Research under China’s Personal Information Law

Xiaojie Li,Yali Cong,Ruishuang Liu

DOI: https://doi.org/10.1126/science.abq7402

IF: 56.9

2022-01-01

Science

Abstract:The new law may present obstacles to some kinds of research

What problem does this paper attempt to address?

China’s Personal Information Protection Law

Daoxin Yin,Xiaojie Li,Ruishuang Liu,Luxia Zhang,Qi-Min Zhan

DOI: https://doi.org/10.1136/bmj-2022-072619

2022-10-17

BMJ

Abstract:Privacy aims must be reconciled with the need for medical research in the public interest

medicine, general & internal
Study on Compliance of Personal Biometric Information Processing Protocols in Financial APPs

Chen Fei,Mao Mengzhi,Li Youxing

DOI: https://doi.org/10.3969/j.issn.1674-747x.2023.03.005

2023-01-01

Abstract:From the perspective of personal biometric information processing protocols, this article conducts a systemic study of the compliance of personal biometric information protection of mainstream financial APPs in an empirical way, including“protocol consent mechanism”,“protocol independence setting”,“protocol preservability”,and“protocol clause content.”The study finds that the current financial APPs are widely faced with the problem of failing to obtain user’s consent and fully inform users of matters related to information processing, and the lack of issues that should be informed to individuals in relevant agreements, which reflect the oversight of the current information processors’ internal control and the lack of supervision. We should focus on consolidating the legal obligations of processors and supervisors, and explore the trinity of “internal control, self-regulation and supervision”for compliance.
A Sociosemiotic Exploration of Personal Information Legislation in the United States and China

Le Cheng,Xitao Hu

DOI: https://doi.org/10.1177/21582440241299677

IF: 2.032

2024-01-01

SAGE Open

Abstract:Personal information security has become a critical concern in the digital era, so it is imperative to clearly delimit and define personal information. This study examines personal information legislation from a sociosemiotic perspective to identify the similarities and differences between legislation in the United States and China. It reviews the evolution of personal information in both countries, and explores their differences in the definition of privacy, the status quo of personal information legislation, the definition of personal information and cross-border personal information flow. The findings indicate that (1) personal information, noted as a social sign, has context-sensitive characteristics, i.e., spatiality and temporality; (2) the meaning-making process of personal information is a continuum; and (3) there exists an intersemiotic operation between language, law and society. Such a sociosemiotic exploration can shed light on relevant studies in the sociosemiotic analysis of legal discourse in particular as well as other context-sensitive discourses in general.
China’s souped-up data privacy laws deter researchers

Dyani Lewis

DOI: https://doi.org/10.1038/d41586-023-01638-1

IF: 64.8

2023-05-25

Nature

Abstract:Recent regulations have strengthened Chinese data privacy, but are impinging on international research collaboration.

multidisciplinary sciences
Whose data is it anyway? An empirical analysis of online contracting for personal information in China

Qin Zhou

DOI: https://doi.org/10.1080/10192557.2022.2117484

IF: 0.542

2022-09-14

Asia Pacific Law Review

Abstract:China's data governance has garnered global attention. An important part of data governance is the protection of personal data. Many believe that the newly issued Personal Information Protection Law (PIPL) can improve the protection of personal information in China. However, the merits of this specialized law rest in part on empirical exams. This paper explores whether the PIPL can solve the issues existing in online contracting for personal information in China. It firstly introduces provisions related to contracting for personal information before the promulgation of the PIPL. It then identifies three critical issues regarding online contracting for personal information in China after reviewing 202 online peer-to-peer lending platforms' terms of service and privacy policies. These issues include privacy policies that are not readily accessible, the substantial variation between terms of service and privacy policies pertaining to personal information collection, processing, sharing, and protection, and the bias of contractual terms. The paper further discusses whether the PIPL can help address three issues considered in the survey results. It argues that, even though the new law looks promising and may help address some of the issues in online contracting for personal information, its effectiveness ultimately depends on its enforcement and consumers' reaction to changes in the way firms contract for personal information. Therefore, this paper also calls for more empirical studies on China's personal information protection.

