
Social Science Series, Vol. 1, No. 258, (2022), pp. 93-102.

49

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

and personal information. Besides, looking at the relevant articles, the wording of the legal terms is
also ambiguous, and even about the contents that have not been resolved in response to previous
debates and conflicts between scholars, the legal articles did not answer the question head-on andavoided clear legal terminology.
For example, Articles 1032 and 1033 of the Civil Code define the concept of privacy and thespecific forms of infringement of the right to privacy, stating that "Natural persons shall enjoy the rightto privacy. No organisation or individual shall infringe the right to privacy of others using
reconnaissance, invasion or harassment, leaking or disclosure. Privacy is defined as 'the tranquillity ofthe private life of a natural person and his private space, private activities and private, confidential
information which he does not want others to know' (Article 1032). Article 1033 also states that, except
as otherwise provided by law or with the express consent of the right-holder, no organisation orindividual shall engage in any of the following acts. (1) Disturbing the tranquillity of another person's
personal life using telephone calls, short messages, instant messaging tools, e-mails, leaflets, etc.; (2)Entering, photographing or peeping into the personal space of another person, such as a house or hotel
room; (3) Filming, peeping into or photographing the personal activities of another person. (4) filming
and peeping into the private parts of another person's body; (5) processing another person's personal
information; and (6) violating another person's right to privacy by any other means. And Articles 1034
to 1038 also set out in detail the concept and protection of personal data. Namely, 'Personal data ofnatural persons shall be protected by law. Personal data are various types of information, recorded
electronically or by other means, which alone or in combination with other information can identify a
specific natural person. This includes a natural person's name, date of birth, ID number, biometric
information, address, telephone number, email, health information and mobility information.
Provisions relating to the right to privacy apply to private information in personal data. Where there
are no provisions, the provisions relating to personal data shall apply' (Article 1034) 21. Furthermore,
it has been clearly stated that a data processor shall not divulge or falsify personal data collected andstored by him, nor shall he unlawfully provide such personal data to another person without the consent
of the natural person. However, except where, through processing, a specific individual cannot be
identified and cannot be restored..." (Article 1038).

21
Misako Oda and Zhu Ye, "The Code of the People's Republic of China" (2, complete), Ritsumeikan Law Review 2020, no. 3(391), p. 482 (1456).

50

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

However, at least the following four uncertainties clearly remain regarding these articles relating
to personal data and the right to privacy. First, the issue of the 'right' to privacy right protection. Article1032 of the Chinese Civil Code clearly stipulates that the right to privacy is a right enjoyed by natural
persons and that no organisation or individual may infringe on this right. However, at this stage, theprotection of the right to privacy in China is still only explicitly recognised in civil law, with the
Chinese Constitution stating that 'personal freedom, civil dignity and civil housing are inviolable, andcivil freedom of communication and confidentiality of communication is protected by law (Articles
38 - 40) '. The extension of the right to privacy from the civil to the constitutional level has been heavily
debated among scholars in China, with no clear answer yet. In fact, opposition to the extension of theright to privacy from the civil to the constitutional level is mainstream among scholars 22. The majorityof scholars believe that extending the right to privacy from the civil to the constitutional sphere should
not be allowed, as it would mean that opposition to public authority would be permissible. For China,
where the traditional Chinese culture of patriarchy is deeply embedded in society, and the politicalsystem has been under the absolute leadership of the Communist Party government, it is an extremely
difficult task to accept that private rights and public power are measured equally, even before the law 23.
In particular, the question of how to maintain the dynamic balance between individual interests,
community interests, the public interest of society, government power and state interests, i.e. whether
to prioritise individual interests or the public interest under government power, is one of China's mostdifficult balancing act. Of course, in recent years, some scholars have hoped that the Personal Data
Protection Law legislation would solve this problem. Still, as related to the following fourth point, thediscussion on the concept of 'personal data rights' in China, the nature of whether this privacy rightprotection is limited to civil law has not been clearly stipulated in law at present and remains one ofthe pending issues 24.
Furthermore, although the term 'any organisation' is mentioned, as in Article 1032 of the Civil
Code, it is extremely unclear to what extent the scope of 'organisation' used here is covered. Chinese

