## [Data protection: Chinese authorities put compliance pressures on online business operators](/pl/en_GB/new/data-protection-chinese-authorities-put-compliance-pressures-online-business-operators)
# Data protection: Chinese authorities put compliance pressures on online business operators
China - 07 / 05 / 2021
Data Protection Alert
-
- [](https://www.linkedin.com/sharing/share-offsite/?url=https://www.garrigues.com/pl/en_GB/new/data-protection-chinese-authorities-put-compliance-pressures-online-business-operators)
- []()
- []()
Previous Next
**On July 2, 2021, the Cyberspace Administration of China (CAC) announced on its website that it has started a cybersecurity review on Didi (world’s biggest online ride-hailing company), and during the review Didi is not allowed to register new users. CAC did not offer details about this law enforcement action, but said its purpose is to prevent data security risks, citing its Cybersecurity Review Measures.**
The announcement (see [here](http://www.cac.gov.cn/2021-07/02/c_1626811521011934.htm)) was published just two days after Didi’s huge IPO on NYSE. On the same day, Didi’s share fell as much as 10.9% after the open and was closed with a down of 5.30%. On July 4, 2021, CAC further ordered the removal of Didi’s ride-hailing app from the app stores with the reason that the app has “severely violated the laws and regulations when collecting and using personal information”, and On July 5, 2021, CAC further announced cybersecurity review on three other online platform operators providing cargo transportation hiring services and recruitment services.
China’s Cybersecurity Law and CAC’s Cybersecurity Review Measures require that the operators of critical information infrastructure (**CIIO**)[\[1\]](#_ftn1) shall undergo a cybersecurity review before CAC when procuring network products and services. The law also has established other cybersecurity related obligations and the cybersecurity/national security reviews for network operators in processing important data and personal information. Taking into account that the above investigations are all connected to companies with personal information (of the drivers, passengers and job applicants) and important data (road, traffic, location, etc.) and were recently listed at foreign capital market, international transfer of data could also be an element that attracted the concern of CAC. Recently, China further developed the compliance obligations on data security with enactment of the Data Security Law, which, among others, established multiple mechanisms to regulate cross-border data flow and also authorized CAC to design the rules for non-CIIOs to transfer the important data outside of China (See our previous [article](https://www.garrigues.com/en_GB/new/china-passes-data-security-law) on Data Security Law).
Huge efforts have also been made by the Chinese regulators on law enforcement. Apart from the recent investigations of CAC on Didi and other online platforms which seem to be a more specifically targeted and national security related move, the Chinese authorities have also been actively enforcing personal data and other online business related regulations covering all kinds of business. For example, CAC has been actively regulating smart phone apps to combat violation of personal data protection (See our recent [article](https://www.garrigues.com/en_GB/new/review-chinas-recent-law-enforcement-data-protection-apps) analyzing CAC’s actions.). In the meantime, as of June 21, the Ministry of Industry and Information Technology (**MIIT**) has also reviewed 1,170,000 mobile phone apps, required 4,002 apps to correct their irregularities, publicly denounced 1,248 apps that failed to correct within given time limit and ordered the removal of 329 apps from app stores.
Cybersecurity and data protection are not the only compliance pressure on the companies operating online business. Chinese authorities are also using other tools in their toolbox, such as anti-trust and unfair competition regulations. For example, a CNY 18.2 billion fine has been imposed by State Administration for Market Regulation (**SAMR**, China’s market regulator) on ecommerce platform Alibaba who abused its market dominance by prohibiting the online store owners from opening stores or doing promotions on other ecommerce platforms. SAMR is also amending the Provisions on the Administrative Punishment of Price-related Violations, which will provide a clearer legal ground to prohibit unfair competition tactics of in ecommerce, such as price dumping and pricing discrimination by using big data and data profiling.
The tightened regulation on online business and active law enforcement may be good for creating a healthy environment and would also bring more competitions into the market, which will eventually benefit all the players. However, companies who have online business should also be mindful of the latest developments to better manage the compliance risks.
---
[\[1\]](#_ftnref1) Critical information infrastructures (**CIIs**) refers to any information infrastructure that can endanger national security, national strategy, and civil welfare in the event of a data breach, compromised network, or system malfunction. There has been no publicly available list of CIIs but according to a guideline of China’s public security authority, CIIs can be websites such as the official websites of Chinese Communist Party, government authorities, public institutions, enterprises and websites that provide public information services to the public; online shopping, online payment, tourism and travelling, forum, map, music and video, search engine, online subscription and other platforms and all kinds of smart application platforms; and office and business systems, industrial control system, large data center, could computing platform, television broadcasting system, etc.
[Data Protection](/pl/en_GB/tags/data-protection), [Compliance](/pl/en_GB/tags/compliance), [China](/pl/en_GB/tags/china)
---
This publication is provided for information purposes only and does not constitute legal advice or advice of any other kind. It does not seek to offer a comprehensive summary of the legislation and developments to which it refers nor to cover all published material, but rather to provide an overview of selected topics. It is therefore recommended that the official texts be consulted and specific professional advice be sought. Garrigues does not accept any liability for the use made of this information and assumes no obligation to update it after publication.
---
### Contact
[Manuel Torres](/pl/en_GB/team/manuel-torres-salazar)
[Contact]()
- +86 21 5228 1122
[Shanghai](https://www.garrigues.com/pl/en_GB/office/shanghai)
[Find more professionals](../team)
### Related services
- [Media and Entertainment ](/pl/en_GB/services/media-and-entertainment)
- [Technology, Communications and Digital ](/pl/en_GB/services/technology-communications-and-digital)
### Related offices
- - [Shanghai](/pl/en_GB/office/shanghai)
## Find a publication
Select service Administrative and Constitutional Law Agribusiness and Food Automotive Banking and Finance Corporate and M&A Criminal Law and Internal Investigations Data Economy, Privacy and Cybersecurity Dispute Resolution: Litigation and Arbitration Energy EU and Antitrust Law Family Business Fashion Law Financial Regulation Human Capital Services Infrastructure Insurance Intellectual Property Labor and Employment Life Sciences and Healthcare Media and Entertainment Planning, Zoning and Environment Private Equity Real Estate Restructuring and Insolvency Securities Markets Sports Startups & Open innovation Sustainability Tax Technology, Communications and Digital Tourism and Hotels Transport, Logistics and Shipping Facet Services detail Facet Services detail
Select type of content Publications Newsletters Garrigues collection Laws: amendments at a glance News Facet Publication type detail Facet Publication type detail
Min
Max
## News search engine