Law note · China
Personal Information Protection Law, Arts. 13(6) and 27 (processing already-public personal information)
What it asks of an app
- Confine processing of personal information someone has already made public to a reasonable scope tied to your stated purpose.
- Stop processing an individual's already-public personal information once they expressly decline, even though no prior consent was required.
- Obtain separate consent before any use of already-public personal information that would have a significant impact on the individual, including most AI-training uses.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Article 27 permits a personal information handler to process, within a reasonable scope, personal information an individual has disclosed themselves or that is otherwise lawfully public, unless the individual has expressly declined; processing that has a significant impact on the individual still needs separate consent.
Article 13(6) states the same ground as a general lawful basis for processing, functioning as China's analog to General Data Protection Regulation (GDPR) Art. 6(1)(f), with its own reasonable-scope ceiling and opt-out rather than a legitimate-interest balancing test.
The 2023 Generative AI Interim Measures additionally require a lawful source for AI training data, which for personal information means satisfying this Article 27 basis; that measure's own robots.txt-related technical standard was not independently confirmed this wave and is not recorded as its own instrument here.