CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
sonal Information Processing (GB/T 45574-2025 敏感个 人信息处理安全要求 ), the following constitute sensitive PI: • health data; • data about political/religious orientation;
tific and technological ethics, shall establish a review committee for scientific and technological ethics. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Privacy Requirements for Use of Personal Data AI-generated content (AIGC) developers and service providers should comply with essential data protection laws when carrying out PI processing activities. For instance, both the PIPL and the DSL require data mini - misation and purpose limitation, which directly affects how AI models are trained. AI systems that process PI must ensure that users can exercise their rights as set out under the PIPL. AI systems must incorporate robust security measures to prevent breaches of PI and AIGC service providers shall build these features into their platforms to comply with such data protec - tion requirements. Furthermore, Article 7 of the Interim Measures for the Administration of Generative Artifi - cial Intelligence Services (“AIGC Measures”; 生成式人工 智能服务管理暂行办法 ) provides that AIGC service provid - ers shall ensure the lawfulness of the training model and data sources when processing training data, and data subjects’ consent shall be obtained if any PI is involved. Automated Decision-Making Using AI Article 24 of the PIPL sets forth restrictions on the use of PI for automated decision-making. When uti - lising PI for automated decision-making through AI, the transparency of the decision-making process and the fairness and impartiality of the outcomes shall be ensured. Unreasonable differential treatment against individuals in terms of transaction conditions such as pricing is prohibited. When a decision significantly affecting an individual’s rights and interests is made through automated decision-making, the individual is entitled to request an explanation and has the right to refuse the decision being made solely through auto - mated decision-making. Risk-Based Regime China implements inclusive, prudent, categorised and tiered regulation over AIGC services, constituting a risk-based regime. There is no provision explicitly pro - hibiting the use of AI in specific high-risk application scenarios. However, AI shall not be used to generate illegal information or to engage in illegal activities. For
• data on criminal convictions; and • PI of minors under the age of 14.
The processing of such data requires the separate consent of the individual. In addition to the general notification items stipulated by the PIPL, the individual must also be informed of the necessity of processing the sensitive PI and its impact on their rights and inter - ests. For processing the PI of minors under the age of 14, the consent of the minor’s parents or other guard - ians must be obtained, and dedicated PI processing rules shall be formulated. Regarding other special categories of PI, such as per - sonal financial data and genetic data, their processing is governed by separate legislation or sector-specific laws and regulations. 1.4 Processing of Personal Data for Research and Development Purposes Under the PIPL, “anonymisation” refers to the pro - cessing of PI in a manner that makes it impossible to identify certain natural persons and so that it cannot be recovered. Once data meets this standard, it is no longer considered PI, and its subsequent use gen - erally does not require obtaining individual consent. However, achieving this status is contingent upon the company having fully fulfilled its obligation to inform and obtain the corresponding legal basis when pro - cessing the original data. In other words, the subse - quent anonymisation process must be founded upon the lawful collection of the original data. Furthermore, the Measures for Review of Scientific and Technological Ethics (Trial) (“Ethics Review Meas - ures”, 科技伦理审查办法 ( 试行 )) stipulate that scientific and technological activities involving human participants, including those utilising human biological samples or PI, shall undergo a review of scientific and technologi - cal ethics. Entities engaged in scientific and techno - logical activities in fields such as life sciences, where the research content involves areas sensitive to scien -
51 CHAMBERS.COM
Powered by FlippingBook