CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
requirements. According to Article 5 of the PIPL, the collection and use of PI must follow the prin - ciples of legality, legitimacy and necessity, which means that the use of cookies for user informa - tion collection must comply with these princi - ples. Individuals must be truly, accurately and completely informed about the use of cookies in a prominent manner and in clear and under - standable language, and the explicit consent of users must be obtained in accordance with Articles 13 and 17 of the PIPL. The use of cook - ies should also follow other general principles of data minimisation and data security protection. Furthermore, if cookies are collected and used for behavioural or targeted advertising that has not been agreed to by the data subjects (and no other legal basis exists), that collection and use of cookies would be deemed illegal. 4.2 Personalised Advertising and Other Online Marketing Practices The Advertising Law ( 广告法 ) is the fundamental law that regulates advertising. The Measures for Administration of Internet Advertising ( 互联网广告 管理办法 ) apply to online marketing. The sender must obtain consent to, or a request for, adver - tising from the recipients, and the sender must also disclose their true identity, contact details and the opt-out method for advertisements dis - tributed via electronic means. In addition, since online marketing, particularly behavioural and personalised advertising, is nor - mally based on the analysis of PI collected from users, regulations on PI collection and use must be observed. To begin with, PI may not be collect - ed or used for personalised advertising if the PI subjects have not agreed to this. Pursuant to Arti - cle 24 of the PIPL, if business marketing or push- based information delivery is conducted towards an individual by means of automated decision- making, an option not targeting the personal
characteristics of the individual, or an easy way to refuse to receive this, must be provided to the individual. In addition, according to the Informa - tion security technology – Personal information security specification (GB/T 35273–2020 信息安全 技术 个人信息安全规范 ), the use of indirect user profil - ing generated from PI that is not from particular persons is recommended for online marketing, rather than direct user profiling. Also, where a per - sonalised display is used for online marketing, an option to turn the function off and to delete or anonymise the PI used for such a personalised display should be provided to the users. 4.3 Employment Privacy Law Currently, there is no special data privacy law or regulation regulating the employment relation - ship. The PI of an employee is subject to the same PI protection regime as that of any other regular person. The employee PI protection is governed by the Employment Law ( 劳动法 ), the Employment Contract Law ( 劳动合同法 ), the CSL, the PIPL and other relevant laws and regula - tions governing PI. These laws have the follow - ing implications for the employment relationship. Employee Data Protection Under the PIPL, employers must ensure that they collect, store and process employee PI in compliance with the legal requirements – eg, employees must be informed about how their PI will be collected, processed or shared. An employer must have at least one legal basis for processing employees’ PI. These legal bases may include obtaining employees’ consent or processing such PI as necessary for human resources (HR) management under labour rules and collective agreements lawfully entered into, etc. If the processing of employees’ PI is speci - fied in the employer’s lawfully established labour rules or in a legally executed labour contract, and can be defined as being necessary for HR
83
CHAMBERS.COM
Powered by FlippingBook