Effective March 15, 2015, China’s State Administration for Industry and Commerce (SAIC) will implement the new Measures for Penalties for Infringing upon the Rights and Interests of Consumers (Measures).  The Measures clarify obligations with respect to corporate handling of personal data, define for the first time what constitutes personal consumer information and demonstrate China’s continued intensified focus on personal data protection.  Adoption of the Measures will repeal the Measures for Penalties Against Conduct Defrauding Consumers first promulgated by the SAIC in 1996.

Formulated “to prevent infringement upon consumer rights and interests in accordance with law, protect the lawful rights and interests of consumers, and maintain the socialist economic order,” the Measures provide new guidelines relating to business operators’ handling of personal data.  Generally, Article 11 of the Measures compels business operators that collect or use personal information of consumers to “follow the principles of legality, appropriateness, and necessity” and requires that they “clearly state the purpose, manner, and scope for collecting and using the information.”  Specifically, business owners are explicitly prohibited from collecting and using consumers’ personal information without consent; leaking, selling or illegally providing to others collected personal information of consumers; and sending commercial information to a consumer without consent or request from the consumer, or after objection from the consumer.

Further, Article 11 defines “personal information of consumers” as

a consumer’s name, gender, occupation, date of birth, identification document number, residential address, contact information, status of income and assets, health status, consumption habits, and other information collected by business operators during their provision of goods and services that may independently or in combination with other information identify the consumers.

The Measures are formulated in accordance with the existing Law of the People’s Republic of China on the Protection of the Rights and Interests of Consumers (Consumer Rights Law), issued by the SAIC in 2014, which regulates the protection of consumers’ rights and interests in relation to the purchase and use of commodities and receipt of services for daily consumption.  Unlike the Measures, however, the Consumer Rights Law does not define what constitutes personal consumer information.

Violations

Business owners that violate Article 11 of the Measures are subject to the penalties outlined in Article 56 of the Consumer Rights Law, which include civil liabilities, administrative corrections or warnings, confiscation of unlawful gains, monetary fines (between one and 10 times the illegal income or up to RMB 500,000), suspension of business and revocation of business licenses.  The violations and resulting penalties also will be recorded into the credit files and disclosed to the public.

Effect

The Measures represent the first time that China has specifically defined what data constitutes personal consumer information.  As a result, business entities will have greater certainty about what particular information will be subject to regulatory oversight by Chinese authorities.  It is important for China-based and multinational companies to work with China counsel on these efforts, because they are best positioned to understand the immediate and long-term implications of the new Measures.  Moreover, China counsel can guide companies in anticipating, designing and implementing the internal data protection policies and procedures necessary to comply with the Measures.