Cybersecurity Compliance

1. What have been the key legislative developments affecting data protection over the past 12 months?

Since 2015, China's legislation on data protection has been raised to a new level. The Amendment Bill of the PRC Criminal Law (IX) (Criminal Law), which came into effect on November 1, 2015, increases penalties and expands the scope of criminal liability to include violations such as selling or illegally offering others citizens' personal information. The Criminal Law also adds the criminal liability of internet service providers (ISPs) who fail to perform their data security management duties and subsequently cause unwanted disclosure of user information and other serious consequences.

In addition, the Implementing Regulations for the PRC Law on the Protection of the Rights and Interests of Consumers (Draft for Comments) (Consumer Protection Law Implementing Regulations) published by the State Administration for Industry and Commerce (SAIC) on August 5, 2016 provides a definition of consumers' personal information, explains what constitutes commercial electronic information and sales calls, and regulates the operators' collection and use of consumer data.