CHINA Trends and Developments Contributed by: Vincent Wang, Xinyao Zhao and Amy Cao, Global Law Office
tive industries, and then use the Standard to determine data levels and assess whether they meet the criteria of important data therein. Moreover, MIIT released the Second Draft Guide - lines for Identification of Important Data in the Industrial Field and the most recent Guidelines for Identification of Important Data in the Tel - ecommunications Field. Both guidelines indicate that personal data related to certain groups, or sensitive personal data affecting over 100,000 individuals, may qualify as important data, underscoring the rising concern over the pro - tection of large-scale personal data sets. Personal Information Protection Compliance Audit (PIPCA) The PIPL mandates that businesses conduct a PIPCA regularly or when required by regulators, particularly when personal information process - ing activities pose significant risks or follow - ing data security incidents. The Administrative Measures on Personal Information Protection Compliance Audit (the “PIPCA Measures”) was finally published on 14 February 2025 and will take effect on 1 May 2025. The PIPCA Measures further supplemented and clarified the PIPCA framework by including an exhibit specifying 27 key audit items. Under the PIPCA Measures, businesses pro - cessing personal data of over ten million indi - viduals must conduct a PIPCA at least every two years, either on their own of via external profes - sional institutions. Meanwhile, businesses must exchange professional institutions for PIPCA when required by regulators. PIPCA is both an essential component of busi - ness routine compliance efforts and a regulator tool to oversee significant-risk personal informa - tion processing activities. Businesses should
evaluate the likelihood and the impact of PIPCA and develop tailored compliance strategies, which should ideally integrate legal expertise with technological solutions. Increased focus on AI governance In recent years, China has been working to bal - ance the benefits and risks of the growth of AI technologies. To support this, the government has introduced national strategies to promote AI development, alongside laws, regulations and guidelines designed to regulate AI services offered to the public. Draft Artificial Intelligence Law of the PRC In 2024, China moved forward with AI laws and policies that are commensurate to the devel - opment of AI technologies. On 9 May 2024, the State Council’s Legislative Working Plan announced that the draft Artificial Intelligence Law will be reviewed by the Standing Commit - tee of the National People’s Congress. The first comprehensive law on AI in China is on the hori - zon. Registration of generative AI services Article 17 of the Interim Measures on Generative AI Services requires generative AI services with public opinion attributes or social mobilisation capability to conduct security assessments and register with the state CAC and its local coun - terparts, in order to prevent security risks. The registration obligation applies not only to service providers of generated AI but also to the compa - nies that integrate third-party generated AI ser - vices into their own services. According to the law, generated AI services that fail to complete the registration process before going online may be shut down. According to the CAC’s announcement on 8 January 2025, 302 generative AI services had
93
CHAMBERS.COM
Powered by FlippingBook