On October 21, 2020, the Personal taptap点点官方网站 Protection Law of the People's Republic of China (Draft) (hereinafter referred to as the "First Review Draft") was officially released to the public for comments. On April 26, 2021, the 28th Session of the Standing Committee of the 13th National People's Congress of the People's Republic of China has deliberated on the Personal taptap点点官方网站 Protection Law of the People's Republic of China (Second Review Draft) (hereinafter referred to as "Second Review Draft"). The Personal taptap点点官方网站 Protection Law of the People's Republic of China (hereinafter referred to as the PIPL) adopted at the 30th meeting of the Standing Committee of the 13th National People's Congress on August 20, 2021, is hereby promulgated, effective November 1, 2021.

The full text of the PIPL consists of eight chapters and seventy-four articles. Focusing on the processing of personal taptap点点官方网站, corresponding rules are established from different perspectives such as processing rules, cross-border provision, personal rights, processor obligations, protection responsibility departments and legal responsibilities; and special rules are emphasized for the processing of sensitive personal taptap点点官方网站 and handling of state organs. The author will interpret it from eight aspects: legislative purpose, important concepts analysis, processing personal taptap点点官方网站 rules, individual rights, processor responsibility, cross-border personal taptap点点官方网站, socialized governance and penalties.

i. Approach data flows with caution

It is not difficult to figure out from the name that the main starting point of the PIPL is to protect personal taptap点点官方网站. This is made clear in Article 1. Regarding to the legislative purpose of the personal taptap点点官方网站 protection law, Article 1 of the First Review Draft stipulates that "this law is enacted in order to protect the rights and interests of personal taptap点点官方网站, regulate the processing of personal taptap点点官方网站, ensure the orderly and free flow of personal taptap点点官方网站 according to law, and promote the rational use of personal taptap点点官方网站." Compared with the First Review Draft, the Second Review Draft takes more cautious attitude towards the flow of personal taptap点点官方网站 and deletes the expression "ensuring the orderly and free flow of personal taptap点点官方网站 according to law". In addition to following the expression of the Second Review Draft, the Personal taptap点点官方网站 Protection Law also adds the content of "in accordance with the Constitution" before "formulating this Law", which is great significance for protecting the personal dignity and other rights and interests of citizens in the provisions of the Constitution.

ii. Extraterritorial jurisdiction

On the issue of extraterritorial jurisdiction, the Personal taptap点点官方网站 Protection law adopts the same principles as the data security law. Article 2 of the Data Security Law stipulates that where data processing activities outside the territory of the People's Republic of China damage the national security, public interests or the legitimate rights and interests of citizens and organizations, legal liabilities shall be investigated according to law.

Article 3 of the Personal taptap点点官方网站 Protection Law stipulates following circumstances that can be subject to extraterritorial jurisdiction, (I) where the purpose is to provide domestic natural persons with products or services; (II) Where the activities of domestic natural persons are analyzed and evaluated; (III) Other circumstances as prescribed by laws and administrative regulations.

Sanctions are also specified in Chapter III "Rules for Cross-border Provision of Personal taptap点点官方网站". Article 42 stipulates that where an overseas organization or individual engages in personal taptap点点官方网站 processing activities infringing upon the personal taptap点点官方网站 rights and interests of citizens of the People's Republic of China, or endangering the national security and public interests of the People's Republic of China, the Cyberspace Administration of China may include such organization or individual in the list of subjects to whom provision of personal taptap点点官方网站 is restricted or prohibited, announce the same, and take measures such as restricting or prohibiting provision of personal taptap点点官方网站 to such organization or individual.

i. What is personal taptap点点官方网站

With regard to the definition of personal taptap点点官方网站, the personal taptap点点官方网站 protection law distinguishes the identification of personal taptap点点官方网站 into "identified" and "identifiable" expressions on the basis of "identification" stipulated in the Cybersecurity Law of the People's Republic of China (hereinafter referred to as "Cybersecurity Law") and the Civil Code of the People's Republic of China (hereinafter referred to as the "Civil Code"). That is, all taptap点点官方网站 related to "identified" natural persons or an "identifiable" natural persons are personal taptap点点官方网站. The Personal taptap点点官方网站 Protection Law distinguishes between "identified" and "identifiable" on the basis of "identification", integrates the elements of "association" to further improve the extension of personal taptap点点官方网站 protection.