law
China’s draft Personal Information Protection Law

Lothar Determann,Zhenyu (Jay) Ruan,Tingting Gao,Jonathan Tam

DOI: https://doi.org/10.69554/gmhh7774

2021-06-01

Abstract:In October 2020, China published a draft of the Personal Information Protection Law of the People’s Republic of China (PRC) for public comment. The draft law is intended to be the first consolidated and comprehensive law targeting the protection of personal information in China. If enacted in its current form, the law would introduce a suite of obligations that apply to organisations in both the private and public sectors and individuals that process Chinese residents’ personal information. The scope, structure and substance of the draft law not only resemble that of the European Union (EU) General Data Protection Regulation (GDPR) in a number of key ways but also diverge from the GDPR in many respects. The draft Chinese law also has some similarities with various US privacy laws, although the United States has not enacted a comprehensive federal privacy law that applies across the country. Despite the variations among the regimes of China, the EU and the United States, organisations that do business in these geographies can leverage the privacy compliance programmes they may have established for the United States and EU to prepare for the implementation of the draft Chinese Personal Information Protection Law. This paper summarizes the key requirements of the draft Chinese law and provides high-level observations regarding its similarities to and differences from the GDPR and key US privacy laws.
The Future of China's Personal Data Protection Law: Challenges and Prospects

Yang Feng

DOI: https://doi.org/10.1080/10192557.2019.1646015

IF: 0.542

2019-01-01

Asia Pacific Law Review

Abstract:On 10 September 2018, the Standing Committee of the National People's Congress of China updated its legislative agenda and planned to enact a comprehensive data protection law by March 2022. This Plan would end the longstanding speculation among Chinese scholars and foreign observers about the direction of China's data protection regime. Nevertheless, whether such a law can be enacted on time remains uncertain. This article examines the current challenges to the creation of a workable data protection law in China. The main challenges are related to the hasty implementation of the information and communications technology (ICT) development strategies, the current weak legal framework and the unprepared scholars and lawmakers. This article concludes that the enactment of a data protection law is not an easy task. This task is likely to be delayed, suspended, or proved to be a failure if the aforementioned obstacles are not resolved properly. Finally, to provide meaningful data protection, this article provides four basic policy and legal recommendations: (1) pay more attention to protecting individuals' personal data against unreasonable use by industry and government; (2) cautiously learn from legislative experience of western countries; (3) explore the best practices under Chinese contexts; and (4) enforce the protection rules in a more meaningful manner.
Before and after China's new Data Laws: Privacy in Apps

Konrad Kollnig,Lu Zhang,Jun Zhao,Nigel Shadbolt

DOI: https://doi.org/10.48550/arXiv.2302.13585

2023-02-27

Computers and Society

Abstract:Privacy in apps is a topic of widespread interest because many apps collect and share large amounts of highly sensitive information. In response, China introduced a range of new data protection laws over recent years, notably the Personal Information Protection Law (PIPL) in 2021. So far, there exists limited research on the impacts of these new laws on apps' privacy practices. To address this gap, this paper analyses data collection in pairs of 634 Chinese iOS apps, one version from early 2020 and one from late 2021. Our work finds that many more apps now implement consent. Yet, those end-users that decline consent will often be forced to exit the app. Fewer apps now collect data without consent but many still integrate tracking libraries. We see our findings as characteristic of a first iteration at Chinese data regulation with room for improvement.
Analysis of Legal Issues of Personal Information Protection in the Field of Big Data

Chuyun Wang,Feifei Guo,Mengxuan Ji

DOI: https://doi.org/10.1155/2022/1678360

2022-08-30

Journal of Environmental and Public Health

Abstract:In the era of big data, while every citizen enjoys the convenience of the Internet, all kinds of information closely related to their personal and property are in a state of "streaking" for a long time. Personal information is frequently leaked, illegally misappropriated, and used. There are necessary requirements of network security. The risks and challenges faced by personal information in the context of big data increase. In the context of the rapid development of big data, the information is circulated in virtual cyberspace in the form of electronic data, and data sharing has become an important flow form of information circulation. It is an important link to realize the optimal allocation of network resources and realize the value of data. The great progress of the digital economy and artificial intelligence technology has greatly increased the demand for data, the speed of circulation has been further accelerated, and the potential value of data has been fully reflected. At present, the scope of personal information protected by Chinese laws is relatively narrow and is basically limited to the scope of privacy rights, which makes a large amount of information owned by individuals that do not belong to the category of personal privacy rights lack legal protection. Personal information is different from the characteristics of privacy rights. It is decided that the protection of personal information should be different from the protection of traditional personal privacy. To sum up, in view of this, this article attempts to analyze the new challenges faced by personal information protection in the era of big data from the perspective of law, combined with the background of the era of big data, from the legislative model, system design, supervision mechanism, industry self-discipline, and other aspects. Exploration of the legislative framework for the protection of personal information in the era of big data in our country is done in order to find a realistic path that balances the development of big data technology and the protection of personal information.
Privacy in Chinese iOS apps and impact of the personal information protection law

