Landmark Court Ruling Adds Clarity to China's Personal Data Export Regime

Summary

---

• A recent provincial-level court ruling provides important clarity on a number of key points on the operation of the Personal Information Protection Law
• The ruling is a good example of the extraterritoriality of certain provisions of the PIPL
• The case clarifies where pre-litigation requirements apply and when checking a box in an app can amount to giving legally valid consent, and when and to what extent a data handler could argue necessity as a basis for processing
• The Court also proposed a helpful analytical framework for personal information handlers relying on "contract necessity" as a legal basis for data processing

On September 2, 2024, the Guangzhou Internet Court ("the Court") released a series of typical cases involving cross-border data disputes, including a case on which it has rendered final judgment, the Case on Personal Information Export – the first China judgment on cross-border data transfer. In this case, the Court ruled that a multinational hotel group, as the personal information handler ('controller' in the EU GDPR sense), conducted personal information export activities in violation of the Personal Information Protection Law (个人信息保护法, "PIPL") and must compensate the Plaintiff for damages of RMB 20,000 as well as issuing a written apology. The ruling has also been published in the China Judgments Online database with the case number (（2022）Yue 0192 Min Chu No.6486).

The ruling clarifies several specific issues regarding the compliance requirements stipulated in the PIPL, including the application and boundaries of the legal basis and justification for information export , and the determination of compensation amounts. The decision provides a greater degree of legal certainty as well as carrying compliance implications for companies exporting personal information from China.