CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
Restrictions on Use of Sensitive or Children’s Data for Marketing Purposes The collection and use of sensitive PI for marketing purposes is subject to strict limitations under the PIPL. For any marketing activity involving sensitive PI, separate consent must be obtained, and individu - als shall be informed of the necessity of processing sensitive PI and the impact on their rights. Regarding children’s data, which is classified as sen - sitive PI under the PIPL, enhanced protections are established. When processing the PI of minors under the age of 14, the consent of their parents or other guardians must be obtained. The Regulations on the Protection of Minors in Cyberspace ( 未成年人网络保护条 例 ) stipulate that commercial marketing shall not be conducted towards minors through automated deci - sion-making methods. Consequently, the use of chil - dren’s data for marketing purposes may only proceed under these strictly limited conditions. Consent Requirements Since online marketing, particularly personalised advertising, is normally based on the analysis of PI collected from users, regulations on PI collection and use must be observed. PI may not be collected or used for personalised advertising if the PI subjects have not agreed to this. 4.3 Employment Privacy Law The PI processing requirements stipulated in the Three Fundamental Laws are also applicable to the employ - ment context. As an exception, where the process - ing of employee PI is necessary for human resources (HR) management purposes, consent or applying the CBDT mechanisms (refer to 5.1 Restrictions on Inter- national Data Transfers for details) may no longer be required. However, it is essential to ensure that any such processing is conducted in accordance with lawfully established labour rules or legally executed collective contracts. Additionally, the HR necessity of the data processing must be clearly substantiated. Employees Monitoring The monitoring of employees, such as through time- tracking systems, must comply with principles of necessity and legitimacy. Employers should inform employees of the monitoring purpose, scope and
methods. Processing must be justified as necessary for HR management (eg, performance assessment) under lawful labour rules; otherwise, consent must be obtained. Remote Work For remote work, employers must establish clear poli - cies regarding the use of company-provided or per - sonal devices. Employees should be informed about data collection related to remote activities (eg, work hour logs), and the data processing must adhere to the “necessity” test under labour rules. Use of IT Systems Employers using IT systems (eg, email, internal plat - forms) to process employee data must define the pur - pose and scope in labour rules or labour contracts. Processing for HR management (eg, payroll, attend - ance) typically does not require consent. However, for systems involving non-essential data for HR manage - BYOD policies require balancing security needs with employee privacy. Employers must clarify employee PI collection scope in the BYOD scenario and imple - ment security measures for the collected data accord - ingly. Consent may be needed if processing extends beyond HR necessities. Background Checks Background checks must be lawful, necessary and transparent. Employers should obtain prior consent and limit checks to job-relevant information. Exces - sive data collection, such as unrelated health details, is not allowed. Results must be kept confidential and securely stored, with retention periods aligned with HR purposes. Job Application For job applications, employers must inform can - didates of the data processing purposes, such as recruitment evaluation. Consent is typically required, and separate consent may be needed as stipulated in the PIPL. Data of unsuccessful applicants should be deleted after the necessary retention period expires, in accordance with the data minimisation principle. ment, consent may be needed. Bring Your Own Device Policies
59 CHAMBERS.COM
Powered by FlippingBook