November 30, 2021

Volume XI, Number 334

Advertisement
Advertisement

November 29, 2021

Subscribe to Latest Legal News and Analysis
Advertisement

China's SAIC Seeks Comment on Data Protection Rule as Part of Consumer Rights Initiative

On August 5, 2016, China's State Administration for Industry and Commerce (SAIC) published the draft Implementation Regulation for the Consumer Rights Protection Law (CRPL), and asked for public comments by September 5, 2016. The draft Regulation includes 70 articles, detailing issues surrounding the implementation and enforcement of the CRPL, such as consumer rights and business obligations, government and social organizations' protection of consumer rights, dispute resolution, and legal liabilities. This alert focuses on provisions regarding consumer data privacy in the draft Implementation Regulation.

The CRPL was most recently amended in 2013, which made it clear for the first time that Chinese consumers' personal information is subject to legal protection. The term "personal information" is more specifically defined in the Implementation Regulation - "information that is collected by business operators when providing goods or services and can be used alone or with other information to identify consumers, including name, gender, occupation, date of birth, ID number, home address, contact method, income and asset information, health condition, transaction information, as well as biometric identifiers."

Article 22 of the Implementation Regulation requires business operators to establish a sound information confidentiality and management system to guarantee that consumers' personal information is protected. More specifically, business operators must not disclose, alter, or destroy consumers' personal information they collect, or provide such information to third parties without consent from the consumer. However, if the processed information cannot be recovered and would not reveal consumer identity, these rules would not apply.

Business operators also are banned from collecting information that is unrelated to the business or through unjustified means. Moreover, business operators must keep the documentation that demonstrates informed consent from consumers for at least five years.

With regard to enforcement, Article 57 of the Implementation Regulation makes it clear that violation of Article 22 will subject business operators to the administrative penalties as specified under Article 56 of the CRPL, which includes administrative warnings, confiscation of illegal income, as well as fines ranging from one to ten times the illegal income (up to 500,000 RMB if there is no illegal income). In serious situations, the authorities may order the business to close down or/and revoke its business license.

In short, the Implementation Regulation imposes further restrictions on the commercial use of consumers' personal information. It is also worth noting that Article 2 of the draft Regulation explicitly states that consumers who purchase goods or services (except financial products) to earn commercial gain (rather than for daily consumption) are not protected by the Regulation. This would affect the so-called "professional consumers" in China who knowingly purchase defective products in an effort to obtain compensation by suing (or threatening to sue) companies who allegedly do not comply with various consumer product laws and regulations. The immediate consequence of this carve-out is that professional consumers will no longer be entitled to rights that belong to consumers, e.g., the right to the protection of privacy data as well as the right to get punitive damages under Article 55 of the CRPL.

Establishing consent mechanisms will be an important component of managing consumer data in China going forward.

© 2021 Keller and Heckman LLPNational Law Review, Volume VI, Number 230
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

David J. Ettinger, Keller Heckman, Partner, Food and Drug Corporation, International Trade Lawyer, Attorney, Shanghai, China
Partner

David Ettinger joined Keller and Heckman in 1999. Mr. Ettinger represents domestic and foreign corporations in the area of food and drug law.

Mr. Ettinger relocated to Keller and Heckman's Shanghai office in November 2012 to focus on the Asian market and counsel companies in the Far East on food, drug, and chemical regulatory matters. He has extensive experience counseling clients on product development and product protection of food and drug packaging in the United States, Europe, Asia, Canada, and South America. From 2006-2007, Mr. Ettinger...

86 21-6335-1000
Tracy Marshall, Keller Heckman, regulatory attorney, for-profit company lawyer
Partner

Tracy Marshall assists clients with a range of business and regulatory matters.

In the business and transactional area, Ms. Marshall advises for-profit and non-profit clients on corporate organization, operations, and governance matters, and assists clients with structuring and negotiating a variety of transactions, including purchase and sale, marketing, outsourcing, and e-commerce agreements.

In the privacy, data security, and advertising areas, she helps clients comply with privacy, data security, and consumer protection laws, including laws governing telemarketing and...

202-434-4234
Sheila Millar, Keller Heckman, advertising lawyer, privacy attorney
Partner

Sheila A. Millar counsels corporate and association clients on advertising, privacy, product safety, and other public policy and regulatory compliance issues.

Ms. Millar advises clients on an array of advertising and marketing issues.  She represents clients in legislative, rulemaking and self-regulatory actions, advises on claims, and assists in developing and evaluating substantiation for claims. She also has extensive experience in privacy, data security and cybersecurity matters.  She helps clients develop website and app privacy policies,...

202-434-4646
Advertisement
Advertisement
Advertisement