Konrad Kollnig,Lu Zhang,Jun Zhao,Nigel Shadbolt

DOI: https://doi.org/10.1016/j.clsr.2024.106041

IF: 2.707

2024-09-03

Computer Law & Security Review

Abstract:Privacy in apps is a topic of widespread interest because many apps collect and share large amounts of highly sensitive information. In response, the Chinese legislator introduced a range of new data protection laws over recent years, notably the Personal Information Protection Law (PIPL) in 2021. So far, there exists limited research on the impacts of these new laws on apps' privacy practices. To address this gap, this paper analyses data collection in pairs of 634 Chinese iOS apps, one version from early 2020 and one from late 2021. Our work finds that many more apps now implement consent. Yet, those end-users that decline consent will often be forced to exit the app. Fewer apps now collect data without consent but many still integrate tracking libraries. Market concentration in app data collection has seen limited change. At the same time, there exists a larger number of influential and equal market participants than in the West. Among them, Apple was the only relevant foreign company. We see our findings characteristic of a first iteration at Chinese data regulation with room for improvement. With the help of enhanced technological capabilities, we expect increased enforcement of the new data rules. There is also room to refine the new laws and make them more targeted at mobile apps and the online sphere, particularly through clear and up-to-date technical specifications for software developers. As such, our findings could also be motivation for non-Chinese policy- and lawmakers to enhance their own data protection regimes.

law
Research on Personal Privacy Protection of China in the Era of Big Data

Zhao Hui,Dong Haoxin,Hui Zhao,Haoxin Dong

DOI: https://doi.org/10.4236/jss.2017.56012

2017-01-01

Open Journal of Social Sciences

Abstract:The purpose of this essay is to investigate the privacy concerns of Chinese, and to develop relevant protective measures. The groups are divided into two parts by gender and six parts by ages to analyze the different gender and different age groups of privacy concerns. The significance of this study is protecting personal data property. The data of personal information after finishing processing have economic value. These data once disclosed, will be not reversible, so it is important to study the personal privacy in the era of big data and to initiate and enforce legal and regulatory protection measures. Results show that Chinese’s privacy in public places for Internet records, friends dynamic and age’s awareness is insufficient; most people especially female lack privacy protection skills. Educators need to improve the relevant laws and regulations, promote privacy protection skills and strengthen the conception of privacy.
An Overview of the Chinese “personal Information Protection Law”

Jun Yang

DOI: https://doi.org/10.3917/pinc.010.0008

2022-01-01

Abstract:The note below is intended to provide the readers with an introductory review of the scope of the application of PIPL, the fundamental rules (both general and specific) governing processing, the outbound data transfer, the rights of data subjects as well as the obligation and liabilities of the processor under the PRC PIPL. The long-awaited “PRC Personal Information Protection Law” (“PIPL”) was finally unveiled on August 20, 2021, and took effect on November 1, 2021. As the last piece of the Chinese legislative trilogy in data protection area (after “Cyber Security Law” [‘CSL”] in 2016 and “Data Security Law” [« DSL”] in June, 2021), this legislative milestone will have immediate and lasting impact on the data protection in China. PIPL which was released amid Beijing’s continued regulatory crackdown on Chinese tech giants would not only help the Chinese regulator to end the wild practices in the local market in the short term but also achieve a rebalance between commercial exploitation of personal information and protection of data subjects. PIPL will profoundly change our daily life and the way how the corporate citizens operate in China (and in overseas jurisdictions) in various fronts ranging from the design of their products/services, defining (redefining) their operating rules to internal decision-making process. This article is intended to offer you an overview of some key aspects of this new law.
China’s Data-Orienting Personal Information Protection During Combating the Epidemic

Yang Li

DOI: https://doi.org/10.15335/glr.2020.14.4.002

2021-01-01

Gachon Law Review

Abstract:COVID-19 came suddenly. China has controlled this epidemic in a certain degree by means of digitized epidemic prevention. This kind of means is like a double-edged sword, which eases major public health events, but threatens personal information security. The legislation of personal information protection went through several discussions in China until this issue resurfaced during the recent COVID-19 pandemic, and on August 20, 2021 China passed The Personal Information Protection Law and began implementing it in November of the same year. This research focus on the outstanding personal information issues in the process of digitized epidemic prevention and hopes to improve the protection system of personal information by combing the deficiencies in legislation.
Research on the Status Quo and Dilemma of Minors' Personal Information Protection