22
Lv Bingbin, "The Protection of Personal Information: The Function of the System and its Relationship with Special Legislation",
Social Science Series, Vol. 1, No. 258, (2022), pp. 93-102; Cheng Xiao, Personal information to the study of legal issues in thedevelopment of data interconnection, Politics and Law 2020 No. 8 Main Seminar; Wang Liming, "Redefining the Concept ofPrivacy", The Jurist, 2012, pp. 108-120.
23
Mue I, Personal Data Protection and Privacy Rights in China’s COVID-19 Measures, The Hitotsubashi journal of law andinternational studies Vol.20, No.1, (March 2021), pp.561-567; Feng Tianyu, “The historical and cultural origins of modern Chinese
democracy”, China 21, Society of Aichi University Modern Chinese Study, (2000, translated by Akiko Tanaka) pp.139-150.
24
Zhang Hong, "Exploring Japanese Personal Information Protection Law in the Era of Big Data", Financial Law No.3, (2020),
pp.150-160.

51

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

legal experts have analysed that the term 'organisation' in social phenomena is not originally a technicalterm for legal concepts. However, in recent years, the word has been used as a general concept in atleast 65 laws and about 165 places in Chinese law, where it is said to be an 'organisation' in legal
relations, abstracted from the results of judgments based on the values of the legislator 25 . Somescholars have pointed out that the scope of the term is supposedly analysed to include all legal entities,
unincorporated organisations, or related entities beyond civil law. However, the term still has a shadowof the former Soviet-era civil law behind it, and, in fact, it is unclear whether the scope of 'organisation'
here includes legal entities or the government 26.
Second, in terms of the concept of the right to privacy in the Civil Code, the Chinese right toprivacy is recognised as a kind of individual right, and it is clearly stipulated that it may not be
infringed by any organisation or other person. In practice, however, mainstream Chinese legal scholars
view the right to privacy as a mental personality right, a kind of passive, passive and defensive right.
Their perspective is that such a passive right to privacy cannot be exercised proactively and actively
by the person in question before others violate it and that the only time it is possible to exercise theright is when it is violated and only when there is an exclusion to the interference of others andcompensation for the loss 27. Such a concept is very different from the Western-style, individualismcentred, individual freedom and ideas developed from a proactive and active conception of theprotection of dignity, and is completely out of step with the Western-style individual 'right to control
one's own information', at least in the early stages of the US, and even more so in the civil law field.
It can be recognised as remaining a reduced version of privacy rights protection.
This is because the theory of personal data control must meet at least two a priori conditions: one,the person concerned and the personal data processor must be on equal footing; the other, the person
concerned must be informed of all information in advance. However, it is also argued that ‘it is unlikelythat these conditions are currently ensured, although Chinese law currently contains only formalities' 28.
Therefore, even if the text of Chinese law states that the person has the right to control his or her
personal information, it can be attributed to the fact that this right to control is simply a kind of passive

Gu Zhuxuan, A Conceptual History of Civil Law - General Provisions, Law Press, (2014), p. 97
Zhang Xinbao, "Analysis of the meaning of "any organization or individual" in China's Civil Code", Chinese Law Review, Vol. 4,
No. 46, (2022), pp. 37-51.
27
Wang Liming, "Redefining the Concept of Privacy", The Jurist, (2012), pp. 108-120.
28
Zhang Jihong "Research on the designed personal information protection mechanism", Journal of Northwest University of
Political Science and Law of Legal Science, Vol. 3, (2022), pp. 31-43.
25
26

