Understanding China’s New Personal Information Protection Law: What You Need to Know

Understanding China’s New Personal Information Protection Law: What You Need to Know

As of November 1, 2021, China’s new personal information protection law, officially known as the Personal Information Protection Law (PIPL), has come into effect, reinforcing the country’s efforts to safeguard the privacy and security of its citizens’ personal information.

The PIPL applies to both domestic and foreign organizations that collect, use, process, and manage personal information of Chinese citizens, including government agencies, businesses, public institutions, and non-profit organizations.

In this article, we will discuss the key provisions and implications of the PIPL and what you need to know as a business owner or data controller.

What Are the Key Provisions of the PIPL?

The PIPL contains several provisions related to personal information protection, including:

1. Consent and Transparency

Under the PIPL, organizations must obtain the consent of individuals before collecting, using, or processing their personal information. Organizations must also provide clear and explicit notices and explanations to individuals about their privacy policies and practices, including the purposes, methods, and scope of personal information collection, use, and processing.

2. Data Minimization and Purpose Limitation

Organizations must only collect personal information that is necessary for the purposes of their services or transactions and must not collect or use personal information beyond the scope of individual consent or the purposes stated in their privacy notices. Organizations must also delete or anonymize personal information that is no longer required for the purposes for which it was collected.

3. Security and Protection

Organizations must adopt reasonable and effective measures to safeguard the security and confidentiality of personal information, prevent unauthorized access, disclosure, alteration, or destruction, and report data breaches and incidents to the regulators and affected individuals in a timely manner.

4. Rights of Individuals

Individuals have the right to access, correct, and delete their personal information held by organizations, and to withdraw their consent for the collection, use, or processing of their personal information. Individuals may also file complaints or lawsuits against organizations for violating their rights under the PIPL.

What Are the Implications of the PIPL?

The PIPL has significant implications for businesses and data controllers operating in China or handling personal information of Chinese citizens.

Firstly, the PIPL imposes strict requirements on personal information collection, use, and processing, which may result in increased compliance costs, administrative burdens, and legal risks for organizations that fail to comply with the law.

Secondly, the PIPL reinforces the importance of data protection and privacy as a fundamental human right, and may increase public awareness and scrutiny of how organizations handle personal information and data breaches.

Lastly, the PIPL may also have extraterritorial effects on foreign organizations that process personal information of Chinese citizens, even if they are not physically located in China, and may face penalties or other enforcement actions for non-compliance.

What Should You Do Next?

As a business owner or data controller, you should take the following steps to comply with the PIPL:

– Review and update your privacy policies and practices to ensure compliance with the PIPL requirements.
– Obtain explicit and informed consent from individuals before collecting, using, or processing their personal information.
– Implement appropriate technical and organizational measures to protect personal information, such as data encryption, access control, and incident response plans.
– Train your employees and contractors on the PIPL and data protection best practices.
– Proactively monitor and respond to data breaches or incidents involving personal information and report them to the relevant authorities and affected individuals.

In conclusion, the PIPL represents a significant milestone in China’s efforts to strengthen personal information protection and set higher standards for data privacy and security. Businesses and data controllers operating in China or handling personal information of Chinese citizens must comply with the PIPL requirements or face severe penalties and reputational damage.