How to comply with PIPL

China’s PIPL or Personal Information Protection Law officially took effect on November 1, 2021. China’s new data protection law will potentially have the greatest reach of global privacy laws, since it protects one of the world’s largest populations. Certainly, it deserves your attention if you conduct business in China. The consequences for failing to comply could include high penalties and even government redlisting and restriction of activities. So, let’s look at China’s data protection law and consider key points to keep in mind for PIPL compliance.

Besides regulating organisations’ and individuals’ handling of personal data belonging to natural persons within the jurisdiction of China, the PIPL is a data law that extends the territorial scope beyond China’s borders.

Data processing activities established outside of China are also covered if one of the following circumstances is present:

• The purpose is to provide products or services to natural persons inside China’s border
• Other circumstances provided in laws or administrative regulations
• Conducting analysis or assessment of activities of natural persons inside the borders

Therefore, all websites, companies and organisations in the world should comply with the PIPL if they offer goods or services to Chinese citizens.

PIPL caps fines at 5% of a company’s annual revenue of the previous year or CNY 50 million(about €6.7 million). PIPL’s upper limit for fines is for “grave” violations (an undefined term). Chinese authorities may also: suspend offending business activities, stop business activities entirely, cancel administrative and business licences, or place offending organisations on a red list and restrict or prohibit them from collecting personal data.

The Cyberspace Administration of China is the primary body responsible for enforcing PIPL compliance. However, several other state council departments may also regulate the PIPL and issue implementing regulations.

PIPL protects all kinds of information, whether recorded by electronic or other means, that relates to identified or identifiable natural persons (excluding anonymised data). The language allows Chinese authorities to take a broad approach when interpreting what constitutes personal information in practice.

PIPL gives special protection to personal information that, if you were to disclose it or use it illegally, may easily cause grave harm to the dignity, personal, or property security of natural persons. This includes, but is not limited to:

• Biometric characteristics
• Religious beliefs
• Specially designated status, medical health
• Financial accounts
• Individual location tracking
• Personal information of minors under the age of 14

This open list describes sensitive data that “may easily cause grave harm”. In this way, it allows the PIPL to consider some data as sensitive that the GDPR may not. To process this type of sensitive personal information, you should obtain a separate consent.

The most common legal basis under PIPL is consent, which must be informed, voluntary and explicit. (Art. 13 lists other legal bases). If your processing purpose, processing method, or the type of personal information you process changes, you’ll need to get a new consent. Unlike GDPR, PIPL does not recognise “legitimate interests pursued by the controller” as a legal basis for personal information processing. This and other aspects of the PIPL put extra emphasis on obtaining consent.

For PIPL compliance, you must provide consumers with a comprehensive description of your online and offline practices. For example, how you collect, use, disclose, or sell personal information. Additionally, you should list people’s data rights in clear and easy-to-understand language.

PIPL emphasises the following principles for processing data:

• Legality
• Appropriateness
• Necessity and Good Faith
• Clear and Reasonable Purpose (includes data minimisation)
• Openness and Transparency
• Quality Assurance and Accountability (includes accuracy and security).

PIPL requires a “clear and reasonable purpose” for processing data, and that the collection of personal information be minimised and not excessive, along with the security of personal information. The PIPL requires companies to establish policies and procedures on personal information protection, implement technological solutions to ensure data security, and carry out risk assessments prior to engaging in certain processing activities.

Offshore organisations that process data belonging to Chinese citizens must establish a dedicated office or appoint a representative in China to be responsible for personal information protection in China.

Specifically provides that organisations shall establish a mechanism for receiving and processing individuals’ rights requests. No specific timeline or extension period requirements. If an individual’s request for the exercise of their rights is rejected, the reasons shall also be explained. Individuals may in turn file a lawsuit with a People’s Court according to the law to challenge the rejection of their DSR requests.

Individuals have ‘the right to know and the right to decide’ when it comes to their personal information; and request handlers explain their handling rules. The PIPL includes an additional requirement for personal information handlers to notify individuals of the name/personal name and contact method of the receiving party when sharing their data with third-parties.

Individuals have the right to access and copy their personal information from the data controllers. Following are few exceptions to this right:

Where state organs process personal information for the purpose of fulfilling statutory duties and responsibilities.
Where laws or administrative regulations provide that confidentiality of personal information shall be preserved.

A unique characteristic of the PIPL is that all data rights extend beyond an individual’s death and can be exercised by close relatives of the deceased unless otherwise arranged by the decedent during their lifetime.

