Disclaimer: The following piece is an editorial, and should not be taken as legal advice.
On November 1, 2021, China’s Personal Information Protection Law (PIPL) went into effect, expanding GDPR-like protections on the collection and use of personal data of users in China. We review some of the law’s provisions and unique features from GDPR, as well as important context for university compliance teams. We believe that the new law is worth following, as some key implementation details have not yet been published, but higher education institutions that comply with GDPR and FERPA don’t have much cause for regulatory concern with PIPL.
Provisions
PIPL mimics the EU’s GDPR in many of its stipulations, including that companies employ a data protection officer, and that consumers have more control over how companies manage their data. Companies will now need to obtain individual consent to collect sensitive information such as location and financial accounts, and users will be empowered to switch off targeted advertising. And extra scrutiny applies to data processors that handle highly sensitive data like biometric information.
Other aspects, however, are more novel, including the requirement that large scale data processors store China-originated personal data within China and pass a security review. Organizations must undergo a security review if they process the data of more than 1,000,000 people in China, or 100,000 if the data is “important” or “personal.” The requirement for the localization of data hasn’t been published or announced yet, but the thresholds of 1,000,000 users or 100,000 users with personal data seem commonplace in other Chinese regulations such as the PIS Specification.
A Beijing man checks his smartphone while riding the subway (Xinhua)
Analysis for Universities and Education Institutions
The good news about PIPL is that…Continue Reading
This article is brought to you by AIRC Strategic Partner, Sunrise International.
Click here for more articles by Sunrise International.