52

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

and passive protection of personal information and privacy rights that is effective against the private
sector to some extent and is powerless against government power.
It should be noted that, in fact, these characteristics are clearly reflected in various policies in
China, for example, in the case of the Chinese social credit system, which is currently being introducedwith a view to implementation and are also manifested in the ongoing measures against newcoronavirus infections. A typical feature is that even if the government collects excessive personal data
unless there is a clear violation of personal interests or an incident of information leakage, it is notregarded as an infringement of personal data or privacy rights, and the public either tolerates thegovernment's collection of personal data or does not regard it as a major problem. The public generally
tacitly accepts or does not regard government collection of personal data as a major problem.
Appropriately, the protection of privacy rights in China does not lie on the axis of 'individual rights'
or 'individual control' but rather the protection of personal information and privacy rights under
government control and with government protection.
On the other hand, some researchers within China have a different perception. For example, somescholars argue that if all individuals feel that their privacy rights are at risk of being violated, even
before they are violated, and if there is solid evidence that their privacy space is being shown on
surveillance cameras or other equipment, individuals have the report states that individuals shouldhave the right to submit a request to have the device removed, and should say so regardless of whether
it is against an organisation or against an individual29. However, the number of researchers making
such claims is still limited in China, with many scholars viewing the Chinese right to privacy as passive
and only as a right of self-preservation. This point that the right is only allowed to be exercised as an
exclusion to interference when it is violated is also linked to the possibility and justification ofcollecting, utilising and disclosing personal data from the government. As is evident from this pointof view, Chinese-style protection of the right to privacy loses much of its democratic content.
Third, the overlap between personal information and the right to privacy is discussed. First,
although China's right to privacy and personal information adopt a dualistic conceptual structure, inpractice, there is some overlap between the two concepts 30. Mainly, this is the 'private, confidential

Li Jia Ni, "A Study of Privacy Issues under Surveillance Cameras", Knowledge Power, Issue 46, (November 2019).
Wang Liming and "And the Appropriateness of Different Rules for Delineating Privacy and Personal Information", Law Review(bimonthly), Vol. 2, No. 226, (2021), pp. 15-24.
29
30

53

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

information' part of Article 1032 of the Civil Code and the concept of 'sensitive information' as
stipulated in the 'Information Technology Personal Information Security Code', which corresponds tothe previous Chinese Personal Data Protection Law, and the Personal Data Protection Law newly inforce since 1 November 2021. In other words, sensitive information, as defined in the Personal Data
Protection Act, is "information that, once leaked, illegally provided or abused, is extremely likely toviolate the dignity of the personality of a natural person and threaten the security of person andproperty, including biometric identification, religious belief, specific status, medical health, financial
accounts, movement information and personal information of minors under 14 years of age' (Law on
the Protection of Personal Data, Article 28), and regulates the use of such information. On the other
hand, the fact that the content of the right to privacy in Article 1032 of the Civil Code, 'private
information', and the content of Article 1304, 'biometric information, health information, movement
information', overlap with the content of 'sensitive information' of personal information, suggests that,conceptually, there is no clear distinction between the right to privacy and personal information in part.
It has been argued that there may be a distinction between the right to privacy and the right to personal
information in some cases31.
For example, "Sensitive information is central to protecting the right to privacy and is highly
private. If such content is disclosed or utilised, individuals may be severely affected. Therefore, privateand sensitive information have the same content" and therefore conceptually overlap, leading someexperts to argue that they are protections of the same nature about the content of personal data and theright to privacy 32 . On the other hand, however, 'while acknowledging that sensitive and private
information have the same content, sensitive and non-private information cannot easily be judged tobe the same because the difference between private and non-private information is the civil right andthe method of protection'. The right to privacy in the safety of private life and private and confidential
spaces such as residences and hotels is clearly different from the concept of private information, andtherefore 'the right to privacy and the concept of private information do not overlap, although they dooverlap' in the Civil Code 33. Some scholars have therefore argued that personal data and the right toprivacy are separate concepts and have different meanings for protect. The focus of this debate is not

31
Xu Ke, Sun Mingxi, "The Re-clarification of Personal Information - From the Relationship between Privacy and Personal
Information", Chinese Applied Law, Vol. 1, (2021), pp. 3-9.
32
Zhang Xinbao, "From Privacy to the Theory and Institutional Arrangement of Re-Equalization of Personal Information Interests",
Chinese Jurisprudence, No. 3, (2015).
33
Cheng Xiao, "Sensitive and Private Information in Personal Information Protection," People's Court Daily, Vol.5, (November 19,2020).

