The Status Of Personal Information Protection In China
The Status Of Personal Information Protection In China
The Status of Personal Information Protection in China
Andrew Zhang, Head of the European-American Desk
On November 7, 2016, China published the Cybersecurity Law of the People's Republic of China which became effective on 1 June, 2017. Although most foreign media reports focus on the terms relating to the mandatory requirements imposed on the Cybersecurity systems of internet enterprises, such as national security examinations, we think foreigners living in China need also to know the terms of the law relating to personal information protection.
A foreigner living in China may be met with the situation in which a person who knows your name, home address, and even what you have purchased from an e-commerce website, calls you on your personal phone number. This would mean that your personal information had been leaked by the person to whom you had disclose such information given by filling online forms when browsing websites, purchasing products and/or services, or handling other matters. Because of the absence of laws which regulate the obtaining, holding, usage, and disclosure of such personal information, the illegal obtaining and disclosing of personal information has become a common problem in China and countless individuals have been defrauded by criminals through the use of said personal information.
In order to change the aforementioned state of affairs, China has legislated Amendment (IX) to the Criminal Law of the People's Republic of China, wherein the selling or providing to others of a citizen’s personal information, and illegally obtaining personal information by theft or otherwise, shall be considered a crime. Having been in force for 2 years, some periodic achievements have been obtained, and numerous criminals have been punished for their illegal actions. Yet, it has not been enough to improve the status of personal information protection in China and to only rely on the criminal law. As such, China has made new regulations for personal information protection pertaining to providers of network products and/or services.
According to the Cybersecurity Law of the People's Republic of China, where network products and services have the function of collecting users' information, the providers shall clearly notify their users and obtain their consent. Network operators shall neither gather personal information unrelated to the services they provide, nor gather or use personal information in violation of the provisions of laws and administrative regulations or the agreements arrived at. These regulations give the 'right of refusal' to the network user which could be used in circumstances where network products and service providers require users to provide unnecessary personal information.
In addition to the above, the laws also require network product and service providers to dispose of personal information they have saved in accordance with the provisions of laws, administrative regulations, and agreements reached with users. They shall not divulge, tamper with, or damage personal information they have collected, and shall not provide the personal information to others without the consent of the persons whose data is collected. If network users have evidence proving network products or service providers leaked personal information to a third party without prior consent, said network users shall have the right to report providers to the telecom administration authority or the public security bureau. It should be noted that the circumstances where information has been processed and cannot be recovered, making it infeasible to match such information with specific persons, will not be deemed as leaking personal information.
Nevertheless, personal information protection in China may still fall behind Europe and other jurisdictions, since in practice, you may still need to provide substantial personal information to product or service providers even where one would think such information would not be necessary for the completion of such a transaction or application. Yet, we believe most providers will, someday and somehow, conform to similar regulations resulting in improved personal information protection in China.