Kejia Lou,Jiale Wu,Ziyu Zhou

DOI: https://doi.org/10.62051/7edhjq16

2024-03-22

Abstract:With the rapid development of mobile Internet, minors' personal information is inevitably collected and processed by various information processors. Due to the characteristics of immature mental development and weak risk prediction ability of minors, it is difficult to effectively protect their personal information security. Although China's "Personal Information Protection Law" makes provisions on the protection of minors' personal information, there are still some problems such as "one-size-fits-all" age limit and imperfect guardian consent system. This paper will test the current hundreds of various types of apps, conduct a questionnaire survey on the protection of personal information of minors and their guardians, analyze the current dilemma of the protection of personal information of minors at the social level, propose countermeasures according to the symptoms, and explore more targeted ways to protect the rights and interests of minors' personal information. Escort the physical and mental healthy development of minors under the background of the information age.
The legal construction of personal information protection and privacy under the Chinese Civil Code

Shujie Cui,Peng Qi

DOI: https://doi.org/10.1016/j.clsr.2021.105560

2021-07-01

Abstract:Personal information protection and privacy interact in diverse ways, especially in the contemporary information age. Although books and articles have focused on this topic, the new tendencies of worldwide legislation and judicial practice bring challenges, as the legal construction of personal information protection and privacy differs from culture to culture and time to time. In 2017, the General Provisions of the Civil Law of the People's Republic of China ("the General Provisions of the Chinese Civil Code" hereafter)<a class="workspace-trigger" href="#cit_1">1</a> (expired) addresses the legal concepts of personal information protection and the right to privacy simultaneously, to which this article refers as the dual model, differing from the one-dimensional mode of privacy protection before. Subsequently, the "The Right to Privacy and the Protection of Personal Information," a chapter of the newly issued Civil Code of the People's Republic of China's ("the Chinese Civil Code" hereafter), ascertains the dual model and details related provisions. It has been dubbed a landmark ruling of China's personal information protection, greatly boosting the modernization of China's civil system.Despite the many articles that discuss approaches to China's civil protections, little attention has been given to the fundamental question concerning what exactly encompasses the personal information protection and privacy to which these laws refer. Based on the regulations and applicability of the General Provisions of the Chinese Civil Code and the Chinese Civil Code, this paper explores the legal construction of personal information protection and privacy under Chinese legal orders, including the differences, similarities, and interplay between the two rights. By distinguishing the legal value, contents and remedial approaches, this paper concludes that the two rights are distinct but overlap. On one side, personal information protection is elevated to the status of a separate civil right in the legal context of China, rather than part of privacy. On the other side, tailored regulations should be establish according to the criteria of the nature of information, the extent of information processing, and the elements of damage when confronted with overlaps in the two rights in judicial practice. Thus, this paper provides a perspective from which to clarify the approaches to civil protection of personal information and privacy in China and a reference model for enactment of the Chinese Personal Information Protection Law in the the future.

law
Assessing Legal Protection of Biometric Data in China: Gaps, Principles, and Policy Recommendations

Qian Li,Jianyu Zhou,Jennifer S. Stevenson

DOI: https://doi.org/10.1080/01947648.2024.2307624

2024-02-21

Journal of Legal Medicine

Abstract:The legal protection of biometric data is becoming an increasingly important issue in the information society. China attaches importance to the legal protection of biometric data. Over the past decades, the rapid development of digital technology has profoundly influenced Chinese information society. However, digital technology may also trigger substantial risks. In this article, we provide an in-depth examination of existing Chinese laws protecting biometric data. We explore general laws and facial recognition laws, administrative regulations, sector-based rules, judicial interpretations, regulatory documents, policy documents, and (draft) national standards. We find gaps in laws in China. Building on this analysis, we elaborate on five principles for the legal protection of biometric data: (1) legality, propriety, and necessity; (2) integrity; (3) purpose; (4) minimization; and (5) controllability. We provide three policy recommendations for the legal protection of biometric data: (1) sufficiently considering the purpose of the collection of biometric data, (2) creating controllable mechanisms, and (3) implementing regulatory compliance programs.

social sciences, biomedical,law
Criminal Law Protection of Personal Information in China in the context of Social Credit System Formation

