New law paves way for private enforcement against personal-data abuse in China

Private lawsuits as a tool to combat abuse of individuals’ personal data are likely to become more frequent as China enters a new era of civil law with an expanded and specified definition of one’s rights to the protection of personal data as a personality right.

The expanded legal protection is in a new Civil Code, the first of its kind in the history of the People’s Republic of China, which has been approved by the National People’s Congress, China’s legislature, and is due to come into effect next year.

This comprehensive piece of legislation, comprising 1,260 entries, covers a range of topics on individuals’ civil rights concerning ownership, contracts, personality, inheritance, marriage and family, and tort liability, replacing previous standalone laws on these issues.

By putting the protection of personal data under the umbrella of personality rights without prior legislation, which in itself is a new concept, the Civil Code will provide further legal basis for individuals to protect their personal data and privacy and allow them to seek redress for matters that would previously have been difficult.

It also suggests the importance the Chinese government has attached to data protection in the digital age, and in doing so, will further boost public awareness about the value of personal data.

Among actions allowed under the Civil Code, individuals will be able to require the infringing party to stop an action, pay for damages, restore the individuals’ reputation and apologize. It will also allow an individual to sue an infringing party over a violation, like other civil disputes.

The Civil Code has refined and expanded the definitions of privacy and personal-information rights in the previous General Principles of the Civil Law by setting out specific examples and scenarios, requirements for data processors and rights of data subjects. These enhancements will bring China more in line with international practices.

Before the Civil Code, a major reference for companies to comply with the personal-data regulations in the Cybersecurity Law was the Personal Information Security Specification, a non-compulsory national standard that doesn’t have legal obligations for non-compliance.

Infringement of one’s personal information, such as the sale of personal data without consent, is already a crime through an amendment to the Criminal Law in 2015. The Ministry of Public Security, the country's police force, has prioritized these infringements for several years.

In its 2019 campaign, the police reported 2,868 cases involving infringement of personal information and the arrest of 7,647 individuals.

Public enforcement by other regulators, such as the Cyberspace Administration and industry regulators, has also been active since the Cybersecurity Law came into effect in June 2017, which resulted in companies receiving administrative fines and having their services temporarily suspended.

But cases of private damage-claims for harm caused by mishandling of data remain rare.

A study conducted on the judgment database operated by PKULAW found only 23 cases involving allegations of abuse of personal information since 2009 and only one judgment was based on the right to protection of personal information in the General Principles of the Civil Law, which also came into effect in 2017.

Zhang Xinbao, a Chinese legal scholar who conducted the research, said the small number of civil cases was likely a result of legal costs, high standard of proof and the small financial quantity that can be claimed in damages.

Prosecutors, however, have been exploring ways to address this, such as the use of public-interest lawsuits and introducing a punitive-damages system.

The Civil Code was passed at a time when China is stepping up legislative efforts around data protection. The National People’s Congress highlighted again this year its plan to draft a Personal Information Protection Law and Data Security Law.

Implementing the Civil Code will be the main task for legislative and judiciary bodies next year. The Civil Code will also pave way for the long awaited Personal Information Protection Law.

The Supreme People’s Court recently held an internal meeting to promote the implementation of the Civil Code and will start cleaning up old laws and drafting new judicial interpretations for implementing the Civil Code, according to a statement.