However, it should also be noted that the provisions of PIPL are lack of operability in terms of what is "relevant", that is, how to determine the criteria of relevance, which may bring greater discretionary space to specific law enforcement and justice. Therefore, it is suggested to enumerate personal taptap点点官方网站 on the basis of the above provisions, so as to reduce the uncertainty of personal taptap点点官方网站 identification.

ii.Definition and method of personal taptap点点官方网站 processing

In Article 76 of the Cybersecurity law, processing is a concept parallel to collection, storage, transmission and exchange, while in Article 4 of the PIPL, processing has become an upper concept, while collecting, storing, using, processing, transmitting, providing, disclosing, and deleting are the specific ways of taptap点点官方网站 processing. This expression is consistent with the Civil Code and similar to the taptap点点官方网站 security technology — Personal taptap点点官方网站 security specification. Such difference may directly affect the scope of application of a specific provision. Thus, it is necessary to pay attention to the scope of "processing" in different contexts in order to accurately understand the differences between different laws and regulations.

From the perspective of the processing method of personal taptap点点官方网站, in addition to the original collection, storage, use, processing, transmission, provision and disclosure, the processing method of "deletion" is added.

i. Do not over collect personal taptap点点官方网站

Article 6 of the Personal taptap点点官方网站 Protection Law stipulates that excessive collection of personal taptap点点官方网站 is not allowed. This provision is related to the background of crackdown on excessive collection of personal taptap点点官方网站 by APP and other applications by relevant ministries and commissions in recent years. Incorporating such into the legal provisions is conducive to regulating the collection of personal taptap点点官方网站.

ii.Prohibition of data discrimination

Data discrimination is a common situation in the use of big data, and it is also a difficult problem in personal taptap点点官方网站 protection. In this regard, the personal taptap点点官方网站 protection law regulates it. In the application of big data, taptap点点官方网站 push and commercial marketing through user profiling and automatic decision-making are common application scenarios. However, it also brings problems such as algorithm discrimination and big data-enabled price discrimination against existing customers. On this point, Article 24 of the personal taptap点点官方网站 protection law make targeted regulations on the use of personal taptap点点官方网站 for automatic decision-making:

1) Where a personal taptap点点官方网站 processor makes use of personal taptap点点官方网站, it shall ensure the transparency of the decision-making and the fairness and impartiality of the results, and shall not impose unreasonable discriminatory treatment on individuals in respect of the transaction price and transaction conditions.

2) taptap点点官方网站 pushing and commercial marketing to an individual through automated decision-making shall be accompanied by options that do not target the individual's personal characteristics, or convenient rejection ways shall be provided to the individual.

3) Where a decision is made through automatic decision-making that has a significant impact on an individual's rights and interests, the individual shall have the right to require the personal taptap点点官方网站 processor to make an explanation and reject the decision made by the personal taptap点点官方网站 processor only through automatic decision-making.

iii.Clearly incorporate human resource management into the scope of personal taptap点点官方网站 processing

The Personal taptap点点官方网站 Protection Law includes the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law in the scope of exemption from individual consent.

The scenario of human resource management is relatively special, because employees and enterprises have subordinate relationship in the working relationship. In some cases, in order to achieve the reasonable purpose of human resource management, the company needs to process personal taptap点点官方网站, and the processing of personal taptap点点官方网站 in this case may not be explicitly stipulated in the labor contract. If the conventional notification consent principle is followed, it will affect the realization of the purpose of the labor contract. If the rules and regulations formulated by the company according to law are signed or informed by the employees, they are generally considered to be part of the labor contract, and thus can be considered to have completed the notice-consent procedure. Based on this, the above provisions have been added to Article 13 of the personal taptap点点官方网站 protection law.

iv.Facilitation of withdrawal of consent

Article 15 of the Personal taptap点点官方网站 Protection Law stipulates that "Where the processing of personal taptap点点官方网站 is based on the consent of the individual concerned, the individual is entitled to withdraw his/her consent. The personal taptap点点官方网站 processor shall provide a convenient method for the individual to withdraw his/her consent.".

