CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
management, then it is generally considered that the employer does not need to obtain the employee’s consent for such PI processing. However, if the processing of such PI cannot be adequately justified as being necessary for HR management, the employer still should obtain the employee’s consent (including separate con - sent if applicable) as required by the PIPL. Employers should also follow the data process - ing principles of lawfulness, legitimacy, necessity and data minimisation. Employers must ensure employees’ privacy-related rights, and adhere to other general requirements for PI processing, such as taking appropriate security measures to safeguard PI. CBDT of Employee PI Employers that intend to transfer employees’ PI outside of China must adhere to specific restrictions and requirements as set out under the PIPL. This could have significant implications for multinational companies, particularly those with operations both in China and abroad, as it is common practice for such companies to con - duct intragroup sharing of employees’ PI. According to Article 5.2 of the Provisions on Facilitating and Regulating Cross-border Data Flows (“CBDT Provisions”; 促进和规范数据跨境流动 规定 ), where it is necessary to outbound trans - fer employees’ PI for the purpose of conducting cross‑border HR management in accordance with the labour rules and regulations formulated and collective contracts concluded in accord - ance with the laws, companies are exempt from submitting applications of security assessment, obtaining certification from the approved agen - cies or filing for standard contractual clauses. For transferring employee PI abroad, employers still need to obtain legal basis for such CBDT
and to meet the disclosure obligations in accord - ance with Article 39 of the PIPL. On the other hand, employers will be exempted from submit - ting CBDT application procedures for outbound transfers of employees’ PI that are necessary for HR management, thereby significantly reducing the compliance burden borne by employers. Employer Liability and Accountability The PIPL and related regulations hold employ - ers accountable for how they handle employee PI. If employers illegally mishandle or misuse employee PI, they could face severe penalties, including fines, restrictions on operations or even legal actions by employees. To avoid such risks, employers need to revise their HR policies to ensure data privacy compliance in employee onboarding, performance evaluations and res - ignation procedures. Employers shall also pro - vide training for HR staff to understand the legal obligations around employee PI handling. Strin - gent security measures shall be taken to protect employees’ PI from breaches, which also impacts the company’s internal practices and operations. Challenges for Employers The evolving regulatory legal framework of data privacy is shaping the employment relation - ship by balancing the protection of employees’ PI against the operational needs of employers. Employers are required to adopt more robust data protection measures and to enhance trans - parency in their management of employees’ PI. This presents new challenges for employers, such as increased costs associated with imple - menting data protection efforts and introducing legal complexities. Multinational companies with operations in China must navigate the intricate landscape of data protection laws across mul - tiple jurisdictions. Such companies may also encounter difficulties in aligning and harmonis -
84
CHAMBERS.COM
Powered by FlippingBook