54

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

so much a dispute over the right to privacy and the concept of personal data but rather a dispute overwhether the meaning of their protection is the same. The reason for being so concerned with the twoconcepts is closely related to the nature of personal data and the methods of protection that follow.
Fourth is the lack of clarity regarding the nature of personal data protection. In the Chinese Civil
Code, the term 'right to privacy' was clearly written, but the term 'right to personal data' was not.
Indeed, the Civil Code clearly stipulates that the personal information of natural persons is protectedby law. However, it does not clearly state what kind of protection this protection is, i.e. whether it is apersonal right. In the opinion of some scholars, personal data should be protected as an individual
right, just like the right to privacy. In addition, "personal data protection law is a kind of public law
rights protection and should be considered as a new type of public law rights protection for information
subjects to counteract information processing acts on the part of information controllers. Such rights
protection belongs to the statutory rights category. ...and since the main object of infringement of theright to personal data is public law liability, it is argued that personal data protection law also has apublic law character and is irrelevant to private law in the Civil Code" 34. On the other hand, in responseto this point of view, China's 'Civil Code plays an important role in clarifying the definition of personal
information. It clearly stipulates that natural persons are not protected against personal information as
an individual right, but as a civil right (interest), and also that it is not a right under public law". Indeed,some scholars argue that although "the Civil Code does not use the term 'right to personal data'", itdoes not change the fact that "the protection of the rights (interests) of personal data is a civil right(interest protection), and a private right (interest) protection" 35.

IV. Analysis on reasons why there are differences between protections
The underlying cause for scholars' adherence to their own views to this extent is the concern thatrecognising the protection of personal data and the right to privacy in the same way would expand theindividual's right to domination and control over his or her personal data and make the right absolute.
There is concern that this will have an adverse impact on the future free flow of personal information

Zhou Hanhua "The Legal Positioning of Personal Information Protection", Legal and Business Studies, No. 3, (2020), p. 52.
Cheng Xiao "Innovation and Development of the Personal Information Protection System in China's Civil Code", Financial Law
No.4, (2020), pp.32-53.
34
35

55

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

and the development of the information and digital society of Chinese society 36. It is also for thisreason that the articles themselves are ambiguously worded in China's Civil Code and Personal Data
Protection Law, which has resulted in an ongoing debate among scholars on the issue 37. Indeed, there
is a lively debate among foreign scholars that in this day and age, it is no longer possible to regard
personal data as completely owned by individuals 38. However, this is precisely why countries are
cautious about the use of this personal data when enforcing their laws and policies. For example, theattitude of governments towards the use of personal information is expressed, for instance, in theinfected person detection apps introduced by various countries in response to new coronavirus
infections, and the collection and processing of information is also largely divided between anonymousand real-name systems. However, in the case of China, the public ownership of personal information
is clearly expressed in policies and laws, so that laws, and the effectiveness of policies, take precedence
over the protection of personal information and personal interests.
According to an analysis by Chinese jurist Wang Liming, "In the Western view of the right toprivacy, the right to privacy is recognised as the dignity of one's personality and personal informationis reflected as the person's right to control his or her personal information", but in the Chinese Civil
Code, the articles on the right to privacy and personal information shows a clear difference in thesedefinition. Whether the Civil Code should have the word right after both privacy and personal
information has been the focus of significant debate within China for many years. In Wang's argument,"the core of the right to privacy is to avoid disturbance from others and to protect the rights ofindividuals, and protection by law is absolute. However, personal information is not the protection ofrights, as it is the personal rights and interests (gains) of the subject of the information, a kind of civilrights and interests (gains) protection. Some personal data rights (interests) belong to individuals,
while others are responsible for the public interest. It is, therefore, important that protection against
personal data is based on the principle of balance of interests. Moreover, while the protection of theright to privacy is an absolute protection of the right for the individual, protection against personal
data does not reach an absolute level". This is because personal data also includes the protection ofrights (interests) belonging to the public interest, and "even in the Civil Code, the right to privacy is

