The Personal Information Protection Law Officially Comes into Force

By Joe Li

In recent years， the collection of personal information， big data discriminatory pricing and the processing of sensitive personal information have become popular and difficult issues.

Therefore， the personal information protection law of the people’s Republic of China has entered into force on November 1， 2021. It has made clear regulations on prohibiting over-collections of personal information， big data discriminatory pricing and the processing of sensitive personal information like facial information， improved the compliant-lodging and reporting mechanisms for the protection of personal information. This law has fully responded to social concerns and provided strong legal guarantees for tackling troubling issues in personal information protection.

How to understand？

Information is not a new concept and personal information protection is not a new topic. There are also laws and regulations relevant to personal information protection. Why formulate a new personal information protection law？

Zhou Hui， associate researcher of the Institute of Law of the Chinese Academy of Social Sciences， believes that after entering the digital age， the situation has been undergoing revolutionary changes. With the accelerated innovation of digital technology and the vigorous development of the digital economy， the complexity and universality of personal information processing has been increasing. The economic and social value of the rational use of personal information and the security risks of illegal collection and abuse of personal information have become new highlights. The traditional social and legal rules need to be systematically updated.

Zhou said that in the digital age， to protect personal information requires reducing the cost of rights protection and increasing the cost of law infringement. It shall also empower relatively vulnerable individuals by offering more personal rights and building a stronger aid and relief mechanism. The regulatory authorities shall also give full play to the initiative and professionalism to better enforce the law. “Therefore， it is necessary to supplement special civil liability rules and litigation rights protection procedures. It is also necessary to clarify the authority of administrative law enforcement and strengthen administrative punishment， and make provisions on the scope of responsibilities of personal information supervision departments and supervision and law enforcement. More importantly， state departments at all levels and organizations authorized by laws and regulations to manage public affairs are processing personal information issues when performing their public responsibilities. Such activities relevant to personal information shall also be regulated.”

Zhou believes that information globalization is a new stage after commodity and capital globalization. As the digital economy and platform economy develop across borders， the global flow of personal information has brought new opportunities and challenges to the changing globalization. As the international competition about the utilization of information and data resources has been increasing， countries with strong information industry and markets have different views about the rules of the cross-border flow of personal information. The protection of personal information has become a new type of trade barrier.

Public interest litigation as new weapon of protection

Zhang Tao， Director of the China Society of Market Supervision， noted that since the implementation of the personal information protection law， local courts have heard at least dozens of civil public interest litigation cases relevant to personal information， “The provision of public interest litigation in the personal information protection law is conducive to solving the issues of high cost and long litigation time of individual rights protection， and strengthening the protection of rights and interests in the field of personal information. The public interest litigation has become a sharp weapon for personal information protection.”

Internet platform services are a significant feature that distinguish the digital economy from traditional economy. In terms of personal information processing， the internet platform provides basic technical services and sets basic processing rules for platform operators to process personal information. It is the key link of personal information protection.

Zhu Wei， Deputy Director of the Communication Law Research Center of China University of Political Science and Law， pointed out that in the era of digital economy， internet platforms should bear more legal obligations in terms of personal information protection. Therefore， for large internet platforms， the personal information protection law sets obligations of personal information protection accordingly.

According to the regulations of the personal information protection law， some internet companies have quickly updated their user service agreements， user privacy policies and other relevant content. However， many internet enterprises have failed to keep up with regulations of the new law.

Recently， the National Computer Virus Emergency Response Center discovered privacy violations in 17 mobile applications through internet monitoring. These violation activities are suspected of over-collecting personal privacy information； hundreds of apps have been requested to be removed from the app store due to highly-frequent and out-of-scope information requests， and the collection of user information in non-service scenarios. Because of violations against the personal information protection law， many apps have been ordered to be removed from the app store.

Zhang Tao pointed out that when it comes to how to process and protect personal information， the personal information protection law sets clear operating guidelines for businesses. It requires relevant companies to adjust their original business model. In the short term， relevant costs will increase， but in the long term， these mechanisms for protecting users’ personal information will play an important role in the development of the company and the whole industry. The companies’ self-development will be much safer and the industry environment will become cleaner.

“Personal information not only involves the personal rights and inter- ests of each individual， but also feature both property interests and public attributes as an important factor of production and value resource. Largescale infringements of citizens’ personal information have damaged the social and public interests. In order to solve the problems of high costs of individual rights protection， difficult rights protection for special groups， and long time period of rights protection， the personal information protection law has added special clauses about public interest litigation， which provide a strong legal guarantee for the protection of personal information，” said Zhang Tao.

Article 70 of the personal information protection law clearly stipulates that if a personal information processor violates this provision and infringes upon the rights and interests of many individuals， the people’s procuratorate， the consumer organization specified by law and other organizations authorized by the state cyberspace administration departments may bring a lawsuit to the people’s court according to the law.

On August 21， 2021， the Supreme People’s Procuratorate issued the Notification on Implementing the Personal Information Protection Law and Promoting the Procuratorial Work of Public Interest Litigation for Personal Information Protection， which standardized the treatment of public interest litigation cases and earnestly performed the legal duties of public interest litigation procuratorial work.

“The personal information protection law sets public interest litigation provisions， which entrusts people’s procuratorates， legal social organizations and other subjects with litigation qualifications， strengthens the legal regulation against infringements upon personal information， and enhances the protection of rights and interests in the field of personal information. Since the implementation of the personal information protection law， a number of relevant cases have finished judgement pronunciation. We can see the power of public interest litigation in resolving disputes. In the future， public interest litigation will be used more frequently when dealing with infringements on personal rights and interests，” said Zhang Tao.