Personal Information: PRC Personal Information Protection Law Released

I. Legal News:

The 30th session of the Standing Committee of the 13th National People’s Congress has recently adopted the Personal Information Protection Law of the People’s Republic of China (the “Personal Information Protection Law”), which shall come into effect from November 1, 2021.

Hereunder are some takeaways of new rules for your reference.

1. Principles for personal information processing

(1) Reasonable purpose with minimum scope¹

The Personal Information Protection Law provides that personal information shall be processed for specific/reasonable purpose, and shall not be excessively collected.

For example, for certain navigation service apps, it is necessary for them to obtain the information of users’ location. However, some apps secretly turning on functions such as the camera or voice transmission, which constitutes excessive collection of personal information.

(2) Fairness and impartiality²

The Personal Information Protection Law also regulates that when processing personal information in automated decision-making, fairness and impartiality of the results shall be ensured, and no unreasonable differential treatment of individuals on transaction prices can be implemented.

For example, some takeaway apps charge higher service fee for customers who order frequently.

2. Rules for sensitive personal information³

The Personal Information Protection Law provides that sensitive personal information refers to biometrics, religious belief, medical/health information, financial accounts, personal whereabouts, etc. Likewise, any personal information of a minor under the age of 14 will be deemed as sensitive personal information. The conditions for collection and processing sensitive personal information are strict, which is only for a specific purpose and is sufficiently necessary. In addition, processing sensitive personal information requires individual’s separate consent.

For example, for applying a membership card in a health club, when the health club collects its members’ information, it shall not collect their ID card number, home address, etc, as these are sensitive personal information, and it is not necessary for the health club to collect such information.

3. Rules for cross-border provision of personal information⁴

The Personal Information Protection Law also improves the rules for cross-border provision of personal information. When a personal information processor needs to provide personal information outside the territory of China, it shall at least meet any of the following conditions:

a. It has passed the security assessment organized by the State cyberspace administration⁵.

b. It has been certified by a specialized institution in respect of the protection of personal information.

c. It has concluded a contract with an overseas recipient according to the standard contract formulated by the state cyberspace administration, specifying the rights and obligations of both parties.

4. Administrative Liability⁶

When personal information is processed in violation of the provisions, the authority departments shall impose the following administrative sanctions:

(1) order to make correction, confiscate the illegal gains and give a warning;

(2) If rectification is refused, impose a fine up to RMB 1 million (a fine of not less than RMB 10,000 but not more than RMB 100,000 shall be imposed on the directly liable persons)

(3) If the circumstances are serious, impose a fine up to RMB 50 million or 5% of its annual turnover of the previous year, and order the processor to suspend relevant business for rectification, or revoke the business license. (a fine of not less than RMB 100,000 but not more than RMB 1 million shall be imposed on the directly liable persons, and such persons may also be prohibited from serving as directors, supervisors, senior managers, and persons in charge of personal information protection of relevant enterprises for a certain period of time)

(http://www.npc.gov.cn/npc/c30834/202108/c5439b50d1614851aeaee97dde63b863.shtml)

The Supreme People’s Court has recently issued the Interpretations on Several Issues Concerning the Application of the Anti-Unfair Competition Law of the People’s Republic of China (the “Draft for Comment”) to solicit public comments by September 19, 2021.

1. More specific rules for confusing acts

Under PRC Anti-Unfair Competition Law, an operator should not perform any confusing acts leading customers to be deceived with other business operator’s products, nor believe certain relations exist between said operator and other business operators.

However, the definition of “certain relations”, is vague in practice.

Currently, according to the Draft for Comments, two more circumstances are defined as “Certain relations”:

(1) customers be mistaken that the operator has the following relationship with other business operators: commercial association, licensing relationship, title sponsor, advertising endorsements⁷

(2) Using without permission others’ registered trademark or unregistered well-known trademark as corporate name in the enterprise name⁸

2. Ceiling compensation amount RMB 5 million applies to more unfair competition infringement

According to Anti-Unfair Competition Law⁹, for two specific unfair competition activities (1) confusing acts¹⁰ and (2) trade secret infringement¹¹, if it is difficult to determine the actual losses suffered by the right holders/interest obtained by the infringer, the court shall award a compensation of less than 5 million RMB. However, for a lot of unfair competition activities, the compensation standard is not clear.

Pursuant to the Draft for Comments, currently the ceiling compensation amount of RMB 5 million will apply to four more unfair competition infringement, namely¹²:

(http://www.court.gov.cn/zixun-xiangqing-318221.html)

As always, Asiallians remains at your service and our teams are currently mobilized in all our offices in Mainland China, Hong Kong and Taipei.

1. Article 6 of the Personal Information Protection Law.

2. Article 24 of the Personal Information Protection Law

3. Article 28, 29 and 31 of the Personal Information Protection Law.

4. Article 38 of the Personal Information Protection Law.

5. For (1) Critical information infrastructure operators, or (2) personal information processors whose processing of personal information reaches the threshold amount prescribed by the national cyberspace authority, when they want to provide such information to an overseas recipient, a security assessment organized by the national cyberspace authority shall be passed; if a security assessment is not required as provided by law, administrative regulations or the national cyberspace authority, such provision shall prevail.

6. Article 66 of the Personal Information Protection Law.

7. Article 12 of draft for comment.

8. Article 13 of draft for comment.

9. Article 17 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

10. Article 6 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

11. Article 9 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

12. Article 27 of draft for comment.

13. Article 2 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

14. Article 8 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

15. Article 11 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

16. Article 12 of Anti-Unfair Competition Law of the People’s Republic of China (Revised in 2019).

Feel free to contact asiallians@asiallians.com for more information.