9 December 2013

China strengthens protection of consumers’ personal data

The Law of the People’s Republic of China on the Protection of Consumer Rights and Interests (the “Law“) was amended on 25 October 2013 to introduce obligations for the protection of consumers’ personal data (the “Amendment“).  This is the first time it has been amended since its entry into force in 1993.

This information is available in English only.

The Amendment introduces regulations designed to cover the increase in online shopping in China and addresses issues relating to e-commerce fraud and the illegal disclosure of consumers’ personal data. To that end, the Amendment introduces several obligations for companies that provide goods or services to consumers within the People’s Republic of China. Such business operators must:

  • abide by the principles of lawfulness, fairness and necessity when collecting and using the personal data of consumers
  • inform consumers, in explicit form, of the purpose, method, scope of collection and use of personal data and obtain their consent to the collection and use
  • publish its data practices in relation to its collection and use of consumers’ personal data
  • keep consumers’ personal data strictly confidential, and not disclose, sell or illegally provide this data to others
  • take necessary measures to ensure security of consumers’ personal data and upon the disclosure or loss of this data, take immediate remedial measures
  • not send any commercial information either to consumers without their consent or request, or to consumers who have expressly refused to receive this information.

The Amendment itself does not provide further information on how the principles should be interpreted (e.g., it does not contain a definition of personal data). How the Amendment will be interpreted and enforced is therefore subject to further guidance. 

Enforcement
The Amendment vests the administration and enforcement of the Law in the State Administration for Industry & Commerce (the “SAIC“) and its local counterparts, except for areas or sectors where a specific authority has been designated. The enforcement instruments of the SAIC include issuing warnings, confiscating illegal earnings and imposing fines. Fines may be imposed up to RMB 500,000 (approximately EUR 61,100) and in the case of illegal earnings, up to ten times the amount of the illegal earnings. A business operator’s business licence may be suspended or even revoked for serious violations.

Entry into force
The Amendment enters into force on 15 March 2014, which is also Consumer Rights Protection Day in the People’s Republic of China. Companies that fall within the scope of the Amendment are advised to review their data practices and to take any necessary steps to ensure compliance with the Amendment prior to 15 March 2014.