Individuals have the right to deletion and requires a data controller to proactively delete personal information where one of the following circumstances occurs; if the personal information handler has not deleted their data in these circumstances, individuals have the right to request deletion when:

• The processing purpose has been achieved, is impossible to achieve, or the personal information is no longer necessary to achieve the processing purpose
• Data controllers cease the provision of products or services, or the retention period has expired
• The individual rescinds consent
• The data controller processed the personal information in violation of laws, administrative regulations, or agreements
• Other circumstances provided by laws or administrative regulations

Where the retention period provided by laws or administrative regulations has not expired, or personal information deletion is technically hard to realise, data controllers shall cease personal information processing except for storage and taking necessary security protective measures. The PIPL also provides individuals the right to limit, or refuse the processing of their personal information by others, unless laws or administrative regulations stipulate otherwise.

Individuals have the right to request personal information handlers correct or complete their personal information. Where individuals request to correct or complete their personal information, data controllers are required to verify the personal information and correct or complete it in a timely manner.

Individuals have the right to request a data controller to transfer their personal information to another data controller. However, specific conditions for moving data will be determined by state cybersecurity and information departments.

In PIPL, individuals have the right to withdraw consent. However, PIPL states that withdrawal of an individual’s consent does not affect the effectiveness of the personal information processing activities that have been carried out based on the individual’s consent before the withdrawal.

The PIPL does not provide an explicit right to object automated decision. However, it requires that if the data controller conducts information push delivery or commercial sales to individuals through automated decision-making methods, the data controller shall provide the option to not target an individual’s characteristics, or provide the individual with a convenient method to refuse to the automated decision-making processing.

Organisations should conduct risk assessments and record them before conducting “specific personal information processing activities” that have a significant impact on individuals, such as processing sensitive PI, automatic decision-making, entrusting processors, providing PI to third parties and so on. Even when the high-risk standard is not met, it is still prudent to conduct a DPIA to minimise liability and ensure best practices for data security and privacy are being followed in your organisation.

In PIPL, transferring personal information outside the territory of China should meet three necessary conditions: (1) obtaining the personal information subject’s separate and informed consent; (2) conducting personal information protection impact assessment and making record; and (3) adopting one of the measures set forth in the PIPL to ensure that adequate safeguards would be provided for the transfer.

For PIPL compliance, you must also ensure data protection standards are met after transfer. The PIPL stipulates that without the approval of the Chinese regulatory authority, personal information stored in China shall not be provided to judicial or law enforcement agencies outside China. This provision is in line with the newly enacted Data Security Law of China.

According to PIPL, the data controller must have an internal management structure and operating rules, processing limits framework, and technical security measures such as encryption & de-identification. Data controllers should also have a mechanism for the categorised management of personal information. Data controllers should conduct audits of their processing activities and compliance with other laws; conduct security education and training of its employees; and implement additional safeguards for sensitive personal information and processing.

You must take immediate action and notify the relevant agency and affected individuals. When the measures taken can effectively avoid damages to personal information, you do not have to notify individuals.

When engaging third parties to process people’s personal information, you must conclude an agreement that specifies:

• The purpose of processing
• A time limit for the third party to retain the data
• Their data-handling methods
• Categories of data they will access
• Their data protection measures
• The rights and duties of both sides

Further, you should supervise the entrusted party to make sure they handle the data properly. The entrusted party, in turn,  must handle personal information according to the agreement. They should also take measures to safeguard the security of the personal information they handle and assist you in fulfilling your PIPL obligations.

You may need to appoint a Personal Information Protection Officer in specific situations, depending on the volume of personal information you process. China’s state cybersecurity and informatisation department will provide clarity on the volume threshold. Data controllers are also required to disclose the methods of contacting Personal Information Protection Officers and report the names of the officers and contact methods to the departments in charge of personal information protection duties and responsibilities.

For PIPL, data controllers that provide internet platform services to a large (undefined) number of users and have complex business models must:

• Establish and complete personal information protection compliance structures
• Establish an independent body to supervise personal information handling
• Follow the principles of openness, fairness, and justice
• Immediately cease their service offerings when in serious violation of the law
• Regularly publish reports on the social responsibility of personal information handling

PIPL does not provide an explicit requirement for having a record of data processing activities. However, the PIPL compliance requires audits of their personal information activities and adherence to laws and administrative regulations. It also requires you to save personal information protection impact assessment reports and handling status records for at least three years.

In Safe Online, we create tools that comply with international data regulations such as PIPL.