China’s privacy law borrows a page from Europe’s GDPR but it goes further as Beijing shores up data security
- China’s new personal data law is one of the strictest in the world, drawing inspiration from Europe’s GDPR but going further
- Beijing has moved to tighten controls on how Big Tech uses data and curtail how private data is moved overseas
While China’s newly enacted Personal Information Protection Law (PIPL) contains many of the elements of the EU’s General Data Protection Regulation (GDPR) in terms of protecting private data from prying eyes, it goes a step further by guarding it within borders, legal experts say.
Much like the GDPR, which came into effect in 2018 and imposed red lines on how companies handle personal data within Europe, China’s PIPL is also set to have a far-reaching impact on how businesses collect and use data in China after it becomes effective November 1 – and it will also restrict cross-border data transfers.
Michael Tan, a partner at Taylor Wessing law firm in Shanghai, says PIPL will be a powerful tool when it comes to curtailing abusive data practices by Big Tech. “Many successful business cases [in China] have actually been structured on serious breaches of privacy and the data rights of others, previously unnoticed when dressed up by fancy terms like data mining, artificial intelligence, or innovation,” said Tan.
A key stipulation of the Chinese law, like GDPR, will be to empower individuals to decide whether or not to hand over their personal information to data processors. Both laws stipulate that personal information data has to be collected and processed according to a transparent and rigid protocol.
“The PIPL integrates the general principles of the GDPR and China’s distinctive national conditions as a developing country,” said Catherine Zheng, a partner at Deacons law firm.
