China’s First National Standard on Personal Information Protection to Take Effect

Feb. 4 – China’s first national standard on personal information protection, namely the “Guideline on Information Security Technologies for the Protection of Personal Information in Public and Commercial Service Information Systems (hereinafter referred to as the ‘Guideline’),” came into effect on February 1, 2013. The Guideline, which was officially released last November, is the first of its kind in China.

Leaking of private information has already aroused nationwide concern in China, and with the wider application of information technology services and a growing number of Internet users across the country, the problem has become more and more prevalent. As such, a sound system on personal information protection has been introduced in an attempt to curb the unauthorized disclosure and illegal use of personal data. And although the Guideline currently lacks the force of law, it still represents a significant step forward in the fight for personal information protection in China.

According to the Guideline, processing of personal information must be for specific, clear and reasonable purposes, and the collection of such information should be subject to the permission of the individual who has been well-informed. Furthermore, such information should be deleted once its intended use has been fulfilled.

The Guideline divides personal information into “general personal information” and “sensitive personal information.” Specifically, sensitive personal information refers to personal information which would have a negative impact on an individual once it has been leaked or modified. Such information includes information included on an individual’s personal identity card, fingerprints, personal religions and political views. Therefore, it can only be collected upon the express consent of the individual concerned.

General personal information refers to all personal information other than sensitive personal information, and can be collected and processed as long as the individual concerned does not expressly raise objections.

In addition, information administrators shall not collect any personal data that exceeds the information they require. Express consent from the individual concerned is required when transferring his or her personal information outside of China.

---