CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
2. Privacy Litigation 2.1 General Overview
In this case, regarding disclosure and trans - parency requirements, the Guangzhou Internet Court decided that the scope of recipients and the geographical regions are not clearly stated in the privacy notice, and data subjects are not explicitly informed where their PI will be trans - mitted or how it will be processed, which fails to comply with Articles 7 and 17 of the PIPL. Regarding the legal basis for such CBDT, the court affirmed that intragroup sharing of custom - ers’ PI via the hotel’s central booking system to the overseas booked hotel and the global head - quarters is legitimate and necessary for hotel management. However, the court ruled out the legitimacy of transferring the customer’s PI to intragroup marketing departments and external business partners for the purpose of “marketing”, as it is not “necessary for performing the contract”, and thus the hotel group is still legally required to obtain the customers’ separate consents on such CBDT in accordance with the laws. Since the hotel failed to obtain the customer’s separate consent, the court held that the hotel’s data pro - cessing activities have not obtained adequate legal basis and are thus illegal, and ruled that the hotel should bear the corresponding infringe - ment liability, which includes compensation for damages, the deletion of relevant PI and an apology to the individual. 2.3 Collective Redress Mechanisms Article 70 of the PIPL establishes the mechanism of public interest litigation for PI infringement. Where any PI handler processes PI in violation of the PIPL, which infringes upon the rights and interests of a large number of individuals, a lawsuit may be brough to a people’s court in
In China, the majority of PI protection litiga - tion cases are public interest litigation. In 2023, procuratorial organs in China handled more than 6,300 public interest lawsuits on PI protection. China also allows individuals to initiate private litigation, and the legal bases for an individual to initiate private litigation mainly include the Civil Code, the Consumer Protection Law, the CSL and the PIPL. The number of privacy litigation cases brought by individuals has increased rapidly in recent years. According to announcements by the Beijing Internet Court, it received a total of 113 cases related to PI protection disputes between October 2023 and October 2024. In contrast, merely 58 such cases were handled by the same court in the past five years leading up to 2023. This increase highlights a rapid growth trend in PI protection dispute cases. One of the most noteworthy cases reflecting the impact of international developments on domes - tic litigation is the first case related to CBDT issues announced by Guangzhou Internet Court (further discussed in 2.2 Recent Case Law ). Along with international economic and business developments, CBDT issues have become the focus of data subject attention, and a rise in pri - vacy litigation involving CBDT is expected in the coming year. 2.2 Recent Case Law One privacy litigation case worth noting involved an individual customer suing a European hotel group for infringement of their PI rights and inter - ests due to CBDT.
accordance with the law by: • the People’s Procuratorate;
79
CHAMBERS.COM
Powered by FlippingBook