Law note · China
Personal Information Protection Law of the PRC, General Processing Rules and Lawful Bases
China's omnibus personal-data statute (Ge Ren Xin Xi Bao Hu Fa, Personal Information Protection Law) requires a lawful basis, most commonly informed consent, before processing personal information, and otherwise contract necessity, statutory duty, public-interest journalism, information the individual or another lawfully disclosed, or another legal ground.
It imposes purpose-limitation and data-minimization duties, requires a handler that entrusts processing to a third party to supervise that processor's activity under an agreement, and assigns joint and several liability among two or more processors who jointly decide a shared processing purpose and method. Chapter II, Section 3 (Arts. 33-37) extends parallel duties to state organs, so the Act binds government processors as well as private ones.
What it asks of an app
- Establish one of PIPL's enumerated lawful bases, most commonly informed consent, before collecting or processing personal information of a person in China.
- Limit personal information processing to the minimum scope and duration necessary for a stated, specific purpose.
- Where personal information is entrusted to a third party processor, execute a written entrustment agreement and supervise that processor's handling; the processor may not exceed the agreed purpose or method and must return or delete the data when the entrustment ends.
- Where two or more processors jointly decide a shared processing purpose and method, agree in writing on each party's respective duties; the individual may still exercise rights against any one of them, and the processors bear joint and several liability for resulting harm.
- Apply the same processing duties to a government agency's processing of personal information as to private processing.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: official CAC-published full Chinese statutory text