Personal Information Protection Law of the People's Republic of China
The Personal Information Protection Law of the People's Republic of China (Chinese: 中华人民共和国个人信息保护法; pinyin: "Zhōnghuá rénmín gònghéguó gèrén xìnxī bǎohù fǎ") referred to as the Personal Information Protection Law or ("PIPL") protecting personal information rights and interests, standardize personal information handling activities, and promote the rational use of personal information. It also addresses the transfer of personal data outside of China. The PIPL was adopted on August 20, 2021, and is effective November 1, 2021. An official English version for reference only was published on December 29, 2021 . History. On August 20, 2021, the Standing Committee of the 13th National People's Congress passed the Private Information Protection Law or ("PIPL"). The law, which took effect on November 1, 2021, applies to the activities of handling the personal information of natural persons within the borders of the China. Provisions. Scope. The PIPL generally covers all organizations operating in China processing personal information. Long Arm Jurisdiction. Some provisions also include Long Arm Jurisdiction over data collection and processes of organizations outside of China. These apply when: This presumably applies to offshore or multi-national companies with Chinese customers in  China, for example Amazon who might be shipping goods to a Chinese buyer, or Apple who may have Chinese users in the American App Store. All such entities are required to establish a dedicated entity or appoint a representative within China. Exemptions. There are few exemptions, but one that was added during late drafting provides a non-consent legal basis for handling employee data, though employee consent is still needed for overseas transfer, such as to a global corporate parent. Key Themes. Individual privacy, control and consent are consistent themes throughout the law, which lays down key principles including: Definitions . The law defines the following: Legal Basis. All personal information collection and processing must have one of the following legal bases: Unlike in the GDPR, there is no legitimate interests basis. Therefore, most consumers will likely be covered by giving their direct consent (such as for cookies, newsletters, etc.) or by contract fulfillment (such as shipping goods to them or providing services). Consent. Consent is a major concern of the PIPL and a key legal basis on which handlers can process personal information. If there is no other legal basis for processing data, handlers must get consent for data collection  and processing, and this consent can be revoked by any individual at any time. Handlers are not allowed to refuse to provide products or services if an individual withholds or withdraws their consent for non-essential processing. Separate consent is also specifically required in a number of situations: Consent for these situations cannot be "bundled" and thus must be obtained separately from the individual. Where a change occurs in the purpose of personal information handling, the handling method, or the categories of handled personal information, the individual's consent shall be obtained again. Individual Rights. Individuals have several specific  rights under the PIPL - they can: Automated Decision Making. There are specific rules for automated decision making in the PIPL, including the right of individuals to opt-out, such as disabling product recommendations. The law specifically requires "transparency of the decision-making and the fairness and justice of the handling result shall be guaranteed, and they may not engage in unreasonable differential treatment of individuals in trading conditions such as trade price, etc." For companies pushing delivery or commercial sales to individuals through automated decision-making methods shall simultaneously provide the option to not target an individual's characteristics, or  provide the individual with a convenient method to refuse. When the use of automated decision-making produces decisions with a major influence on the rights and interests of the individual, they have the right to require personal information handlers to explain the matter, and they have the right to refuse that personal information handlers make decisions solely through automated decision-making methods. Automated Decision Making is defined as "refers to the activity of using computer programs to automatically analyze or assess personal behaviors, habits, interests, or hobbies, or financial, health, credit, or other status, and make decisions." Facial Recognition. The  PIPL specifically covers the use of facial recognition in public spaces, including that it can only be used for public security reasons unless each individual separately consents: "The installation of image collection or personal identity recognition equipment in public venues shall occur as required to safeguard public security and observe relevant State regulations, and clear indicating signs shall be installed. Collected personal images and personal distinguishing identity characteristic information can only be used for the purpose of safeguarding public security; it may not be used for other purposes, except where individuals’ separate consent is obtained." Handler Obligations. Personal information handlers  have several specific obligations: All handlers must "regularly engage in audits of their personal information handling and compliance with laws and administrative regulations." Personal Information Protection Officers. In addition, at a certain (not yet defined) data handling scale, handlers must appoint "personal information protection officers, to be responsible for supervising personal information handling activities as well as adopted protection measures, etc." Impact Assessment. Under the following circumstances, handlers must perform a personal information protection impact assessment and report the results: Such assessments must include: Data Localization. The PIPL has specific requirements on data localization, the storage and processing of personal  information in China. Data Security. Information handlers have several responsibilities, including adopting the following measures to ensure personal information handling conforms to the provisions of laws and administrative regulations, and prevent unauthorized access as well as personal information leaks, distortion, or loss: Impact Assessments. Impact Assessments are required in a number of situations, including: Contractual Elements. Agreements are required when a handler entrusts personal data handing to another handler. Some law firms have suggested this will resuit in specific standard contractual clauses ("SCC"), similar to in the GDPR. Breach Notification. All data leaks must be reported internally, and if "harm  may have been created" they may be required to notify the individuals affected. Notification details must include: Large Handlers. Large-scale handlers, such as those "providing important Internet platform services, that have a large number of users, and whose business models are complex" also have the obligations: Overseas Transfers. Moving personal information outside of China is only allowed if one of these conditions is satisfied: All such transfers require each individual's separate consent and notification about "the foreign receiving side’s name or personal name, contact method, handling purpose, handling methods, and personal information categories, as well as ways  or procedures for individuals to exercise the rights provided in this Law with the foreign receiving side, and other such matters." Sharing data with foreign governments. Information handlers are prohibited from sharing any personal information with foreign judicial or law enforcement agencies with approval. This has raised concerns among law firms about how multi-national corporations would or could respond to judicial inquiries in other countries, such as a warrant for data held about a Chinese citizen in those countries. Government Departments. The PIPL includes legal basis for how government ("State Organs") can collect and process data. Generally, the government  must follow the same rules as non-government entities, including notifications. There are some exceptions, such as when it "shall impede State organs’ fulfillment of their statutory duties and responsibilities". Enforcement. The PIPL has several enforcement mechanisms, including warnings, orders to stop illegal activity, fines, and confiscation of unlawful income. Illegal acts may also be recorded in China's Social Credit System. In addition, individuals can also sue handlers for violation of their rights. Reactions. Initial reaction has been mostly by numerous law firms publishing notices and whitepapers outlining the new law, its key provisions, and recommended initial courses of  action to prepare for compliance. Articles of the Law. The PIPL has eight chapters and 73 articles, concerning processing rules, sensitive data, government data use, cross-border transfers, rights of individuals, processor obligations, legal liabilities, and miscellaneous supplemental provisions. Chapter 1 - General Provisions Chapter 2 - Personal Information Handling Rules Section 1: Ordinary Provisions Section II: Rules for Handling Sensitive Personal Information Section III: Specific Provisions on State Organs Handling Personal Information Chapter 3 - Cross-Border Provision of Personal Information Chapter 4 - Individuals’ Rights Chapter 5 - Personal Information Handlers’ Duties Chapter 6 - Departments Fulfilling Personal Information Protection Duties and Responsibilities Chapter  7 - Legal Liability Chapter 8 - Supplemental Provisions