China’s State Administration of Industry and Commerce (“SAIC”) has released for public comment a draft regulation implementing recent amendments to a consumer protection law that would, among other things, supplement existing privacy obligations for businesses operating in China.

The “Regulations on the Implementation of the Law on the Protection of the Rights and Interests of Consumers” (“Draft Implementing Regulations”) implement certain provisions of the Law on the Protection of the Rights and Interests of Consumers (“Consumer Rights Protection Law” or “CRPL”; unofficial English translation by Chinalawtranslate.com available here), which underwent significant revisions in October 2013. The Draft Implementing Regulations reiterate and supplement data privacy and security obligations imposed in the CRPL and in the Measures on Penalties for Infringing Upon the Rights and Interests of Consumers (“CRPL Penalty Measures”; unofficial English translation by Covington available here), which was promulgated in January 2015 and discussed in our previous article here.

A definition of “consumer personal information” first appeared in the CRPL Penalty Measures as “a consumer’s name, gender, occupation, date of birth, identification document number, residential address, contact information, status of income and assets, health status, consumption habits, and other information collected by business operators during their provision of goods or services that may, independently or in combination with other information, identify the consumers.” This definition is reproduced in the Draft Implementing Regulations with the addition of “identifying biological characteristics.”

The Draft Implementing Regulations largely reiterate a number of data privacy and security requirements that apply to companies operating in China (referred to as “business operators”) found in the CRPL and the CRPL Penalty Measures:

  • Business operators must inform and obtain consent from consumers regarding the purpose, method, and scope of collection or use of consumer personal information. Such information may be collected or used only if necessary.
  • Business operators may not divulge consumer personal information without consent.
  • Business operators must implement measures to ensure the security of consumer personal information and immediately take remedial action if information is leaked or lost.

The Draft Implementing Regulations further supplement the CRPL and CRPL Penalty Measures by adding certain new or modified requirements:

  • Collection of consumer personal information by a business operator would need to be related to its business operations.
  • Business operators would need to retain for at least five years proof that they fulfilled their obligations to inform and obtain consent from consumers regarding the purpose, method, and scope of collection and/or use.
  • Business operators would be prohibited from “tampering with or destroying” consumer personal information.
  • The Draft Implementing Regulations add an exception to the prohibition on divulging consumer personal information (without consent) for information that has been irreversibly de-identified, although no specific processes are specified for de-identification.
  • In addition to the requirement that they take immediate remedial action, business operators would also be required to notify consumers in a timely manner of a data leak or loss. The regulation does not specify what kinds of actions or notifications would satisfy this requirement.
  • The prohibition on business operators sending commercial information to consumers without their consent or request is expanded and made slightly more specific. The Draft Implementing Regulations prohibit the sending of electronic commercial information and the making of telemarketing calls without consent.
  • The draft further adds language stating that consumers should not bear the costs of consented-to commercial communications unless otherwise agreed.

The draft regulations, once finalized, would build on the CRPL, the CRPL Penalty Measures, and laws and regulations applicable to personal data collected and processed over information networks. Many of the rules described in this post are not unique in the context of Chinese data privacy law, and reflect emerging trends that may become increasingly familiar to companies with business operations in the country.

Public comments on the Draft Implementing Regulations can be submitted by September 5.

Yan Luo and Tina Zhang of Covington & Burling LLP assisted with the research and preparation of this article.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Ashwin Kaja Ashwin Kaja

With over a decade of experience in China, Ashwin Kaja helps multinational companies, governments, and other clients understand and navigate the complex legal and policy landscape in the country. He plays a leading role in Covington’s China international trade and public policy practices…

With over a decade of experience in China, Ashwin Kaja helps multinational companies, governments, and other clients understand and navigate the complex legal and policy landscape in the country. He plays a leading role in Covington’s China international trade and public policy practices and, outside of Covington, serves as the General Counsel of the American Chamber of Commerce in China.

Ashwin helps clients solve acute problems that arise in the course of doing business in China and position themselves for longer-term success in the country’s rapidly evolving legal and policy environment. He is an expert on Chinese industrial policy and has worked on matters related to a wide range of sectors including technology, financial services, life sciences, and the social sector. Ashwin has also counseled a range of clients on data privacy and cybersecurity-related matters.

As the General Counsel of the American Chamber of Commerce in China (AmCham China), Ashwin serves as a senior officer of the organization and as an ex officio member of its Board of Governors, supporting nearly one thousand member companies in developing their businesses in China and advocating for their needs with China’s central and local governments.

Read more about Ashwin KajaEmail
Show more Show less
Photo of Eric Carlson Eric Carlson

Eric Carlson has nearly two decades of experience advising clients operating in China and other jurisdictions in Asia on compliance and investigations matters, particularly in the areas of corruption/FCPA/fraud and export controls/sanctions.

Having lived in China for more than a decade, he has …

Eric Carlson has nearly two decades of experience advising clients operating in China and other jurisdictions in Asia on compliance and investigations matters, particularly in the areas of corruption/FCPA/fraud and export controls/sanctions.

Having lived in China for more than a decade, he has deep experience leading highly sensitive investigations in China and other jurisdictions in Asia, including investigations presenting complex legal, political, and reputational risks. He speaks Mandarin and Cantonese and has led more than four hundred witness interviews in Chinese in 24 provinces in China, and conducted dozens of trainings in Chinese. He is a Certified Fraud Examiner.

Eric also counsels clients on the compliance risks of proposed transactions, conducts compliance due diligence as part of mergers, acquisitions, and joint ventures, assists companies in updating and strengthening their internal compliance programs and tailoring them to the unique features of Asian markets, and developing and presenting tailored compliance training in Chinese and English. Eric has advised scores of companies and organizations representing nearly every major industry.

Eric is a regular speaker on China-related compliance issues. He has been quoted in publications such as The Wall Street Journal, The Economist, The Financial Times, Global Investigations Review, Compliance Week, FCPA Report, The Corporate Treasurer, Commercial Dispute Resolution, China Business Law Journal, and Economy and Nation Weekly and was a contributing editor to the FCPA Blog. Chambers notes that Eric has “much more than just a conversational grasp of the language, but the ability to conduct interviews on specific subject matter details and get to the root of the issues.” Chambers further notes that “his language skills are very impressive” and that he provides “great advice that is grounded in reality,” adding: “They know the industry and their advice is very risk-based and balanced.” One client noted to Chambers: “They have strong regional coverage both in terms of footprint as well as language skills. If I have a compliance investigation in region with a tight timeframe, I know they can get it done. They take a more realistic approach to scoping investigations.” Other clients noted to Chambers that Eric is “really brilliant” and “an expert in this field.” According to one client surveyed by Chambers, “he is particularly adept at ‘right sizing’ the scope of an investigation to get at the key issues without incurring unnecessary operational or financial burden. He is also incredibly responsive to client communications.”

Read more about Eric CarlsonEmail
Show more Show less