Privacy & Information Security Law Blog

In the past two months, Chinese national authorities amended a law, and provincial authorities in Jiangsu Province issued a new regulation, both of which include provisions concerning the protection of personal information.

Law of the People’s Republic of China on Resident Identity Cards

Any Chinese citizen who resides in China is required to obtain a resident identity card when he or she turns 16 years old. The cards carry information which generally would be considered personal information under Chinese law, such as name, gender, date of birth, home address and identity card number. The Law of the People’s Republic of China on Resident Identity Cards, a national law originally enacted in 2003, was amended on October 29, 2011, to include the following new provisions on the protection of personal information:

• Relevant organizations, such as government agencies, financial institutions, telecommunications service providers, communications providers, educational institutions and medical institutions, and their employees, shall keep confidential the personal information that they obtain from identity cards in the course of performing their duties or providing their services.
• The following penalties may be imposed for violations:
  • Criminal sanctions (if applicable);
  • Administrative penalties, which could include 10 - 15 days imprisonment, seizure of any illegal proceeds, and a fine of between RMB 100,000 and 500,000 if the violator is an organization, or of RMB 5,000 if the violator is an individual; and
  • Civil liabilities, if the violation resulted in damages.

Although the new provisions do address the protection of personal information, they apply only to information recorded on resident identity cards. Draft Guidelines published earlier this year indicate that a more generally applicable national law of this nature may be forthcoming.

Regulation of Information Technology of Jiangsu Province

On September 23, 2011, the Standing Committee of the Jiangsu Provincial People’s Congress issued the Regulation of Information Technology of Jiangsu Province (the “Regulation”), which will take effect as of January 1, 2012. The Regulation includes comprehensive provisions on the collection and use of personal information and relevant legal liabilities for violations. Although China already has numerous laws and rules containing provisions on the protection of personal information, most are limited or applicable only to a specific industry (such as banking or electronic commerce). Jiangsu Province is the first province to implement a local rule on the protection of personal information that is not limited to a particular industry sector, but applies to a broader extent, as information technology may cover a wide range of businesses.

Collection of Personal Information

The Regulation imposes different restrictions on how government agencies and other organizations or individuals may collect personal information.

• When collecting, maintaining and updating information resources in accordance with their official duties, government agencies must abide by the principles of “one-time data collection” and “the collector is responsible for maintaining and updating the data.” The Regulation prohibits repetitive collection of the same information by different government agencies; information resources collected by one government agency will be shared with other agencies rather than collected multiple times.
• Non-governmental organizations and individuals may only collect personal information with the consent of the relevant data subject, and they must explain how the information being collected will be used.
• No organization or individual may use illegal means (such as theft, black-market purchase or other fraud) to obtain personal information.

Use of Personal Information Collected

• Personal information may only be used within the scope of use described to the data subject at the time of the collection.
• Illegally disclosing, selling or otherwise providing personal information to third parties is prohibited.

Penalties

Organizations or individuals who (1) illegally disclose, sell or otherwise provide personal information they collect, or (2) collect personal information by illegal means (such as theft, black-market purchase or other fraud) may be subject to the following penalties:

• Administrative penalties, which could include an order to delete such information , seizure of any illegal proceeds, a fine of between RMB 100,000 and 500,000 if the violator is an organization, or between RMB 10,000 to RMB 50,000 if the violator is an individual, and other administrative penalties that may apply; and
• Criminal sanctions (if applicable).

The Regulation does not provide for civil liabilities as, according to the drafters, other Chinese laws (such as the Tort Liability Law) already include suitable remedies.

Given the absence of any uniform personal data protection law in China, Jiangsu Province’s Regulation may be seen as a milestone on China’s road toward the development of a national personal information protection law.