CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
1.6 Data Breach Requirement According to Article 57 of the PIPL, in the event of a PI leak, alteration or loss, or where such an inci - dent is likely to have occurred, the PI handler shall immediately take remedial measures and notify the competent authority and the affected individuals. The notification shall include: • the categories of PI involved, the causes of the incident and the potential harm that may result; • the remedial measures that have been taken and the measures individuals can adopt to mitigate the harm; and • the contact details of the PI handler. The Measures for the Administration of National Cybersecurity Incident Reporting ( 国家网络安全事件报告管 理办法 ) further specify the thresholds, procedures and timelines for such reporting. For a “relatively major” incident – for instance, one involving the PI leakage of more than one million individuals – a report shall be submitted to the cyberspace administration authority within four hours. If the network operator is a Critical Information Infrastructure Operator (CIIO), the report shall be submitted within one hour. Upon being informed of the incident, the competent authority may initiate an investigation in accordance with the law. Mass data privacy litigation is also pos - sible – refer to 2.3 Collective Redress Mechanisms for more details. 1.7 Regulators Key Regulators and Their Core Competence Since data regulation is a topic that impinges upon all industries, there is a wide range of law enforcement departments related to it, many of which have inter - secting duties and authorities. There is no centralised regulatory body. Among all these regulators, the most important ones include: • the Cyberspace Administration of China (CAC); • the Ministry of Public Security (MPS); and • the Ministry of Industry and Information Technology (MIIT). The CAC is in charge of overall planning with regard to data protection and privacy, and co-ordinates the
instance, it is prohibited to use AI to generate content that infringes upon the lawful rights and interests of others or endangers national security, etc. Further - more, AIGC technology shall not be utilised to engage in monopolistic or unfair competition practices. How AI Regulation Affects Data Protection in China Where PI processing is involved in AI scenarios, the essential data protection laws shall be complied with. Simultaneously, specialised regulations govern - ing AI, such as the AIGC Measures, impose further specific requirements regarding the PI processing in AIGC services. Specific provisions have been formu - lated in key data protection regulations to address AI development while simultaneously ensuring a balance between innovation and data protection. For instance, the newly amended CSL specifically incorporates framework provisions on AI safety and development, emphasising that China will improve ethical norms for AI and strengthen risk monitoring, assessment and security oversight. The transparency requirements under the PIPL, which mandate the full fulfilment of notification obligations, are also applicable to AIGC services when processing PI. The AIGC Measures also require AIGC service pro - viders to enhance the transparency of their services, as well as the accuracy and reliability of the generated content. The RANDS provide that, in so far as the training data and processing activities thereof are concerned, the network data handlers providing AIGC services shall fulfil relevant security management obligations, which demonstrates the emphasis placed on data govern - ance. The Ethics Review Measures stipulate that entities engaged in AIGC activities, where the research con - tent involves areas sensitive to scientific and techno - logical ethics, shall establish an ethics review commit - tee, conduct reviews of scientific and technological ethics for the AIGC activities and implement follow-up supervision over the AIGC activities.
52 CHAMBERS.COM
Powered by FlippingBook