36
Cheng Xiao " Innovation and Development of the Personal Information Protection System in China's Civil Code ", Financial
Law No. 4, (2020), pp. 33-34.
37
Wang Xixin, Peng Chun, “Constitutional Foundations of the Legal System for the Protection of Personal Information”, Tsinghua
Law vol. 15, No. 3 (2021), pp. 6-24.
38
Jerry Kang, “Information Privacy in Cyberspace Transaction”, 50 Stanford Law Review pp.1193,1202,1246 (1998).

56

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

recognised as an independent personality right, but personal data does not constitute an independentright, but merely the protection of one personality right (interest). The analysis states that 'protection
to legal rights is higher because it exceeds the level of protection to interests (profits)' 39.
And according to Wang's analysis, although there is no clear distinction in the Chinese Civil Coderegarding the protection of rights and interests (profits) as in other laws, there is a clear distinction
between the protection of the right to privacy and the protection of personal data. For example, Article1033 on immunity from infringement of the right to confidentiality regulates that 'the explicit consent
of the person must always be obtained'. On the other hand, Article 1038's exemption for processing
personal data states that 'the consent of the natural person or the guardian shall always be obtained',but the word 'explicit' is absent from Article 1038. This is a careful conclusion of the legislator andnot an accidental omission. The reason for the absence of the word 'explicitly' is that if the word
'explicitly' is added to personal information, the method of using the person's 'implicit consent' cannot
be used when collecting personal information, and the 'explicit 'consent' of the person must be obtained.
Currently, in China, the government's "collection of personal data (although the law states that theperson's consent is required) can, in fact, be processed without the person's explicit consent, as longas there is tacit consent. Wang analyses that the reason this is not illegal is that it does not protect
personal data as a right but as a right (benefit) for both the individual and society 40. Furthermore, thelogic in China is that the public interest as a society stands above the private interest.
In other words, Chinese law defines the right to privacy and personal information as separate
concepts and clearly distinguishes between the protection of both as well as their realities. The reasonsfor this division of the two according to their substance are analysed by Chinese experts in thefollowing five ways.
The first is the difference in the nature of the two rights. The right to privacy is a kind of spiritual
personality right, and its value as property is unclear. The right to privacy is one of comprehensive
rights (interests) and includes both spiritual and property interests. On the other hand, the right toprivacy is a personality right and is regarded as an absolute individual right in its nature. However, the39
Wang Liming "And the Appropriateness of Different Rules for Delineating Privacy and Personal Information", Law Review(bimonthly), Vol. 2, No. 226, (2021), p. 19.
40
Wang Liming "And the Appropriateness of Different Rules for Delineating Privacy and Personal Information", Law Review(bimonthly), Vol. 2, No. 226, (2021), p. 18.

