Implications of New Chinese Legislation for Data and Cybersecurity

Data privacy

At the end of May 2019, China's internet regulator, the Cyberspace Administration of China, or CAC, issued a draft data security regulation for feedback from industry stakeholders. The proposed law is intended to give customers more control over how their personal information is collected and used.

The draft regulations lay out specific rules regarding what can or cannot be done by internet companies in their collection and usage of customer data. Explicit labeling needs to be provided on customized content that uses personal data, such as advertising and news feeds. Network operators are also required to avoid forcing or misleading users to agree to the collection of their personal information on such pretexts as improving service quality or enhancing user experience.

The regulation applies to the network-based collection, storage, transmission, processing, and use of data, as well as data security protection and supervision in the country. It also requires operators to take immediate actions in the event of personal information leakage or when data security risks increase significantly.