This month, China’s National Information Security Standardization Technical Committee (“NISSTC”) organized a meeting to launch a working group tasked with drafting a Personal Information Security Standard (“PIS Standard”). NISSTC is a government committee jointly supervised by the Standardization Administration of China and the Cyberspace Administration of China. In addition to the government agencies, several Chinese research institutions and Internet companies (including Tencent and Alibaba) will also participate in the working group.
According to one report, an NISSTC official explained that the PIS Standard would be a non-binding guideline serving as a bottom line for the data privacy and security practices of companies, including internet companies, operating in China. The official said that the PIS Standard would limit the kinds of information companies are permitted to collect, and that certain data protection-related conditions would be imposed on providers of information services and the design of relevant software. This official indicated that the PIS Standard would cover both data privacy and security; another official, according to a NISSTC press release, stated the hope that it would serve as the foundational standard for personal information protection practices in China. It is not currently clear whether the greater emphasis would be on data security or on privacy.
Although the contemplated PIS Standard would not be legally binding, its content may influence the future trajectory of data privacy and security-related legislation amid calls for a more comprehensive legal regime governing the protection of personal information. Further, as Chinese regulators generally wield significant discretion in the interpretation and application of often vaguely worded laws and regulations, such a standard could serve as a barometer for assessing legal compliance.
Steven Zhu of Covington & Burling LLP assisted with the research and preparation of this article.