57

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

Civil Code does not define the interest (benefit) of personal data as an absolute right. The reason forthis is that the protection of personal data must be coordinated between the safety of the interests ofnatural persons, freedom of information and reasonable use. For example, the Civil Code stipulates
that the reasonable use of personal data for 'acts such as newspaper reporting and public opinion
supervision to implement public interests' (Article 999) is possible, and the personal data infringement
exemption (Article 1037) also clearly defines the details. On the other hand, the difference between
the two is evident in the absence of rules against the right to privacy, such as cooperation andreasonable use of personal data.
Second, personal data is aggregated, whereas the right to privacy is less characterised byaggregation. Personal information can be processed as aggregate data, whereas the right to privacy
cannot be processed this way.
Third, personal information is available, and the law plays a role in protecting and promoting its
use. The emphasis here is on the consent of the individual at the time of collection and use, as personal
information, in general, is allowed to be known by others. However, as the right to privacy is, inprinciple, non-useable, the degree of protection is overwhelmingly superior.
Fourth, the person has the right to self-disposal of the right to privacy but does not allow others
to use it without permission or for business purposes. However, personal information, other thanprivate and confidential information, can be used under the Civil Code, provided that the rules areobserved, such as the collection of personal information under lawful and legitimate reasons, notexcessive, and that the data is not processed (Article 1035). And it is legal for it to be used by others
to develop the internet and other information industries and the digital economy.
Fifth, there are many types of violations of the right to privacy. For example, the Civil Code lists
six types of infringements of the right to privacy and stipulates that they apply to the business activities
of companies and the official activities of government departments, as well as to the scope of activities
of individuals 41. On the one hand, the protection of personal data rights and interests (interests) mainly

41(i) Disturbing the peace and quiet of another person's private life by means of telephone calls, short messages, instant messages,
e-mails, leaflets, etc. (ii) Entering, photographing or peeping into the private space of another person's residence, hotel room, etc.
(iii) Photographing, peeping into, eavesdropping on or disclosing the private activities of another person. (iv) filming or peeping on
the private parts of another person's body (v) processing another person's private information (vi) Violating another person's right to58Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

covers personal data processing, and the rule scope includes activities such as the collection, storage,use, processing provision and disclosure of personal data. Conversely, it is stipulated that theprotection of personal data does not apply to communications between family members and friends or
to the provision of personal data in social activities 42.
As this analysis shows, Chinese law and mainstream experts see the concepts of privacy rights
and personal data as distinct and different. Some scholars hold opposing views to this notion. For
example, in the interpretation of some scholars, personal data protection is the core content offundamental rights and reflects human dignity and independence of personality. However, as the
Chinese Constitution does not incorporate the content of personal data protection, they argue that itshould be written into the Constitution through constitutional precedents 43 . On the other hand,requiring personal data to be protected from the Constitution is not compatible with China's (culture,ideology, political system, etc.) national circumstances. There are also notable dissenting voices thatargue that protecting personal data as a fundamental right is an overemphasis on personal data andclashes with the free circulation of information and the development of the information industry 44.
At the heart of the debate on whether personal data protection should be protected as an individual
right is the dispute over the absolute right of ownership and control of information by the subject of
personal data. That is, it is generally recognised in China that personal information contains individual
rights (interests) as well as social rights (interests). It is true that the law takes the form of requiring
the consent of the individual when collecting personal information. Still, in Chinese society, where thepublic interest prevails over the rights (interests) of the individual, when the government collects
personal information in response to social needs (such as policy enforcement), it is based on implied
consent. These issues are at the heart of the debate. It is efficient and convenient for governments tocollect personal data through the introduction of various policies if they can freely collect personal
data at any time in the form of implied consent. Conversely, if the protection of personal data is legallydefined as a right, various legal restrictions will be imposed on the use of personal data. This may leadprivacy by any other means (Civil Code, Article 1033) (see Soga Law Office, Japanese translation,
https://www.sogalaw.com/archive/200528%20Minfadian_JP_ver201222.pdf).
42
Cheng Xiao, "Sensitive and Private Information in the Protection of Personal Information", People's Court Daily, p. 5, 19
November 2020; Wang Liming "And the Appropriateness of Different Rules for Delineating Privacy and Personal Information",
Law Review (bimonthly), Vol. 2, No. 226, (2021), p. 18.
43
Sun Ping, "Protection of Citizens' Privacy in the Era of Government Mega-Databases", Jurisprudence, No. 7, (2007), p.41.
44
Xu Mei, "Re-discussing the Path of Personal Information Protection - Taking Article 111 of the General Principles of Civil Law
as a Starting Point", Journal of China University of Political Science and Law, Vol. 5, (2018), p. 89.