A. S. Ozerova

DOI: https://doi.org/10.17803/1994-1471.2022.138.5.196-206

2022-04-19

Actual Problems of Russian Law

Abstract:The paper analyzes the norms of criminal law, which enshrined the protection of personal information in the PRC. The tendencies of law enforcement practice in criminal cases, the subject of which are personal data, are being studied. Increased criminal law protection of personal information of Chinese citizens is due to the emergence of a social credit system. The paper discusses the features of the functioning of the social credit system, as well as the impact of this system on the rights and freedoms of the individual in the context of digitalization. Interest in the system under consideration is due to the significant influence exerted by the PRC on the formation of the legal culture of other countries. The author concludes that a significant degree of state intrusion into the private space of citizens correlates with effective measures to protect personal information. The Chinese case shows the desire of the state to protect the personal data of citizens, including through criminal law means. At the same time, cases of law enforcement are becoming more common, especially in criminal law.
Inadequacy and Improvement of Legal Protection of Sensitive Personal Information

Zhangboyu Sun,Zixi Liu

DOI: https://doi.org/10.1051/shsconf/202315703006

2023-02-16

SHS Web of Conferences

Abstract:In the era of rapid development of big data, the problem of personal information leakage is widely concerned by the society. Among them, sensitive personal information related to the human dignity of natural persons or basic rights such as personal and property is more important. China introduced the Personal Information Protection Law in 2021 to improve the legal system of personal information protection in China, but due to the short development time of the relevant system for the protection of sensitive personal information, resulting in the legal protection of sensitive personal information faces serious challenges in practice, so it is especially important to improve the legal protection of sensitive personal information in China. Based on this, this paper firstly explains the concept and characteristics of sensitive personal information, then analyzes the shortcomings of the legal protection of sensitive personal information, and finally puts forward suggestions for improvement from different perspectives, including improving the principle of "informed consent", strengthening the supervision of industry self-regulation and improving the principle of imputation.

English Else
New consideration for data collection and application of clinical research under the back-ground of ligalization of data administration in China

张潇,周辉,何晶晶,姚宏伟,陈甦,张忠涛

DOI: https://doi.org/10.3760/cma.j.cn115610-20220104-00006

2022-01-01

Abstract:The medical data processed and analyzed in clinical research often contain a large number of personal information. Therefore, researchers should pay attention to the safety management of medical data during clinical research. The Data Security Law of People's Republic of China and the Personal Information Protection Law of People's Republic of China implemented on 1 st September and 1 st November 2021 respectively establish legal basis for data security and personal information protection and point out the direction for medical data security, which indicate that data governance has entered the 'strong regulatory era'. In the process of medical data collection and application of clinical research, respecting and protecting the privacy and safety of patients, ensuring the quality of medical data, safely managing medical data and carrying out high-quality clinical research will be an important test for the collection and application of clinical scientific research data under the new legal background.
Research on the Legal Protection of Personal Information in the Big Data Era

Xianghua Deng,Meiyuan Yan

DOI: https://doi.org/10.1088/1742-6596/1883/1/012081

2021-04-01

Journal of Physics: Conference Series

Abstract:Abstract With the scale and convenience of information storage and transmission, human society has entered the era of big data. In this era, information has become the most valuable and potentially influential resource, and personal information that is closely related to citizens’ daily lives is no exception, and is used by all stakeholders. Improper collection of personal information, fraudulent use of personal information, and malicious use of personal information have disrupted the peaceful life of citizens, thereby threatening personal and property safety issues are gradually exposed. In the era of big data, personal information protection is facing new challenges of data personality shaping and modern power control. Strengthening the protection of personal information is an urgent need in the era of big data.

Research under China’s Personal Information Law

China’s Personal Information Protection Law

Study on Compliance of Personal Biometric Information Processing Protocols in Financial APPs

A Sociosemiotic Exploration of Personal Information Legislation in the United States and China

China’s souped-up data privacy laws deter researchers

Whose data is it anyway? An empirical analysis of online contracting for personal information in China

China’s draft Personal Information Protection Law

The Future of China's Personal Data Protection Law: Challenges and Prospects

Before and after China's new Data Laws: Privacy in Apps

Analysis of Legal Issues of Personal Information Protection in the Field of Big Data

Privacy in Chinese iOS apps and impact of the personal information protection law

Research on Personal Privacy Protection of China in the Era of Big Data

An Overview of the Chinese “personal Information Protection Law”

China’s Data-Orienting Personal Information Protection During Combating the Epidemic

Research on the Status Quo and Dilemma of Minors' Personal Information Protection

The legal construction of personal information protection and privacy under the Chinese Civil Code

Assessing Legal Protection of Biometric Data in China: Gaps, Principles, and Policy Recommendations

Criminal Law Protection of Personal Information in China in the context of Social Credit System Formation

Inadequacy and Improvement of Legal Protection of Sensitive Personal Information

New consideration for data collection and application of clinical research under the back-ground of ligalization of data administration in China

Research on the Legal Protection of Personal Information in the Big Data Era