Personal-data legislation tops the agenda, as China’s political assemblies kick off meetings

Legislation on protection of privacy and personal data remains at the top of the agenda for members of a key Chinese policy advisory body, as they gather in Beijing for their annual meetings.

Representatives of China’s National People's Congress — the country’s legislature — and the Chinese People's Political Consultative Conference — a political advisory body — will kick off their annual plenary sessions tomorrow and today, respectively, following delays caused by Covid-19.

Members of the political Consultative Conference, including delegates from various political parties and organizations in China, have again raised proposals concerning legislation on privacy rights and personal-data protection.

The question of whether to draft legislation to protect personal data has become a frequent topic during these sessions since China enacted the 2017 Cybersecurity Law, which covers issues including network security and data processing.

The Chinese legislature has already indicated that it’s working on what are to be known as the Personal Information Protection Law and a Data Protection Law. The legislature recently announced that a draft of the Personal Information Law was ready.

Members of the political consultative conference this year have called to step up the formulation of the Personal Information Protection Law as personal data protection has become an enforcement priority in China, amid growing public awareness.

Last year, the country conducted a sweeping campaign targeting abusive data collection and processing by mobile apps and the momentum has continued to build this year, with small-scale enforcement and routine inspection launched by industry regulators and local authorities.

The subject has attracted fresh public attention due to the Covid-19 pandemic, during which China has used the analysis of personal data to contain the spread of the disease, leading to concerns that people’s personal details had been illegally circulated.

Lian Yuming, the head of the International Institute for Urban Development, a research institute, has proposed to establish a mechanism specifically for data handling during pandemics, awarding high-level protection for data used to control pandemics.

Other proposals include to differentiate individuals under 18 further into different age ranges, to better protect their privacy online under the Minors Protection Law, which is currently undergoing a review.

The government rolled out the Regulations on Protection of Children’s Personal Information last October.

There are also calls for the establishment of a regulatory body dedicated to personal data protection, with responsibility for privacy regulation currently falling on several agencies, as well as the introduction of the right to be forgotten, a concept included in the EU’s General Data Protection Regulation.

One important entry on this year’s agenda of the National People's Congress, the legislative assembly, is to review the draft Civil Code, which has been a major lawmaking project for the government in recent years.

The draft Civil Code has a section on Personality Rights, which covers privacy rights and personal information protection. The section sets out definitions of privacy and personal information, as well as principles for data collection.