59

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

to various disadvantages when enforcing policies, so both in the legal system and in the academic field,
the definition and protection of personal data protection are very carefully debated, which is one of
the main characteristics of personal data protection and privacy rights protection in China. This is also
one of the main characteristics of the protection of personal data and the right to privacy in China thatreflects the essence of the community interest and public interest priorities of Chinese society.
However, I argue here that consent is a kind of declaration of intent. For example, under Article
140 of the Civil Code, manifestations of intention, including consent, can be indicated by express andimplied means. However, a legal provision stipulates that an implication can only be recognised as adeclaration of intent if it conforms to a promise or a trade custom between the parties concerned.
Reasoned statements of intent, which can be considered implied consent, involve strong interferencewith personal autonomy and may be intended to remove legal ambiguity and forcefully pursue theachievement of a goal 45. Therefore, silence regarding personal data and privacy rights cannot be taken
as consent, as it is not generic as a typical normal case. The perception that the attitude of silence on
the subject of personal data is an acceptance is mere speculation. It is unlikely to be considered realconsent to personal data processing. Otherwise, the person is regarded as consenting, even though heor she has done nothing, and the collection and processing of personal data are made voluntary, which
can easily lead to a state of lawlessness in society. As a result, legislation to protect various types of
personal data becomes meaningless. Therefore, some Chinese experts have expressed alarm in thisregard, and therefore the idea of tacit consent is also out of step with the fundamentals of democracy 46.
Moreover, such an approach is clearly contrary to the principle of the rule of law, which statesthat all individuals, organisations and governments are equal before the law. Article 1035 of the Civil
Code originally stipulates that the consent of the individual or his/her guardian is the principle forprocessing personal information, and the Personal Data Protection Law, which will come into force
on 1 November 2021, specifically states that, with regard to sensitive information, "the individual has
the right to know and control the processing of personal information and others have the right to restrict
or refuse the processing of personal information. The principle of requiring the person's consent isclearly emphasised: 'The person has the right to restriction or refusal of the processing of personal45
Shi Yifeng "The Meaning of Silence in Civil and Commercial Interactions - A Multi-Level Balance of Private Autonomy", The
Jurist, Vol. 6, (2017).
46
Lv Bingbin, "The "Consent" Dilemma of Personal Information Protection and Its Way Out", Legal and Business Studies, Vol. 38,
No. 28, (2021).

60

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

information' (Article 44). However, the convenient interpretation of the concept of personal data in
the name of national digitisation and the development of informatisation, as well as the ambiguity ofthe scope of the law's reference to 'organisations' in 'any organisation', makes it unclear whether thegovernment is included, and indeed, when implementing the law, the government is above the law,etc., this is clearly at variance with the principle of legal impartiality and contrary to democratic
principles.
Of course, under such a leading policy, China, in the process of implementing various procedures,
frequently has cases that violate personal information and privacy rights without obeying the law. For
example, health codes are being introduced in many parts of China to combat new coronavirus
infections. However, all kinds of personal information are being collected, not only information on
those infected with the epidemic but also personal health examination information and life
management information of the general public. The scope of personal information collected far
exceeds that required for epidemic control, but local governments are single-handedly expanding thescope of personal information collected under the guise of controlling epidemics 47. CCTV cameras on
the streets are also constantly checking people's behaviour, checking for traffic rule-breakers andcriminals. The moment a problem is detected, without confirmation, the person's face image andpersonal details are shown on the monitor screen, sometimes without the person even knowing if they
have done anything wrong, and in some cases, their personal details are exposed. While this kind of
overarching approach is very effective in creating a social environment, it is difficult to say that theprotection of an individual's personal data and privacy rights is reliably ensured 48.
China's Personal Data Protection Law emphasises, among other things, the principle of theperson's consent to the handling of sensitive information, stipulating that "the person has the right toknow and control personal information processing and others have the right to restrict or refuse toprocess personal information" (Article 44). However, although it states that the person has the right tocontrol his or her personal data, in reality, this right to control is protection of personal data under
government power and against the private sector, and what is being protected is the overriding
protection of the interests of the private sector as a whole. On the other hand, the public is certainly'powerless' against exercising government power. This is because, as there is a latent and continuing

