Building a new data protection framework

The standing committee of China's top legislator, the National People's Congress (NPC), approved the Decision on Strengthening the Protection of Online Information (关于加强网络信息保护的决定) on December 28 2012. The Decision became effective on the same day and contains only eleven articles. From the outset, it does not appear like a typical law, but it does have the same character because the NPC is the highest state body and legislative house. The Decision stresses the protection of private information online, with the media reporting it as a step forward in data protection. But what impact will this new legislation have on international companies with operations in or connected with China?

Resuming the process

According to statistics from the China Internet Network Information Center (CNNIC), there were about 546 million people using the internet as of January 2013. This accounts for approximately 42.1% of China's population. Such a large customer base contributes to the country's booming internet sector, but legislation has lagged behind industrial development, in particular privacy and data protection. Although provisions exist under the PRC General Principles of the Civil Law (中华人民共和国民法通则) concerning privacy protection and the PRC Criminal Law (中华人民共和国刑法) over offences by staff in special agencies (like government, banks and telecom operators) for illegal disclosures of private information, no systematic legal framework for data protection has been established. There have been various administrative rules from different governmental agencies imposing commitments on data controllers and processors to ensure security, but these rules focus more on protecting state or public interests and less on the protection of private rights attached to information.