Draft law expected to better protect personal info

Organizations and individuals handling personal information should fully inform its owners and get their permission before collecting, storing or using it, according to a draft law being deliberated by Chinese lawmakers.

It is the first time that the draft law on personal information protection has been submitted for review to the bimonthly session of the National People’s Congress Standing Committee, the country’s top legislature.

If the aims, means of collection or categories of personal information change, those handling it should get renewed permission from its owners, who also have the right to withdraw their permission, according to the draft law.

By the end of March, China had 900 million internet users, with over 4 million websites and some 3 million apps, “meaning personal information has been widely collected and used”, Liu Junchen, deputy director of the NPC Standing Committee’s Legislative Affairs Commission, said on Tuesday.

“Although we have intensified protection of personal information in recent years, a few enterprises, institutions and individuals are still collecting, illegally purchasing, overusing or misusing personal information for profit,” he told lawmakers, adding that this was disturbing people’s daily lives.

Liu hailed previous legislative efforts to safeguard personal information, such as the enactment of the Cybersecurity Law and the E-Commerce Law and amendments to the Criminal Law and the Law on the Protection of Consumer Rights and Interests, but said it was “difficult to keep up with the rapid development of information and people’s increasing demands for better lives”.

He said special legislation was needed to respond to public concerns and the scattered coverage of personal information protection in various laws, highlighting its role in maintaining a good online environment and boosting healthy growth of the digital economy.

Given the major role big data has played in preventing the spread of COVID-19 and helping businesses recover from the effects of the pandemic, Liu said, “the draft allows the handling of personal information to face public health incidents and protect people’s health and life in emergencies”.

The draft also says sensitive personal information, such as that related to ethnicity, religion, biological features, financial accounts and whereabouts, needs to be handled more strictly.

Organizations and individuals that handle personal information overseas but aim to provide products or services for users on the Chinese mainland, or analyze or evaluate the behavior of its residents, will also need to follow the requirements of the draft law and establish special institutions or have representatives responsible to protect the personal information.