The Personal taptap点点官方网站 Protection Law stipulates the principle of convenience. Although it has not been carried out on what is convenience, it is generally understood that the difficulty of "withdrawing consent" should not be greater than that of "consent". That is, according to common understanding of the convenience of doing business on internet, the "withdraw" button should be located in the eye-catching place of the page, or in the same easy-to-read position as the "Personal taptap点点官方网站 Protection Policy" (or privacy policy), and the check box of "withdraw consent" should be given item by item within the scope of permission.

v.Classify minor taptap点点官方网站 processing as sensitive taptap点点官方网站 processing

Article 31 of the Personal taptap点点官方网站 Protection Law takes the personal taptap点点官方网站 of minors under the age of 14 as sensitive personal taptap点点官方网站, and requires personal taptap点点官方网站 processors to formulate specialized rules for processing such personal taptap点点官方网站.

This provision is in line with the requirements of the Provisions on the Cyber Protection of Children's Personal taptap点点官方网站, raising this provision to the height of the Law. At the same time, it is much clear that as long as the personal taptap点点官方网站 involving children is protected according to the standard of personal sensitive taptap点点官方网站, which reflects the importance of the law on the protection of children's personal taptap点点官方网站 (i.e. minors under the age of 14).

vi.Exceptions to notification and consent

The Civil Code clearly states that there are exceptions - "except as otherwise provided by laws and administrative regulations", which reflects the duty of disclosure and the preconditions for obtaining consent before handling, and also gives some room for exceptions. At present, at the level of laws and administrative regulations, exceptions are scattered in different provisions. Article 13 of the Personal taptap点点官方网站 Protection Law includes six exceptions: the necessity of contracts, the handling of human resources matters, statutory responsibilities, emergencies, the reasonable handling of public taptap点点官方网站, and the reporting and supervision of public interests.

In addition, there is another exception in the PIPL, that is, the provisions of Article 26 on image collection and personal identification equipment in public places do not require personal consent if conspicuous prompting signs are set and the collected personal images and personal identity taptap点点官方网站 are used for the purpose of maintaining public security. If used for other purposes, individuals' separate consent is required.

Before the promulgation of the PIPL the Cybersecurity Law and Law of the People's Republic of China on the Protection of Rights and Interests of Consumers both made provisions on the rights of individuals related to personal taptap点点官方网站. Mainly around the "inform consent" principle, it stipulates that the personal taptap点点官方网站 subject has the right to know and consent, and the right not to collect and use personal taptap点点官方网站 without consent. taptap点点官方网站 security technology — Personal taptap点点官方网站 security specification stipulates the rights of inquiry, correction, supplement, deletion, withdrawal of authorization and consent, response, etc. In addition to the above provisions, the PIPL also defines the rights of individuals in personal taptap点点官方网站 processing activities more clearly through Articles 44 to 50. Important new contents worthy of attention are as follows:

i. Right to carry personal taptap点点官方网站

The PIPL stipulates the portability of personal taptap点点官方网站. That is, if an individual requests to transfer his personal taptap点点官方网站 to his designated personal taptap点点官方网站 processor, which meets the requirements of national cyberspace department for transferring personal taptap点点官方网站, such personal taptap点点官方网站 processor shall provide the detailed methods for the transfer.

For a long time, various Internet platforms regard users' personal taptap点点官方网站 as their important property rights and interests, and usually do not assist or cooperate in transferring personal taptap点点官方网站 to other personal taptap点点官方网站 processors except deleting personal taptap点点官方网站 as requested. The provisions of the law on the portability of personal taptap点点官方网站 are conducive to the free processing of their personal taptap点点官方网站 and provide convenient conditions for cross platform transfer of taptap点点官方网站.

ii.Personal taptap点点官方网站 protection rules for the deceased

Article 49 of the Personal taptap点点官方网站 Protection Law stipulates that "Where a natural person dies, his/her close relatives may, for the purpose of their own lawful and legitimate interests, exercise such rights as consulting, copying, correcting and deleting the relevant personal taptap点点官方网站 of the deceased as prescribed in this Chapter, unless otherwise arranged by the deceased prior to his/her death. " From the perspective of the protection of the rights and interests of close relatives and the will of the deceased, the PIPL allows close relatives to access, copy, correct and delete the personal taptap点点官方网站 of the deceased within a limited scope. This processing method is in line with the attribute of personal taptap点点官方网站 as personality right.

