CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
Moreover, the National Data Bureau, inaugurated in October 2023, is responsible for overseeing the inte - gration, sharing and development of data resources, co-ordinating the construction of data infrastructure systems, and the planning and construction of digital China, the digital economy and digital society. Co-Ordination With Privacy and Competition Authorities The regulation of PI and non-personal data is inte - grated through a shared enforcement framework. The CAC leads the enforcement of the PIPL but its mandate extends into network data issues, which may involve non-personal data regulation. Sectoral author - ities also assume regulatory duties over both PI and non-personal data within their respective industries. China’s competition authorities, primarily the SAMR, also collaborate with non-personal data regulators. In early 2025, the SAMR, jointly with the National Data Bureau, the CAC and three other departments, issued the Implementation Plan for Improving the Security Governance of Data Circulation to Better Promote the Marketization and Value Realization of Data as a Factor of Production (“Implementation Plan”, 关于完善 数据流通安全治理 更好促进数据要素市场化价值化的实施方案 ). It explicitly stipulates the punishment of monopolistic and unfair competition practices involving the use of data, thereby providing guidance for subsequent enforcement by the SAMR. In daily operations, these authorities have established mechanisms for informa - tion sharing, case notification, and co-ordinated law enforcement. For instance, non-personal data regula - tors may transfer leads to the SAMR if they discover indications of unfair competition involving data dur - ing routine oversight. Conversely, when investigating cases of data-related unfair competition, the SAMR may require the CAC to provide professional input on data regulation. Enforcement Trends The joint formulation and issuance of core policies by multiple authorities has become a regular practice. A case in point is the Implementation Plan, which aims to promote the utilisation of data. Various sectoral authorities have intensively introduced detailed data rules specific to their respective industries. For exam - ple, both the People’s Bank of China and the MIIT
have issued or drafted relevant sector-specific regu - lations, thereby making the oversight more scenario- specific and practical.
4. Sectoral Topics 4.1 Use of Cookies
The use of online tracking technologies is usually regarded as PI collection, which must comply with PI protection-related requirements. According to the PIPL, the collection and use of PI must follow the principles of legality, legitimacy and necessity, which means that the use of online tracking technologies for user information collection must comply with these principles. Individuals must be truly, accurately and completely informed in a prominent manner and in clear and understandable language, and consent must be obtained. The “opt-out” model is generally not permitted under the core principles of the PIPL. 4.2 Personalised Advertising and Other Online Marketing Practices The Advertising Law ( 广告法 ) is the fundamental law that regulates advertising. The Measures for Adminis - tration of Internet Advertising ( 互联网广告管理办法 ) apply to online marketing. The sender must obtain consent to, or a request for, advertising from the recipients, and the sender must also disclose their true identity, contact details and the opt-out method for advertise - ments distributed via electronic means. Restrictions on Profiling Pursuant to Article 24 of the PIPL, if business mar - keting or push-based information delivery is con - ducted towards an individual by means of automated decision-making, an option not targeting the personal characteristics of the individual, or an easy way to refuse to receive this, must be provided to the individ - ual. In addition, according to the Information security technology – Personal information security specifica - tion (GB/T 35273–2020 信息安全技术 个人信息安全规范 ), the use of indirect user profiling generated from PI that is not from particular persons is recommended for online marketing, rather than direct user profiling.
58 CHAMBERS.COM
Powered by FlippingBook