Recently, China formally passed the Personal Information Protection Law (PIPL), which is the first comprehensive national level personal data protection law of this country. PIPL will become effective as of November 1, 2021, leaving a short time for the companies operating in China (and even certain foreign companies) to become fully compliant to the new personal data protection regime.
On July 28, 2021, China’s Supreme People’s Court (the top judicial authority) published the 'Provisions on Relevant Issues on the Application of Laws in Hearing Civil Cases Related to the Application of Facial Recognition Technology in Processing Personal Information'. The provisions came into force as of August 1, 2021. They provided guidance for the courts to apply the rules scattered in Civil Code, Cybersecurity Law, Consumer Rights Protection Law, E-Commerce Law, etc. on personal data processing by using facial recognition technology, and have also set specific rules based on the recent practices of the Chinese courts. In this article we provide our comments on several highlights in the provisions.
China’s Ministry of Industry and Information Technology (MIIT), Cybersecurity Administration of China (CAC) and Ministry of Public Security (MPS) jointly published the Provisions on Administration of Security Vulnerability of Network Products (Provisions), which will be in force as of September 1, 2021. The Provisions have established rules for the detection, collection, publication and other activities in relation to the security vulnerability of network products.
A few days ago, Cyber Administration of China (CAC) has shaken the online business sector with the cybersecurity review on Didi (world’s biggest online ride-hailing company) and other three online business companies to prevent data security risks, citing the Cybersecurity Review Measures.
Shenzhen, the leading financial and production center for China and home of many Chinese internet and tech giants such as Huawei, Tencent and DJI, enacted its regional data protection law, Data Regulation of the Shenzhen Special Economic Zone (Shenzhen Data Regulation) on June 29, 2021. Shenzhen Data Regulation will become effective as of January 1, 2022.
On July 2, 2021, the Cyberspace Administration of China (CAC) announced on its website that it has started a cybersecurity review on Didi (world’s biggest online ride-hailing company), and during the review Didi is not allowed to register new users. CAC did not offer details about this law enforcement action, but said its purpose is to prevent data security risks, citing its Cybersecurity Review Measures. The announcement (see here) was published just two days after Didi’s huge IPO on NYSE. On the same day, Didi’s share fell as much as 10.9% after the open and was closed with a down of 5.30%. On July 4, 2021, CAC further ordered the removal of Didi’s ride-hailing app from the app stores with the reason that the app has “severely violated the laws and regulations when collecting and using personal information”, and On July 5, 2021, CAC further announced cybersecurity review on three other online platform operators providing cargo transportation hiring services and recruitment services.
Chinese Government recently enhanced the regulations on mobile apps’ data processing through new regulations and active law enforcement actions . On March 22, 2021, Cybersecurity Administration of China (CAC) jointly with other government authorities issued Regulations on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications, which defined the scope of necessary personal information for 39 common types of apps and prohibited the operators of the apps from collecting “unnecessary” personal information from the users. Since the Regulations come into effective as of May 1, 2021, CAC has released four announcements on a total number of 351 apps with irregularities in personal information processing activities. In this articles, we summarized the trends reflected in those recent law enforcement actions of CAC and provided several key points on the compliance works for personal information protection in the development and operation of Apps.
On June 10, 2021, China's National People’s Congress Standing Committee passed the Data Security Law (DSL). The DSL will become effective as of September 1, 2021, leaving less than three months for companies to adapt to the new data security regime. Garrigues has been closely following the legislative process of such law and we hope this article will help you to better understand the key contents of the DSL and its major implications on your business.
China’s data protection authorities have strengthened the regulations on personal information processing activities of mobile internet applications (App). Since May 1, 2021, in the law enforcement campaigns against over collection and coercive collection of personal information by Apps, a total number of 222 Apps have been ordered to be removed from App stores. On April 26, 2021, Communications Administration of Ministry of Industry and Information Technology of China released the Interim Provisions on Administration of Personal Information Protection of Mobile Internet Applications (Draft for Public Comment) (Provisions) seeking for public opinions. The Provisions detailed the compliance requirements on the personal data protection for Apps and provided policies and standards reflected in the recent law enforcement proceedings comprehensively for the first time.
China recently published the second version of the draft Data Security Law (DSL) with the purpose of seeking public opinions. According to the legislative plan of its legislative authority, China will formally enact the DSL within 2021. Hence the legislative authority is expected to perform a final review on the DSL and then pass the bill into law in the next few months. Considering the immediate and significant implications of the DSL on the PRC data protection and data security legal regime, in this article we provide you with some highlights of this new version of DSL (New Version of DSL).