New consumer protection provisions that clarify how companies may collect, use, and protect personal information of consumers will come into effect in China on March 15, 2015.

On January 5, 2015, China’s State Administration of Industry and Commerce (“SAIC”) issued measures to implement China’s Consumer Rights Protection Law (“CRPL”), which was amended effective March 2014 to include, among other things, provisions on the protection of personal information of consumers and administrative penalties for the misuse of personal information.   The newly promulgated measures, entitled Measures on Penalties for Infringing Upon the Rights and Interests of Consumers (“CRPL Penalty Measures”; Covington’s translation is available here) flesh out the CRPL by addressing a range of consumer protection issues.  From a privacy perspective, the CRPL Penalty Measures (1) clarify the definition of “personal information of consumers,” (2) provide more detail on the CRPL’s requirements for the collection, use, and protection of consumer personal information, and (3) provide for significant penalties for violations.  The CRPL Penalty Measures take effect on March 15, 2015, China’s Consumer Protection Day.

Article 11 of the CRPL Penalty Measures define “personal information of consumers” as “a consumer’s name, gender, occupation, date of birth, identification document number, residential address, contact information, status of income and assets, health status, and consumption habits, and other information collected by business operators during their provision of goods or services that may independently or in combination with other information identify the consumers.”

The CRPL states that consumers’ personal information is entitled to protection when they purchase goods or services.  The CRPL applies to all online and offline consumer transactions and to businesses in all industries that provide goods or services to consumers in China.  The CRPL and the CRPL Penalty Measures, taken together, require businesses to:

(1) Inform and obtain consent from consumers regarding the purpose, method, and scope of collection or use of consumers’ personal information;

(2) Publish rules for the collection and use of consumers’ personal information;

(3) Not collect or use information in ways that violate laws, regulations, or contractual arrangements;

(4) Not divulge, sell, or illegally disclose consumer personal information to third parties;

(5) Implement measures to ensure the security of consumers’ personal information and immediately take remedial action if information is improperly disclosed or lost;

(6) Not send commercial information to consumers without consent, particularly if consumers have expressly indicated an unwillingness to receive such information.

Violations of the CRPL Penalty Measures are subject to civil liability:  SAIC and its local counterparts may confiscate all illegal earnings and impose fines of between one and ten times the amount of the illegal earnings, or up to RMB 500,000 (about US $80,000) if there are no illegal earnings.  (Note that starting in October 2014, companies have been required to disclose administrative penalties to the public within 20 business days.)

The CRPL Penalty Measures are part of a series of laws and regulations issued by the government in the last 24 months to further regulate collection and use of personal information — e.g., the Decision of the Standing Committee of the National People’s Congress on Strengthening Online Information Protection  (see our previous client alert here) and the Provisions on Protecting the Personal Information of Telecommunication and Internet Users (see our blog post here).  The definition in the CRPL Penalty Measures of “personal information of consumers” is one of the more specific definitions in China’s patchwork of privacy laws and regulations.

The substantial enforcement authority granted to SAIC and its local counterparts (local Administrations of Industry and Commerce, or AICs) suggests that the Chinese government is serious about cracking down on improper use, disclosure, and sale of consumers’ personal information in the country.  AICs handle not only consumer protection but also advertising regulation, commercial bribery, and some aspects of antitrust enforcement.  In our experience, AIC enforcement is largely executed at a local level (district, municipal, or sometimes provincial).

Sheng Huang of Covington & Burling LLP assisted with the research and preparation of this article.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Eric Carlson Eric Carlson

Eric Carlson has nearly two decades of experience advising clients operating in China and other jurisdictions in Asia on compliance and investigations matters, particularly in the areas of corruption/FCPA/fraud and export controls/sanctions.

Having lived in China for more than a decade, he has …

Eric Carlson has nearly two decades of experience advising clients operating in China and other jurisdictions in Asia on compliance and investigations matters, particularly in the areas of corruption/FCPA/fraud and export controls/sanctions.

Having lived in China for more than a decade, he has deep experience leading highly sensitive investigations in China and other jurisdictions in Asia, including investigations presenting complex legal, political, and reputational risks. He speaks Mandarin and Cantonese and has led more than four hundred witness interviews in Chinese in 24 provinces in China, and conducted dozens of trainings in Chinese. He is a Certified Fraud Examiner.

Eric also counsels clients on the compliance risks of proposed transactions, conducts compliance due diligence as part of mergers, acquisitions, and joint ventures, assists companies in updating and strengthening their internal compliance programs and tailoring them to the unique features of Asian markets, and developing and presenting tailored compliance training in Chinese and English. Eric has advised scores of companies and organizations representing nearly every major industry.

Eric is a regular speaker on China-related compliance issues. He has been quoted in publications such as The Wall Street Journal, The Economist, The Financial Times, Global Investigations Review, Compliance Week, FCPA Report, The Corporate Treasurer, Commercial Dispute Resolution, China Business Law Journal, and Economy and Nation Weekly and was a contributing editor to the FCPA Blog. Chambers notes that Eric has “much more than just a conversational grasp of the language, but the ability to conduct interviews on specific subject matter details and get to the root of the issues.” Chambers further notes that “his language skills are very impressive” and that he provides “great advice that is grounded in reality,” adding: “They know the industry and their advice is very risk-based and balanced.” One client noted to Chambers: “They have strong regional coverage both in terms of footprint as well as language skills. If I have a compliance investigation in region with a tight timeframe, I know they can get it done. They take a more realistic approach to scoping investigations.” Other clients noted to Chambers that Eric is “really brilliant” and “an expert in this field.” According to one client surveyed by Chambers, “he is particularly adept at ‘right sizing’ the scope of an investigation to get at the key issues without incurring unnecessary operational or financial burden. He is also incredibly responsive to client communications.”

Read more about Eric CarlsonEmail
Show more Show less
Photo of Ashwin Kaja Ashwin Kaja

With over a decade of experience in China, Ashwin Kaja helps multinational companies, governments, and other clients understand and navigate the complex legal and policy landscape in the country. He plays a leading role in Covington’s China international trade and public policy practices…

With over a decade of experience in China, Ashwin Kaja helps multinational companies, governments, and other clients understand and navigate the complex legal and policy landscape in the country. He plays a leading role in Covington’s China international trade and public policy practices and, outside of Covington, serves as the General Counsel of the American Chamber of Commerce in China.

Ashwin helps clients solve acute problems that arise in the course of doing business in China and position themselves for longer-term success in the country’s rapidly evolving legal and policy environment. He is an expert on Chinese industrial policy and has worked on matters related to a wide range of sectors including technology, financial services, life sciences, and the social sector. Ashwin has also counseled a range of clients on data privacy and cybersecurity-related matters.

As the General Counsel of the American Chamber of Commerce in China (AmCham China), Ashwin serves as a senior officer of the organization and as an ex officio member of its Board of Governors, supporting nearly one thousand member companies in developing their businesses in China and advocating for their needs with China’s central and local governments.

Read more about Ashwin KajaEmail
Show more Show less