Wang Xixin, Peng Chun, “Constitutional Foundations of the Legal System for the Protection of Personal Information”, Tsinghua
Law vol. 15, No. 3, (2021), pp. 6-24.
48
Shi Jiayou, “Protection of personal information in public video equipment applications”, Jiangsu Social Sciences Vol. 3, (2022).
47

61

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

recognition in traditional Chinese culture, the government is the representative of the 'public', the'public' stands above the 'private', and government action is for the benefit of society as a whole, andpersonal information is not an absolute right of the individual. Therefore, when considering individual
rights and interests, the individual, first of all, as a member of society, is increasingly aware that all
citizens are obliged to serve society under the principle that the 'community interest' takes precedence,and this tendency is expressed prominently in law and the enforcement of policy.
Through the analysis of the concepts of personal data and privacy rights, of the nature ofprotection in both, and the claims of scholars in China, it has become clear that some of the typicalfeatures of this Chinese-style protection of personal data and privacy rights are as follows. It aims tosolve various social problems under the Chinese government's governance. This means that theprotection of privacy rights in China prioritises the protection of the public interest, the communityand society as a whole rather than the individual's personal data and privacy rights, with a clear"hierarchical distinction" and "protecting the public interest" - in short, ensuring the successful
development of China's information society as a top priority. As China continues to be influenced bytraditional Confucian moral ethics and is under the political system of Communist Party leadership,with a strong sense of community, clear hierarchical relations and a political structure of concentrationof power, the Chinese-style protection of personal information and privacy rights that is being nurtured
and developed are consistent with these aforementioned characteristics. Hence, the Chinese-styleprotection of personal information and privacy rights is not coloured by democracy and individualism
but is used by the government as a tool for the governance of one society 49.
However, two questions remain about the way personal data protection is shaped by this politicalsystem and values: first, with regard to legal personal data and privacy rights in China, in a context
where all personal data is collected and processed by the government, what is still left as a right toprivacy; and second, what is left as a right to privacy in a context where all personal data is collected
and processed by the government. The second question is what is still left as a right to privacy in asituation where all personal data is collected and processed by the government. Another question isthat personal information contains both private and public interests, but how can the boundary between
the two be demarcated, and how can the balance point be reached? In short, even under the guise ofprioritising the public interest, the answer to the question of how much private interest is ultimately

49

Regarding Confucianism, please refer to: Kei Amago, Chinese Logic and Western Thinking, (Seitousha, 2021).

62

Characteristics of the Identification and Protection of Personal Data and Privacy Rights in China

left to the private interest is extremely unclear.

V. Summary
This chapter has identified four characteristics of the right to privacy and personal information in
China, based on the Chinese Civil Code and Personal Data Protection Law and the discussions ofscholars in China, including the conceptual similarities and differences between the two and the natureof their protection. Personal data and the right to privacy in China are regarded as two separate things,
and the types of protection are quite different. In recent years, Western-style theories of personal
information and privacy rights have been introduced and accepted in China by the needs of Chinesesociety and have been strongly influenced by China's unique culture, ideology, morality, values andpolitical system, etc. As a result, the original colours of democracy, individualism, liberalism, etc.,
have been shed, and China's own form of personal information and privacy rights protection has been
formed. These characteristics of personal data and privacy rights protection are expressed prominently
in laws such as the Civil Code and policy enforcement. In effect, this Chinese-style protection of
personal information and privacy rights is a passive right protection under the Chinese government,with the aim of resolving frictions and conflicts between the private sectors to protect the stability ofChinese society and the people's living environment. Through an analysis of Chinese law, this paper
took a closer look at the nature of personal data and privacy rights protection and the attitudes ofscholars in China towards personal data and privacy rights protection.

63

Nagoya University Asian Law Bulletin Vol.9 (May 2023)

64