Building a new data protection framework

|

Data collection and use

Personal information addressed under the Decision refers to “electronic information which can be used to specify the personal identity of a citizen or concerns privacy of a citizen”. This definition is similar to the one found in the German Federal Data Protection Act (BDSG). The principles for collection and use of personal electronic information are also similar to those in the “transparency, legitimate purpose and proportionality” principles of the European Union Data Protection Directive (see figure 2).

The principles and obligations in figure 2 apply to internet service providers, enterprises and institutions. This application scope is broad and has the potential to cover all entities involved in the data collection and processing business. Entities are required to use technical and other necessary means to ensure information security and immediately take remedial measures when the related information is divulged, sabotaged or lost. A similar obligation is imposed on government agencies and staff that are required to keep confidential, refrain from disclosing, alternating, sabotaging, selling or illegally providing to others the personal electronic information within their awareness when performing their duties.

|

Cracking down on data theft

The Decision mentions that the State protects personal electronic information. It stresses that no organisations or individuals shall steal or use other illegal means to acquire personal electronic information of citizens, nor shall they sell or illegally provide to others personal electronic information. Any organisation or individual has the right to report these activities to the competent authorities who can then handle the issue in a timely manner according to law. The victim may go on to file an action. This just reiterates what already exists under present laws like the PRC Tort Liability Law (中华人民共和国侵权责任法) and the Criminal Law.

The Decision outlines a crackdown on spam messages. It stipulates that, without consent, or request of, or when explicitly declined by the recipients, any organisation or individual should not send electronic information of a commercial nature to fixed line phones, mobiles or personal e-mail accounts. Whenever a citizen discovers internet information divulging their personal identification or privacy, or when they are harassed by electronic information of a commercial nature, they have the right to request the respective internet service provider to delete the related information or to take other preventative measures. In the past, this principle has never been addressed under national-level legislation and corresponds to the driving factor behind the Decision – the desire to curb spam messages and the related abuse of private data.

|

Tightened user and information control

It is worth noting that the Decision strengthens the system of user identification management. If an internet service operator offers network services like website access, fixed-line telephone services, mobile services or provides information dissemination services, the operator shall ask its customers to provide real identity information when concluding a service agreement or confirming provision of services. Such an identification registration system is not new for mobile and fixed line services – it was already introduced years ago, but for the first time has been extended to the internet sector.

This may be a controversial development for the industry and is a quite unique feature of the Chinese data protection regime. At the same time, when stressing the importance of private rights protection and judicial remedies, it reflects the tendency to resort to administrative power and control to regulate protection. This system becomes even trickier when the Decision pushes down responsibility (see figure 3) to data service operators to strengthen management of the information publicised by its users.

This tone is in line with the Chinese government's desire to strengthen regulation of the internet sector. It also reflects a United Nations telecommunications conference at the end of 2012 when China, together with Russia and some other countries, backed the UAE's proposal of a stronger government say in internet affairs. The proposal was strongly opposed by the US. The Decision potentially provides a legal basis for the Chinese authorities to fortify its existing content censorship system in the internet sector. This system already creates a practical hurdle for international players like Google or Facebook to expand their business in the China market.

|

Outlook

The few principles laid out by the Decision cannot be used to try data protection cases. They mainly touch upon administrative legal consequences by referring to administrative punishments like warnings, fines, confiscation of illegal gains, revocation of licence, shutting down of websites and prohibiting relevant personnel from engagement in internet service business. No details regarding how these punishments shall be imposed is further specified. From a company compliance perspective, it does not provide detailed guidance for industrial players to follow. More importantly, it does not create any new civil remedies for private data subjects, nor does it address some popular issues in the West like cross-border data transfer and employee data protection.

The Decision itself, however, is a pragmatic step forward for data protection legislation in China. According to Article 9 of the PRC Legislation Law (中华人民共和国立法法) promulgated on March 15 2000, the standing committee of the NPC has the power to make decisions regarding matters which are not yet addressed by official legislation of the NPC. The Decision will function as a legal basis for the national-level government to create administrative rules to regulate these matters according to practical demands. It also provides an upper-level legal basis for existing administrative rules regulating data protection topics. It is foreseeable that various stakeholders will issue detailed administrative regulations to implement the principles in the Decision. Whether these new regulations will create order for the Chinese internet industry or bring more potential hurdles for businesses remains to be seen. International players who have a stake in China should keep a close eye on this new legislation trend and be prepared for a potentially more challenging business environment, with more stringent data protection requirements.

Michael Tan and Sherry Duan, Taylor Wessing, Shanghai