m88 live casino Personal Information Protection Law (Draft for Second Review) was Released for Public Comments

Legislative Process and Significance

On October 21, 2020, after deliberation at m88 live casino 22^ndmeeting of m88 live casino Standing Committee of m88 live casino 13^thNational People's Congress (“NPC”), m88 live casino full text of m88 live casinoPersonal Information Protection Law of m88 live casino People's Republic of China (Draft)(“First Draft”) was officially published on m88 live casino NPC’s website for public comment. On April 29, 2021, m88 live casinoPersonal Information Protection Law of m88 live casino People's Republic of China (Draft for Second Review)(“Second Draft”) was released to m88 live casino public again for soliciting feedback until May 28, 2021 after deliberation at m88 live casino 28th meeting of m88 live casino Standing Committee of m88 live casino 13th NPC.

m88 live casino legislation of m88 live casinoPersonal Information Protection Lawhas entered m88 live casino final stages. This means that m88 live casino first unified law on personal information protection in China will soon be finalized and formally issued. m88 live casinore will soon be a more complete, comprehensive, and systematic legal protection scheme for personal information.

Key Amendments of m88 live casino Second Draft

m88 live casino framework and layout of m88 live casino Second Draft remains basically m88 live casino same as those of m88 live casino First Draft. m88 live casinore are eight chapters under m88 live casino Second Draft, and m88 live casino chapter names remain unchanged. It does, however, have three more articles than m88 live casino First Draft, amounting to 73 articles in total. m88 live casino Second Draft revises and improves several provisions of m88 live casino First Draft from m88 live casino aspect of language expression, and has also added provisions such as m88 live casino personal information protection of m88 live casino deceased and m88 live casino personal information protection obligations of very large-scale online platforms. m88 live casino major amendments to m88 live casino Second Draft as compared to m88 live casino First Draft are summarized as follows:

Basic Rules for Processing Personal Information

m88 live casino Second Draft adds one legal provision for m88 live casino processing of personal information on m88 live casino basis of m88 live casino First Draft, i.e. “Processing disclosed personal information within a reasonable scope in accordance with m88 live casino provisions of this law”, and specifies that in principle, an individual’s consent should be obtained for personal information processing, but m88 live casinore is no need to obtain consent under six different circumstances, om88 live casinor than “obtaining personal consent” under Article 13. (Article 13 of m88 live casino Second Draft)

Entrust Processing

In addition to retaining m88 live casino provisions of m88 live casino First Draft on m88 live casino entrusted processing of personal information, m88 live casino Second Draft is also linked to m88 live casinoCivil Code,with newly added provisions: If m88 live casino entrustment contract does not take effect, or is void, revoked, or terminated, m88 live casino personal information shall be returned to m88 live casino personal information processor or deleted, and shall not be retained by m88 live casino entrusted party. (Article 22 Paragraph 2 of m88 live casino Second Draft)

Rules for m88 live casino Cross-border Transfer of Personal Information

Regarding m88 live casino rules for m88 live casino cross-border provision of personal information, m88 live casino Second Draft for m88 live casino first time clarifies that personal information processors should enter into contracts with overseas recipients “in accordance with m88 live casino standard contract formulated by m88 live casino national cyberspace administration” (Article 38 of m88 live casino Second Draft), while no revisions have been made to m88 live casino rest of m88 live casino relevant provisions in this regard.

In terms of providing domestic personal information to overseas judicial or law enforcement agencies, m88 live casino Second Draft has more stringent and specific regulations in terms of m88 live casino scope of m88 live casino application and m88 live casino approval requirements than m88 live casino First Draft. Article 41 of m88 live casino Second Draft stipulates that if an overseas judicial or law enforcement agency requires m88 live casino provision of personal information stored in China, no information can be provided without m88 live casino approval of m88 live casino competent authorities of m88 live casino People’s Republic of China.

Adding Requirements on m88 live casino Protection of m88 live casino Personal Information of m88 live casino Deceased

Article 49 of m88 live casino Second Draft adds requirements for m88 live casino protection of m88 live casino personal information of m88 live casino deceased in terms of m88 live casino rights of personal information subjects, stipulating that if a natural person has died, m88 live casino individual’s rights in personal information processing activities shall be exercised by his/her close relatives. This provision is in line with m88 live casino requirements of Article 994 of m88 live casinoCivil Codeon m88 live casino protection of m88 live casino deceased’s personality rights and interests, and clearly grants relevant parties m88 live casino right to exercise m88 live casino deceased’s personal information rights from m88 live casino legal level.

Obligations of Personal Information Processors

m88 live casino Second Draft does not substantially revise m88 live casino obligations of a personal information processor under m88 live casino First Draft, but it adds a provision and clarifies that m88 live casino entrusted party in m88 live casino case of entrusted processing should perform m88 live casino relevant obligations of a personal information processor: “m88 live casino entrusted party who is entrusted to process personal information shall perform m88 live casino relevant obligations stipulated in this chapter and take necessary measures to ensure m88 live casino safety of m88 live casino personal information processed”. (Article 58).

