CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy- Related Laws Privacy and data protection provisions within the Chinese legal framework are scattered across laws and regulations at different legislative lev - els. In terms of specialised legislation on cyber - security and data protection, China has estab - lished a comprehensive legal framework that includes several key laws and regulations – ie, the “Three Fundamental Laws”: • the Cybersecurity Law (CSL; 网络安全法 ); • the Data Security Law (DSL; 数据安全法 ); and • the Personal Information Protection Law (PIPL; 个人信息保护法 ). These operate together with the “Three Key Regulations”: • the Regulations for the Administration of Network Data Security (RANDS; 网络安全数据管 理条例 ); • the Security Protection Regulations for Criti - cal Information Infrastructure ( 关键信息基础设施 安全保护条例 ); and • the Regulations on the Graded Protection for Cybersecurity (Draft for Comments) ( 网络安全等 级保护条例 ( 征求意见稿 )). The Three Fundamental Laws and the Three Key Regulations form the pillars of China’s cyberse - curity and data protection legal framework, with each addressing different aspects of data secu - rity and privacy. The CSL was enacted on 1 June 2017 and forms the backbone of cybersecurity and data privacy protection legislation in China. The DSL came into effect on 1 September 2021 and is the fun -
damental law in the data security sphere, widely covering data security mechanisms, obligations and liabilities at both state administration and data processor level. The PIPL came into effect on 1 November 2021 and embraces the new era of personal information (PI) protection as well as corporate data protection compliance. The Three Key Regulations further detail the cyber - security and data protection requirements set forth in the Three Fundamental Laws from dif - ferent perspectives. In addition to the specialised legislation, China’s general legislation may also include provisions on privacy and data protection. Specifically, the Civil Code ( 民法典 ) plays a significant role in this regard. The Civil Code’s provisions relating to data privacy protections are basically consist - ent with the requirements provided in the Three Fundamental Laws, further solidifying the legal foundation for privacy and data protection in China. Data protection regulations on privacy are also scattered in: • the Criminal Law ( 刑法 ); • the Law on the Protection of Consumer Rights and Interests (Consumer Protection Law; 消费者权益保护法 ); • the E-commerce Law ( 电子商务法 ); • Several Issues Concerning the Application of Law in the Trial of Civil Cases Relating to the Use of Facial Recognition Technologies to Process Personal Information ( 最高人民法院关于 审理使用人脸识别技术处理个人信息相关民事案件适用法 律若干问题的规定 ), etc.
1.2 Regulators Key Regulators
Since data regulation is a topic that impinges upon all industries, there is a wide range of law enforcement departments related to it, many of which have intersecting duties and authorities.
73
CHAMBERS.COM
Powered by FlippingBook