- Cybersecurity
- Dispute Resolution
- Foreign Direct Investment
- Retail Trade and Distribution
- Technology Media and Telecom
Landmark Court Ruling Adds Clarity to China's Personal Data Export Regime
September 20, 2024 | BY
Susan MokCasper Sek and Alan Zhang of Jingtian & Gongcheng analyze the first court judgment on cross-border data transfer, which answers practical questions relating to the operation of the Personal Information Protection Law in the context of a hotel booking app, and prompts companies to review their privacy policies
Summary
|
- A recent provincial-level court ruling provides important clarity on a number of key points on the operation of the Personal Information Protection Law
- The ruling is a good example of the extraterritoriality of certain provisions of the PIPL
- The case clarifies where pre-litigation requirements apply and when checking a box in an app can amount to giving legally valid consent, and when and to what extent a data handler could argue necessity as a basis for processing
- The Court also proposed a helpful analytical framework for personal information handlers relying on "contract necessity" as a legal basis for data processing
On September 2, 2024, the Guangzhou Internet Court ("the Court") released a series of typical cases involving cross-border data disputes, including a case on which it has rendered final judgment, the Case on Personal Information Export – the first China judgment on cross-border data transfer. In this case, the Court ruled that a multinational hotel group, as the personal information handler ('controller' in the EU GDPR sense), conducted personal information export activities in violation of the Personal Information Protection Law (个人信息保护法, "PIPL") and must compensate the Plaintiff for damages of RMB 20,000 as well as issuing a written apology. The ruling has also been published in the China Judgments Online database with the case number ((2022)Yue 0192 Min Chu No.6486).
The ruling clarifies several specific issues regarding the compliance requirements stipulated in the PIPL, including the application and boundaries of the legal basis and justification for information export , and the determination of compensation amounts. The decision provides a greater degree of legal certainty as well as carrying compliance implications for companies exporting personal information from China.
This premium content is reserved for
China Law & Practice Subscribers.
A Premium Subscription Provides:
- A database of over 3,000 essential documents including key PRC legislation translated into English
- A choice of newsletters to alert you to changes affecting your business including sector specific updates
- Premium access to the mobile optimized site for timely analysis that guides you through China's ever-changing business environment
Already a subscriber? Log In Now