On August 20, 2021, the People’s Republic of China Congress passed a new national personal data protection law.
The Personal Information Protection Law (“the PIPL”) establishes a set of rules on the collection and processing of personal information. Its main purpose is to protect personal information rights and interests, standardize personal information handling activities, safeguard the lawful, orderly, and free flow of personal information, and stimulate the reasonable use of personal information.
The spirit of the PIPL resembles the EU GDPR.
We summarize below some aspects of the law:
- Scope: The PIPL applies to organizations and individuals’ handling personal information activities of natural persons within the borders of China. It also applies in specific information processing activities conducted outside its borders.
- Definition of personal information: The term covers all kinds of information recorded by electronic or other means, related to identified or identifiable natural persons, not including information after anonymization handling.
- Legal basis: The PIPL recognizes several legal bases for the processing of personal information, such as the individuals’ consent, the existence of a contract, the necessity for performing legal duties or legal obligations, the necessity for dealing with public health emergencies or for the protection of the life, health, and property safety of a natural person; among others.
- Sensitive information: Sensitive...
