Reports have emerged that China has passed the Personal Information Protection Law (PIPL). PIPL is a European GDPR that sets out comprehensive rules for how companies collect, process and protect user data.
The law stipulates data minimization, meaning that data collection is limited to information necessary for a specific purpose. They are also obligated to give users control over how their personal information is used. For example, a user may have a choice to reject targeted advertisements. PIPL states that businesses must handle personal information for clear and reasonable purposes, and the information obtained is at least limited in scope for that purpose.
In addition, this law also has provisions on data transfer to third countries, and a post will be installed as the DPO in charge of data protection, and regular audits for the security of personal information will be conducted. In China, in addition to PIPL, data security-related laws have been passed and will come into effect on September 1. PIPL differs from GDPR, which applies to all companies handling European citizen information in that there is a movement to establish a clear framework for managing data according to the economic value of the company and its relevance to national security.
China’s preparation of such a law is seen as tightening regulations on large domestic tech companies. Alibaba, China’s largest e-commerce company, was fined 18.228 billion yuan in April for abuse of its dominant position. In addition, Internet dispatch service Didi Chuxing launched an investigation immediately after it went public on the New York Stock Exchange in July, accusing the CAC of China’s Cyberspace Administration of violating user privacy. On August 7, Tencent was also pointed out that WeChat Youth Mode violated the Child Protection Act.
Since the PIPL will come into effect on November 1, 2021, companies have only two months left to respond to the law. Related information can be found here.