New privacy law – November deadline approaching

On November 1st, the Personal Information Protection Law will enter into force in China. This change in legislation involves all companies operating in the Chinese market, as they must comply with the new norms.

The new law is considered to be consistent with Beijing’s strategy on countering big tech and their power. The government is committed to avoid the creation of monopolies, discipline data processing, and balance profitability and economic performance.

The new Chinese privacy law features similar regulations to the General Data Protection Regulation (GDPR), which has entered into force in 2018 in every country of the European Union, following a long discussion and implementation process.

Regarding individual privacy protection, the new law states that a person is entitled to know which set of information has been collected, to deny consent on data processing, and to demand amendments or cancellation from database.

Companies such as Alibaba, Tencent, or DiDi, dealing with large-scale quantities of data, will need a completely different approach in managing their activities and customer relationship. Companies operating in other areas will need to raise their standards to become compliant with the new norms.

Concerning personal data processing, the law states that explicit consent from the interested party must be sought through contract, unless a preeminent public interest or a health emergency situation is recognized, such as during the pandemic. The Cybersecurity Authority of China (CAC) supervises and assesses compliance with the norms.

The new law concerns Chinese and foreign companies operating in the Chinese market. Companies might be sanctioned or blacklisted when found not compliant with the law or when found to have transferred sets of data towards countries with less stringent regulations.

The law’s main objective is to tackle big tech abuses, however, every company should quickly implement internal policies and verify compliance with the Personal Information Protection Law.