Data Backup Digest

China hasn’t exactly been known as pioneers of consumer data protection. In fact, they’ve notoriously remained one of the few developed countries left that doesn’t regulate or protect consumer data whatsoever – until recently.

Set to go into effect in November 2021, China’s new regulations, known as the Personal Information Protection Law, specifically prohibits any sort of illegal means that involve “collecting, using, processing, transmitting, disclosing, and trading people’s personal information,” according to a report issued by Xinhua News Agency.

Prior to the Personal Information Protection Law, there were absolutely no laws regarding the collection, usage, or distribution of this sort of information. This includes people’s full names and contact information.

What China did have, however, was a series of fractured and disconnect legal provisions that were loosely tied to their pre-existing data privacy laws. In most cases, however, these provisions were lacking the necessary integrity – and urgency – needed to actually help consumers in any sort of meaningful way.

The law takes it even further by clarifying exactly what is meant by terms like “processing” and “provision,” although, at the time of this writing, the full text of the law has yet to be released to the public.

Built out of Necessity

China’s new data privacy laws are certainly built out of necessity. It’s likely not a coincidence that the laws come on the heels of several major cases involved Chinese IT firms mishandling consumer data. According to representatives in Beijing, these issues pose serious threats to national security.

According to Alex Capri, a researcher with the Hinrich Foundation: “Data has become increasingly strategic, particularly as more powerful AI, algorithms and machine learning, combined with state-sponsored cyber activities, become more pervasive.”

Moreover, the new laws are meant to help reinforce regulation of the country’s public surveillance system, which is a controversial subject on its own. Their vast, country-wide network of cameras uses next-gen facial recognition alongside highly advanced AI algorithms to identify individuals and public and track crime.

The Personal Information Protection Law specifically forbids companies from using customer data for the means of marketing or advertising. Moreover, companies must make it easy for consumers to opt out of any forms of advertising that are being used.

Finally, the law makes it clear that sensitive personal information – including healthcare status, financial standing, and biometric information – cannot be processed, used, or shared without the individual’s consent.

It’s also important to note that the new laws also come shortly after several of their largest tech firms have successfully attained placement on the U.S. stock exchange; including companies like Didi, Full Truck Alliance, Kanzhun, and more.

Nonetheless, companies that fail to comply with the new laws starting on November 1 will be subject to significant fines and, in severe cases, temporary suspension or complete termination of their company. News of the upcoming laws caused stocks on the Hang Seng Tech Index to drop significantly, marking the index’s worst weekly report in several months, but this is generally seen as a huge step in the right direction for the country as a whole.