In order to safeguard national interests and individual rights, the PIPL lists the responsibilities of processors through processing rules and special obligations. Chapter V of the PIPL sets out some general obligations of personal taptap点点官方网站 processors, such as (a) Take necessary measures to protect the security of personal taptap点点官方网站; (b) Designate a person in charge of huge amount of data; (c) A specially assigned person shall be responsible for the overseas data processor; (d) Regular audit; (e) Personal taptap点点官方网站 impact assessment and recording; (f) Remedial measures and notification of leakage incidents etc. This article will focus on the relevant highlights of the PIPL.

i.  Special person in charge

The Personal taptap点点官方网站 Protection Law stipulates the system of "person in charge of personal taptap点点官方网站 protection" or "special institutions and designated representatives" for a certain number of personal taptap点点官方网站 processors and overseas personal taptap点点官方网站 processors.

Article 52 stipulates "Where the quantity of personal taptap点点官方网站 processed reaches that specified by the CAC, the personal taptap点点官方网站 processor shall designate a person in charge of personal taptap点点官方网站 protection to be responsible for supervising the activities of processing of personal taptap点点官方网站 and the adopted protection measures. The personal taptap点点官方网站 processor shall make public the contact taptap点点官方网站 of the person in charge of personal taptap点点官方网站 protection and submit the name and contact taptap点点官方网站 of the person in charge of personal taptap点点官方网站 protection to the authorities’ performing duties of personal taptap点点官方网站 protection. "

Article 53 is for "personal taptap点点官方网站 processors outside the territory of the People's Republic of China shall establish a special agency or designate a representative within the territory of the People's Republic of China to be responsible for handling matters relating to personal taptap点点官方网站 protection, and submit the name and contact taptap点点官方网站 of the relevant agency or the representative to the authorities performing duties of personal taptap点点官方网站 protection."

ii. Specific obligations of important internet platforms

Article 58 of the PIPL stipulates that: Any personal taptap点点官方网站 processor that provides important Internet platform services, with a large number of users and complicated business type shall perform the following obligations:

a) Establishing a sound compliance system for personal taptap点点官方网站 in accordance with the provisions of the nation.

It is clear that the platform needs to establish and improve the personal taptap点点官方网站 protection compliance system, so as to raise the construction of the "compliance" system to the legal level. This provision is a new addition to the Personal taptap点点官方网站 Protection Law, which reflects the legislative goal of the legislature that the legislature hopes enterprises to reduce the legal risk of personal taptap点点官方网站 processing and improve the level of data governance through their own compliance construction.

b) Introduce external members to form an independent agency

Setting up an independent agency mainly composed of external members to supervise personal taptap点点官方网站 protection. This system has strengthened the intervention of external supervision forces. Due to the important Internet platform services, a huge number of users and complex business types, the personal taptap点点官方网站 processor which holds their personal taptap点点官方网站 has great utilization value. Whether the enterprise's internal control system and data compliance system can be truly implemented in the implementation process needs to introduce external forces for necessary supervision.

c) Supervision responsibilities of Platform

The clause stipulates: "ceasing to provide services to product or service providers on the platform that process personal taptap点点官方网站 in serious violation of laws and administrative regulations;" and this provision is similar to the supervision responsibility of E-commerce platform operators on product quality, intellectual property rights and consumer protection of E-commerce operators in the platform stipulated in the E-commerce Law.

d)    Social responsibility reports

The article also provides that, the platform shall regularly releasing social responsibility reports on personal taptap点点官方网站 protection for public supervision. According to this principle, personal taptap点点官方网站 processing is not only the relationship between the platform and the personal taptap点点官方网站 subject, but also the embodiment of the social responsibility of the platform.

