Privacy & Cybersecurity Law Blog

On August 30, 2013, following the effort by the People’s Republic of China to establish a Consumer Rights Protection Bureau in 2012, the China Banking Regulatory Commission (the “CBRC”) issued a document entitled “Guidance for the Banking Sector on the Protection of the Rights of Consumers” (the “Guidance”). Among other things, the Guidance re-emphasizes the principle of protecting personal financial information. Banking institutions are required (1) to take effective measures to protect consumers’ personal financial information; (2) not to modify or illegally use consumers’ personal financial information; and (3) to prevent the disclosure of consumers’ personal financial information to any third party without the relevant consumers’ authorization or consent.

In practical effect, the Guidance does not establish any new requirements to protect personal information since personal financial information is already protected by certain rules in China. The Guidance is, however, binding on financial institutions. Its reiteration of the principle of protecting personal financial information is another indication that personal information protection has won the attention of policymakers in China. In sum, the CBRC has not neglected data protection as it continues to evaluate and regulate increasingly creative and diverse financial products and financial innovations.

Read our previous coverage on China’s efforts to strengthen the protection of personal information.