Is It Time to Revise Your Company’s Personal Data Privacy Policies? New Legislation Demonstrates China Is Serious About Personal Data Privacy

By Russell Leu, Sheppard Mullin Richter & Hampton LLP*

A common question a foreign company doing business in China asks is how to administer and maintain the personal data of its employees, especially when such personal data is collected, transmitted or stored online. Companies doing business in China should take heed that China is now paying more attention to online personal data privacy protection, and this especially may include a company’s handling of an individual employee’s personal data. For companies seeking to enter China’s lucrative e-commerce market, this summary may provide a starting point on structuring a business plan. Recently, China has enacted new personal data privacy laws which govern the collection, use, maintenance and dissemination of personal data. These laws are directed at a wide range of groups, including network service providers, business enterprises and business operators, organizations and government institutions. The new laws were developed in response to two growing pains – employees of government institutions which collected large amounts of data electronically in the course of their business activities were selling or unlawfully providing third parties with personal data, and secondly, China’s consumers have developed an enormous appetite to spend domestically via e-commerce. China’s e-commerce is a lucrative retail market with serious business implications as 40% of its population uses the internet, and its economy has benefited greatly from domestic e-commerce retail spending. In 2012, Chinese consumers spent RMB 1.3 trillion on online purchases, and it is estimated that by 2015, online purchases will reach RMB 3.3 trillion.¹

Last year, Chinese lawmakers passed a set of significant laws addressing personal data privacy. To ensure compliance, companies should be aware of the various new rules and regulations affecting the collection, processing, and use of personal information. The passage of this new legislation presents an opportune time for companies to internally review existing data collection and management policies and practices; determine whether these policies and practices comply with the new laws; and where necessary, develop or revise appropriate policies and practices.

I. CHINESE LEGISLATION ON PERSONAL DATA PRIVACY