Privacy & Information Security Law Blog

On May 25, 2021, the Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP submitted its response (in English and in Mandarin) to the Standing Committee of the National People’s Congress (“NPC”) of the People’s Republic of China on the updated version of the Draft Personal Information Protection Law (“PIPL”).

As we previously reported, CIPL provided comments to the NPC on the initial draft of the PIPL in November 2020. Many of the comments that CIPL put forward in its initial response are still relevant and applicable to the updated PIPL. CIPL reiterates many of its previous recommendations in the current response and highlights several new considerations that the NPC should take into account as it continues to work on the PIPL.

Key recommendations from the response include:

• Providing further clarity on when consent is required under the PIPL. The NPC has stated in the updated version of the PIPL that consent is not required for circumstances stipulated under Articles 13(2)-13(7) of the draft law (i.e., the other legal bases for processing). CIPL recommends that the NPC cross reference this assertion in other provisions of the PIPL that require consent for specific processing operations.
• Providing further clarity on the impact of withdrawing consent. CIPL appreciates that the NPC has clarified that where an individual withdraws consent to processing, such withdrawal shall not affect processing activities that have taken place prior to the withdrawal. CIPL recommends that the NPC further clarify that withdrawal of consent does not affect certain ongoing forms of processing that rely on the integrity of datasets, and to which an individual initially provided consent (e.g., processing data for medical research that has already commenced).
• Adding a legitimate interest processing ground to the PIPL. Given its increasing use in data protection laws globally and its utility in ensuring that many forms of processing operations not covered by other legal grounds can still take place, CIPL recommends that the NPC include a legitimate interest ground for processing in the next version of the PIPL.
• Enabling a risk-based approach to determining whether an organization is processing the personal information of minors in the context of mixed audience websites. CIPL recommends that the NPC enable personal information processors to make a contextual determination based on a number of factors to determine whether they are processing the personal information of minors in order to meet the requirements of Article 15 of the PIPL for mixed audience websites and services.
• Revising some aspects of the international data transfers provisions. CIPL restates several of the recommendations it has previously made with respect to international transfers, including removing the requirement to obtain consent in addition to using cross-border transfer mechanisms listed under the PIPL. CIPL further recommends in the current response that the NPC reinstate the general goal of safeguarding the orderly and free flow of personal information under Article 1 of the PIPL, and consider existing model contractual clauses in other jurisdictions in formulating any model contracts for transfers under the PIPL (e.g., ASEAN Model Contractual Clauses for Cross-Border Data Flows).
• Providing clarity on which types of personal information processors are required to set up an external independent body to supervise processing and publish social responsibility reports. CIPL recommends that the NPC clarify: the parameters that trigger the requirements of Article 57 of the PIPL, who exactly the provision applies to and how the requirements apply to online platform services that do not have insight into certain activities undertaken on their platforms.
• Approaching anonymization from a risk-management perspective, and not as a technique or end state. CIPL recommends that the NPC revise the definition of anonymization to reflect the more realistic standard of reasonable anonymization coupled with procedural, legal and administrative safeguards.

To read about the above recommendations in detail, along with all of CIPL’s other recommendations, please see the full response (in English or in Mandarin).