China’s State Administration of Industry and Commerce (“SAIC”) has released for public comment a draft regulation implementing recent amendments to a consumer protection law that would, among other things, supplement existing privacy obligations for businesses operating in China.

The “Regulations on the Implementation of the Law on the Protection of the Rights and Interests of Consumers” (“Draft Implementing Regulations”) implement certain provisions of the Law on the Protection of the Rights and Interests of Consumers (“Consumer Rights Protection Law” or “CRPL”; unofficial English translation by Chinalawtranslate.com available here), which underwent significant revisions in October 2013. The Draft Implementing Regulations reiterate and supplement data privacy and security obligations imposed in the CRPL and in the Measures on Penalties for Infringing Upon the Rights and Interests of Consumers (“CRPL Penalty Measures”; unofficial English translation  available here), which was promulgated in January 2015 and discussed in our previous article here.

A definition of “consumer personal information” first appeared in the CRPL Penalty Measures as “a consumer’s name, gender, occupation, date of birth, identification document number, residential address, contact information, status of income and assets, health status, consumption habits, and other information collected by business operators during their provision of goods or services that may, independently or in combination with other information, identify the consumers.” This definition is reproduced in the Draft Implementing Regulations with the addition of “identifying biological characteristics.”

The Draft Implementing Regulations largely reiterate a number of data privacy and security requirements that apply to companies operating in China (referred to as “business operators”) found in the CRPL and the CRPL Penalty Measures:

• Business operators must inform and obtain consent from consumers regarding the purpose, method, and scope of collection or use of consumer personal information. Such information may be collected or used only if necessary.

• Business operators may not divulge consumer personal information without consent.

• Business operators must implement measures to ensure the security of consumer personal information and immediately take remedial action if information is leaked or lost.

The Draft Implementing Regulations further supplement the CRPL and CRPL Penalty Measures by adding certain new or modified requirements:

• Collection of consumer personal information by a business operator would need to be related to its business operations.

• Business operators would need to retain for at least five years proof that they fulfilled their obligations to inform and obtain consent from consumers regarding the purpose, method, and scope of collection and/or use.

• Business operators would be prohibited from “tampering with or destroying” consumer personal information.

• The Draft Implementing Regulations add an exception to the prohibition on divulging consumer personal information (without consent) for information that has been irreversibly de-identified, although no specific processes are specified for de-identification.

• In addition to the requirement that they take immediate remedial action, business operators would also be required to notify consumers in a timely manner of a data leak or loss. The regulation does not specify what kinds of actions or notifications would satisfy this requirement.

• The prohibition on business operators sending commercial information to consumers without their consent or request is expanded and made slightly more specific. The Draft Implementing Regulations prohibit the sending of electronic commercial information and the making of telemarketing calls without consent.

• The draft further adds language stating that consumers should not bear the costs of consented-to commercial communications unless otherwise agreed.

The draft regulations, once finalized, would build on the CRPL, the CRPL Penalty Measures, and laws and regulations applicable to personal data collected and processed over information networks. Many of the rules described in this post are not unique in the context of Chinese data privacy law, and reflect emerging trends that may become increasingly familiar to companies with business operations in the country.

Public comments on the Draft Implementing Regulations can be submitted by September 5.

Yan Luo and Tina Zhang assisted with the research and preparation of this article.