iii. Personal taptap点点官方网站 protection impact assessment

Article 55 stipulates that: Under any of the following circumstances, a personal taptap点点官方网站 processor shall conduct an impact assessment on personal taptap点点官方网站 protection beforehand and keep a record of the handling:

(I)  processing sensitive personal taptap点点官方网站;

(II) making use of personal taptap点点官方网站 to make automatic decision-making;

(III) entrusting others to process personal taptap点点官方网站, providing other personal taptap点点官方网站 processors with personal taptap点点官方网站 and publicizing personal taptap点点官方网站;

(IV)  providing personal taptap点点官方网站 to overseas parties; or

(V) other personal taptap点点官方网站 processing activities that have significant impact on personal rights and interests.

The PIPL no longer sets security assessment as a necessary prerequisite but stipulates four conditions in Article 38, at least one of which should be met:

(I) it shall pass the security evaluation organized by the Cyberspace Administration of China in accordance with the provisions of Article 40 hereof; 

(II) it shall have been certified by a specialized agency for protection of personal taptap点点官方网站 in accordance with the provisions of the Cyberspace Administration of China;

(III) it shall enter into a contract with the overseas recipient under the standard contract formulated by the Cyberspace Administration of China, specifying the rights and obligations of both parties; and

(IV) it shall meet other conditions prescribed by laws, administrative regulations or the Cyberspace Administration of China.

Article 64 of the Personal taptap点点官方网站 Protection Law stipulates:  "Where authorities performing duties of personal taptap点点官方网站 protection find in their performance of such duties that there are high risks in personal taptap点点官方网站 processing activities or personal taptap点点官方网站 security incidents have occurred, they may, according to prescribed authority and procedures, have an interview with the legal representative or person chiefly in charge of the personal taptap点点官方网站 processor concerned, or require such processor to entrust a specialized agency to conduct a compliance audit on its personal taptap点点官方网站 processing activities. The personal taptap点点官方网站 processor shall take measures to make rectification and eliminate hidden dangers as required."

According to this provision, entrusting professional institutions to conduct compliance audit on personal taptap点点官方网站 processing activities is a remedial measure that enterprises or other institutions can take when facing risks or taptap点点官方网站 security incidents. For the problems found in the compliance audit, the personal taptap点点官方网站 processor shall take measures to rectify and eliminate the hidden dangers as required.

The Personal taptap点点官方网站 Protection Law has greatly improved the diversity of punishment measures and the severity of punishment compared with the previous legislation. Article 66 is particularly representative. This article sets out three types of penalties for those who illegally handle personal taptap点点官方网站, or who do not perform the obligations of personal taptap点点官方网站 protection stipulated in the Personal taptap点点官方网站 Protection Law:

i.  Suspension or termination of services

In the event that personal taptap点点官方网站 is processed in violation of the provisions of this Law or that personal taptap点点官方网站 is processed without performing the obligation of protecting personal taptap点点官方网站 as stipulated in this Law, the authorities performing duties of personal taptap点点官方网站 protection shall order the suspension or termination of provision of services by the applications that illegally process personal taptap点点官方网站.

ii.  Huge fines 

For any illegal act with serious circumstances, the authorities performing duties of personal taptap点点官方网站 protection shall confiscate its illegal gains, and impose a fine of not more than 50 million yuan or not more than 5% of its turnover of the previous year on it, and may also order it to suspend relevant business or suspend business for rectification, and inform the relevant competent authorities to revoke the relevant business permit or business license.

iii.  Market ban

Decision may be made to prohibit the person directly in charge and other directly liable persons from acting as the director, supervisors, senior executives and persons- in-charge of personal taptap点点官方网站 protection of the relevant enterprises within a certain period of time.

The Personal taptap点点官方网站 Protection Law will undoubtedly have a profound impact on the personal taptap点点官方网站 processing behavior of the internet, taptap点点官方网站 technology industry and other industries handling personal taptap点点官方网站. In order to protect personal taptap点点官方网站, it will also bring new opportunities and challenges to enterprises. Hence, the ability of enterprise personal taptap点点官方网站 protection and governance capability will become an important competitiveness of enterprises.