Data privacy protection
As the dramatic developments of internet and business in China, peoples’ data privacy protection has met unprecedented challenge. Recently, China made a great step forward in the protection for data privacy. And now let’s outline this progress based on the following points.
1. Q: What’s the great progress in data privacy protection?
A: As the first revision of China’s old Consumer Rights Law since its promulgation in1993, the newly revised Consumer Rights and Interests Protection Law of People’s Republic of China (promulgated on October 25, 2013) will take effect on March 15, 2014. The revised Consumer Rights Law makes an attempt to bring the law in this area up to the data privacy protection by providing rules governing the collection, use and security of consumer personal information.
2. Q: The brief introduction of the data privacy protection prior to the promulgation of new Consumer Rights Law.
A: Actually, there is no comprehensive data protection law in China so far. Before this advance in Consumer Rights Law, general data privacy protection has been mainly regulated by the Decisions of the National People’s Congress Standing Committee on Strengthening Internet Information Protection and the National Standard on Information Security Technology- Guideline for Personal Information Protection Within Information System for Public and Commercial Services along with other protection provisions scattered across different PRC laws and regulations.
3. Q: What are the provisions of data privacy protection in the new Consumer Rights Law?
A: The data privacy protection obligations are provided in article 14 and article 29 in new Consumer Rights Law. Article 14 states that consumers shall have the “right to have personal information protected in accordance with the law” when purchasing and using merchandise or service and article 29 makes a specific provisions of how to protect data privacy during the collect and use of consumer personal information no matter online or offline as follows:
(a) Purpose, method, scope and rules of collection and use of personal information shall be explicitly stated and consented to by consumers
(b) Business operators shall keep the personal information confidential and not disclose, sell or illegally provide the personal information to others
(c) Business operators shall also take technical or necessary measures to ensure information security and to prevent information disclosure or loss and
(d) Sending commercial information to consumers is prohibited where the consumer has not consented or requested it, or where the consumer has indicated that he/she does not want to be sent such information.
4. Q: How to evaluate the above provisions?
A: Although article 29 requires the business operators to notify consumers of the information set out in (a) above and to obtain the consumer’s consent, article 29 does not define the format of such notification and consent. Neither does article 29 stipulate whether the notification has to be given orally or in written form or whether opt-in, opt-out, oral or written consent is required. However, the addition of data privacy protection in the new Consumer Rights Law will fill the legal void and make the Consumer Rights Law an integral part of the laws and regulations governing data privacy in China, since prior to the revision, the main rules mentioned above is partly applicable to consumer personal information though, only the consumer personal information in electronic form is covered.
5. Q: What are the penalties for the breaking of the article 29 of new Consumer Rights Law?
A: A breach of article 29 may result in the business operator facing such consequences as confiscation of illegal earnings in conjunction with a fine between twice and ten times the value of the illegal earnings. Where there are on illegal earnings, a fine below RMB 500,000may be imposed.
6. Q: The influences of the addition of data privacy protection in new Consumer Rights Law?
A: Despite the limitations above, compliance with such provisions is strongly recommended. Since it reflects a general trend toward data privacy regulation in China and more attentions of the government authorities are attracted on this area and more steps are taken to enforcing the personal information protection. While we expect authorities will more often than not issue warnings before bringing enforcement actions, businesses that collect or use consumer information should consider strategies to be able to comply by the time this law takes effect on March 15, 2014.
|
