Protection file

China’s personal information protection regime has ended

A a flurry of laws has completed the initial phase of privacy protection, covering all aspects of this developing field. First, there was the Civil Code, which came into force on January 1, 2021, and which provides the basis for the personal information protection regime.

On the same day, the causes of action provisions in civil cases of the Supreme People’s Court added the cause of action for disputes relating to the protection of personal information.

Then, on November 1, 2021, the Personal Information Protection Act (PIPL) came into effect, providing comprehensive coverage of the rules for handling personal information, the rights of individuals, and the legal obligations and responsibilities of processors. information, as well as the establishment of a relatively strict global legislative framework. framework.

Li Chunyi
Zhongzi Law Firm

At this point, China’s personal information protection legal system, consisting of criminal law, civil code, cybersecurity law, PIPL, and other legal standards, is complete.

On this basis, the forgery of personal information will be punishable by criminal or administrative sanctions depending on the type of behavior and the seriousness of the case. Prosecutors and consumer organizations can initiate civil public interest lawsuits against acts that infringe the rights and interests of many people. Individuals can also bring a civil action for the protection of personal information.

China’s digital economy has grown at an unprecedented speed and scale. Benefiting from the country’s huge population and large-scale market, new industries, new businesses and new models based on big data are continually emerging, bringing a multitude of platforms dealing with large amounts of personal information.

Some of these platform companies form business advantages through “data + algorithm + platform rules”, which infringe the rights and interests of consumers and hamper fair competition.

After the implementation of PIPL, personal information processors, especially platform companies, face not only the remediation and standardization of regulatory bodies, but also the challenge of civil litigation over protection of personal information.

Although civil disputes regarding the protection of personal information took place from time to time, long before the enactment of the Civil Code, disputes were primarily judged on the basis of reputation and privacy rights. However, just before the enactment of the Civil Code, courts began to treat personal information differently from privacy rights and to protect personal information as an independent legal interest in court cases.

Now, many disputes relating to the protection of personal information appear with the following characteristics.

Diversification of the parties concerned and litigation purposes. Some complainants are lawyers, law students and other legal professionals. They make allegations of violation of the personal information processing behavior of certain Internet service platforms, such as the personal information protection cases brought against WeRead by Tencent and Tik Tok. Some plaintiffs have taken legal action against telecommunications companies, airlines and financial institutions because their personal information is inappropriately collected, disclosed unlawfully, or treated improperly. Among them, disputes relating to the credit files of financial institutions represent a relatively large proportion. It should be noted that this year, there were complaints made by professional service providers.

The balance between personal and public interests in determining the offense. Based on past cases, courts take into account not only personal authorization and the principles of “legality, legitimacy and necessity”, but also public interests such as “social and economic development” and “free movement”. of information ”when determining the legality of the processing of personal information. , especially when identifying new business models involving Big Data. The PIPL limits the processing of personal information on the basis of the public interest. It is foreseeable that in future disputes over the protection of personal information, the courts will adopt more stringent standards to examine the legality of the commercial use of personal information.

Recourse applying the protection of personality rights. Personal information falls under the rights and interests of the personality. Therefore, personal information violation engages civil liability for violation of personality rights, namely to stop violation, compensate loss, apologize, remove influence, restore reputation, etc.

The consequence of the damage is also taken into account in determining the terms and amount of compensation for civil liability. At present, the courts generally do not support high monetary compensation, but generally support stopping the violation, apologizing and paying reasonable expenses for the protection of rights. Although the infringement is identified in some cases, the claim of the plaintiff is rejected because the consequence of the damage does not reach a certain degree.

Although the amount of compensation for personal information protection cases is not high, it can have a significant impact on the rules of handling of the original information and even on the business model of the platform. Some cases have generated widespread concern in society, and the court ruling not only requires the platforms concerned to improve relevant rules or practices, but also promotes the improvement of subsequent support standards for the protection of personal information.

The principle of the presumption of fault applies. Prior to the enactment of the PIPL, the court determined in some cases, based on the ability and possibility of collecting evidence, that the party processing the information had to produce evidence for not disclosing personal information. Otherwise, its tort liability should be incurred. The PIPL formally establishes the principle of presumption of fault for violation of personal information, that is to say if the processing of personal information infringes the rights and interests of personal information and causes damage, and that the party processing the information personal cannot prove that it is not at fault, it will engage its tort liability such as compensation for damages.

With the completion of China’s legal system for the protection of personal information, there has been a proliferation in the number and variety of lawsuits. Stricter and more comprehensive legal standards have given greater protection to personal information and, at the same time, compliance requirements have been strengthened for internet platforms, telecommunications companies, financial institutions and other entities that process a large amount of personal information.

Li Chunyi is a partner at Zhongzi law firm. He can be contacted on +86 10 6625 6419 or by email at