Personal Information Protection Obligations of large-scale online Platforms

As a new provision, Article 57 of m88 live casino Second Draft specifies m88 live casino personal information protection obligations of “personal information processors who provide basic Internet platform services with a huge number of users and involves complex business types”, including: (a) establishing an independent organization mainly composed of external members to supervise personal information processing activities; (b) halting services to product or service providers on platforms that process personal information that are in serious violation of laws and administrative regulations; (c) regularly publishing social responsibility reports on personal information protection and accept social supervision.

m88 live casino above-mentioned provisions reflect m88 live casino recent trend of regulatory authorities to strengm88 live casinon m88 live casino supervision of large-scale Internet platforms and tightens m88 live casino regulation of security incidents such as data breaches. However, topics such as determining m88 live casino criteria for “basic Internet platform services” and om88 live casinor terms such as “external members”, as well as how to implement m88 live casino requirements for m88 live casino preparation method and content, release frequency and m88 live casino scope of “social responsibility reports on personal information protection”, are subject to follow-up implementation rules and/or explanations by regulatory authorities.

Refine m88 live casino Duties of m88 live casino National Cyberspace Administration

m88 live casino Second Draft furm88 live casinor refines and specifies m88 live casino duties of m88 live casino national cyberspace administration. It provides that it shall coordinate m88 live casino relevant departments to promote m88 live casino work of personal information protection in accordance with this law and m88 live casino new provisions are as follows: (a) formulate specific rules and standards for personal information protection; (b) formulate special personal information protection rules and standards for sensitive personal information and new technologies and applications such as face recognition and artificial intelligence; (c) support m88 live casino research and development of safe and convenient electronic identity aum88 live casinontication technology. (Article 61)

Legal Liability

In terms of civil liability, m88 live casino Second Draft adjusts m88 live casino provisions of m88 live casino First Draft and links with m88 live casino relevant provisions of m88 live casinoCivil Code, clarifying that m88 live casino principle of “presumption of fault” should be applied to m88 live casino infringement of personal information rights. Specifically, m88 live casino Second Draft stipulates that if personal information rights and interests are infringed due to personal information processing activities, and m88 live casino personal information processor cannot prove that it is not at fault, it shall be liable for damages and om88 live casinor torts. m88 live casino liability for damages is determined in accordance with m88 live casino individual’s consequent loss or m88 live casino personal information processor’s benefit; if it is difficult to determine m88 live casino individual’s consequent loss and m88 live casino personal information processor’s benefit, m88 live casino amount of compensation should be determined based on m88 live casino specific situation. (Article 68)

Processing of Personal Information by State Agencies

m88 live casino Second Draft adds a new stipulation that m88 live casino provisions on m88 live casino processing of personal information by state agencies shall apply to m88 live casino personal information processing by organizations authorized by m88 live casino laws and regulations with m88 live casino function of managing public affairs, and with m88 live casino purpose of performing statutory duties. (Article 33 to 37 of m88 live casino Second Draft)

Our observation

m88 live casino Personal Information Protection Law, as m88 live casino first special law on m88 live casino protection of personal information in China, will become an important legal basis for m88 live casino establishment of m88 live casino personal information protection legal regime of China.

From a content perspective, m88 live casino Second Draft, on m88 live casino basis of retaining m88 live casino basic framework and most of m88 live casino provisions of m88 live casino First Draft, and in response to current outstanding problems in m88 live casino field of personal information protection and m88 live casino trends in supervision and law enforcement, revises m88 live casino First Draft, improves m88 live casino rules of legal basis for personal information processing and cross-border transfer of personal information, and adds new requirements for personal information protection of m88 live casino deceased and personal information protection obligations of large-scale Internet platforms.

Basically, m88 live casino Second Draft maintains a certain degree of consistency with m88 live casino current laws, regulations or drafts that provide for personal information protection and is furm88 live casinor linked to m88 live casinoCivil Code, but also provides many new requirements and regulations at m88 live casino same time. How m88 live casino specific provisions of m88 live casino draft of Personal Information Protection Law will be connected with m88 live casino existing laws and regulations and how m88 live casino scope of application will be divided remains to be clarified. In addition, m88 live casinore are a number of issues that have yet to be clarified in m88 live casino First Draft, such as m88 live casino definition of "separate consent", m88 live casino security assessment of m88 live casino cross-border transfer of personal information, and how m88 live casino protection certification is to be carried out, which are still not clarified and improved in this Second Draft. m88 live casino clarification of m88 live casinose contents may require subsequent legislative improvement or m88 live casino furm88 live casinor introduction of related implementation rules and interpretations.

We recommend that companies fully understand m88 live casino relevant content of m88 live casino Second Draft and prepare to summarize and rectify incompliance in m88 live casino current corporate compliance work before m88 live casino promulgation of m88 live casino Personal Information Protection Law as soon as possible. We will also continue to pay close attention to m88 live casino follow-up legislative process of m88 live casino Personal Information Protection Law and share m88 live casino latest updates with our clients.