Law note · China
Personal Information Protection Law, Individual Rights and Automated Decision-Making
Individuals have the right to know about and decide on processing, and to limit or refuse it (Art. 44), the right to access and copy their data including portability to another handler under state conditions (Art. 45), the right to correction or completion (Art. 46), the right to deletion in enumerated circumstances with cessation of active processing as a fallback where deletion is technically infeasible (Art. 47), and the right to an explanation of processing rules (Art. 48).
Article 50 requires a convenient exercise mechanism, a reasoned explanation for any refusal, and permits a court suit if a request is unreasonably denied.
Article 24 separately requires transparent, non-discriminatory treatment of automated-decision-making results, prohibits unreasonable differential pricing, requires a non-personalized option or opt-out where automated decisions push marketing, and gives an individual a right to explanation and to refuse a decision made solely by automated means where it has a major effect on their rights, with Article 55(2) requiring a personal-information-protection impact assessment before deploying automated decision-making.
What it asks of an app
- Provide a convenient channel for individuals to access, copy, correct, or delete their personal information, and to request portability to another handler where state conditions are met.
- Give a reasoned written explanation whenever a rights request is refused.
- Ensure transparency and non-discriminatory treatment in any automated decision made using personal information, and do not use it for unreasonable differential pricing.
- Offer a non-personalized option or a convenient opt-out wherever automated decision-making is used to push marketing or commercial information.
- Provide an explanation and honor an individual's refusal of a decision made solely by automated means where that decision has a major effect on their rights.
- Complete a personal-information-protection impact assessment before deploying automated decision-making.
When LexLint raises it
Declared activities: crawls_web, trains_models, processes_voice, processes_biometrics, automated_outreach, high_risk_decisions
Primary source: official CAC-published full Chinese statutory text