2021年8月20日，经第十三届全国人大常委会第三十次会议审议，《中华人民共和国个人信息保护法》（以下简称“《个人信息保护法》”）获得通过并公布，并将于2021年11月1日起生效实施。《个人信息保护法》的实施将对我国公民的个人信息权益及各组织的数据合规带来深远的影响，其作为我国第一部关于个人信息保护的专门立法，不仅引起了国内学术界和实务届的广泛讨论，在国际上也备受关注。本文拟针对个人信息保护法的域外适用提供相应的关注要点和合规建议。

Personal Information Protection Law of the People's Republic of China ("China’s Personal Information Protection Law" or “the Law”) was passed and promulgated through deliberation during the 30th meeting of The Standing Committee of the 13th National People's Congress on August 20, 2021, and will come into effect on November 1, 2021. The implementation of China’s Personal Information Protection Law will have a profound impact on the personal information rights of citizens and data compliance of organizations in China. As the first special legislation on personal information protection in China, the Law not only aroused extensive discussions in domestic academic and practical circles, but also attracted much attention in the international arena. In this paper, we would like to provide relative key points and suggestions on law compliance aiming at the extraterritorial application of China’s Personal Information Protection Law.

一、个人信息保护法在国际背景下的意义
I. The significance of China’s Personal Information Protection Law in aninternational context

III. Our General Advice for Data Compliance

IV. Conclusion

 

《个人信息保护法》的实施，将深刻影响到掌握并处理个人信息的各个行业，尤其针对涉及个人信息跨境业务的境内外企业，其不仅要遵循一般的个人信息处理规则，还要遵循相应的跨境提供和境内外主体全面合规要求。企业应按照《个人信息保护法》及相关规定的要求，尽快完善、优化或建立自身的个人信息处理合规和保护安全体系，以降低个人信息处理所带来的法律风险。

The implementation of China’s Personal Information Protection Law will profoundly affect various industries that hold and process personal information, especially for domestic and foreign enterprises involved in cross-border business of personal information, which shall not only follow the general personal information processing rules, but also follow the corresponding cross-border provision and comprehensive compliance requirements for domestic and foreign subjects. Enterprises should improve, optimize or establish their own personal information processing compliance and protection security system as soon as possible in accordance with the requirements of China’s Personal Information Protection Law and related regulations in order to reduce legal risks in personal information processing.

 

[1] 例如，中国的《个人信息保护法》区分了同意、单独同意、书面同意的情形：在向他人提供个人信息，公开其所处理的个人信息，所收集的个人图像、身份识别信息用于维护公共安全以外的目的，处理敏感个人信息，向境外提供个人信息的都需要获得个人的单独同意；而法律、行政法规规定应当取得书面同意的情况下应当取得书面同意。而欧盟的《通用数据保护条例》(GDPR)和美国的《加州消费者隐私法案》(CCPA)等并未对同意类型作出如此细致的规定。

[1] For example, China's Personal Information Protection Law distinguishes between consent, separate consent, and written consent: separate consent is required when providing personal information to others, disclosing the personal information that one processes, using the collected personal images and identifying information for purposes other than maintaining public safety, processing sensitive personal information, and providing personal information to overseas parties; Where laws and administrative regulations provide that the processing of personal information shall be subject to the written consent, such provisions shall prevail. However, the GDPR and the U.S. California Consumer Privacy Act, for example, do not provide such detailed regulations on the type of consent.

 

[2] 《个人信息保护法》第四十二条规定：境外的组织、个人从事侵害中华人民共和国公民的个人信息权益，或者危害中华人民共和国国家安全、公共利益的个人信息处理活动的，国家网信部门可以将其列入限制或者禁止个人信息提供清单，予以公告，并采取限制或者禁止向其提供个人信息等措施。

[2] Article 42  Where an overseas organization or individual engages in the personal information processing activities infringing upon the personal information rights and interests of citizens of the People's Republic of China or endangering the national security and public interests of the People's Republic of China, the Cyberspace Administration of China( “CAC”) may include such organization or individual in the list of subjects to whom provision of personal information is restricted or prohibited, announce the same, and take measures such as restricting or prohibiting provision of personal information to such organization or individual.

 

[3] 有关数据出境应采取的方式，其具体实施标准有待相关部门进一步细化，《个人信息保护法》第六十二条亦规定，应由国家网信部门协调相关部门制定个人信息保护具体规则、标准。

[3] The specific standards of imlpementation need further guidance from the relevant authorities. Article 62 also provides that the CAC shall coordinate relevant authorities to formulate specific rules and standards for personal information protection in accordance with the Law.

 

[4] 安全评估的内容和标准有待后续具体规则加以明确，但参照以往国家互联网信息办公室发布的《个人信息出境安全评估办法（征求意见稿）》，以及全国信息安全标准化技术委员会发布的《信息安全技术数据出境安全评估指南（草案）》等，个人信息出境安全评估的内容大致可包括个人信息的情况、个人信息出境的必要性、个人信息接收方的安全保护措施、个人信息接收方所在国或地区的网络安全环境、个人信息出境的风险等，且针对不同的个人信息出境主体（如，是否为关键信息基础设施的运营者、是否为处理个人信息达到国家网信部门规定数量的个人信息处理者），个人信息出境安全评估的具体要求也可能有所不同。

[4] The objects and standards of the security assessment need further guidance by subsequent specific rules. However, with reference to the "Measures for Personal Information Cross-Border Transfer Security Assessment(Draft for Public Comments)" issued by the National Internet Information Office, as well as the "Information Security Technology- Guidelines for Data Cross-Border Transfer Security Assessment (Draft)" issued by the National Information Security Standardization Technical Committee and other rules have been issued, the objects of the personal information cross-border transfer security assessment may generally include the character of personal information, the necessity of personal information cross-border transfer, the security measures taken by recipient of the personal information, the cyber security environment of the country or region where the recipient of the personal information is located, the risk of the personal information cross-border transfer, etc. Moreover, the criteria for assessing the security of the personal information cross-border transfer may differ for different personal information providers. For example, the sepecific requirements of the assessment may differ depending on whether the provider is a critical information infrastructure operator or whether the quantity of processing personal information of the provider reaches that as prescribed by CAC.

 

[5] 《信息安全技术 个人信息安全规范》第5.2条等规定

[5] Article 5.2 of Information Security Technology—Personal Information Security Specification and etc.

 

[6] 根据《个人信息保护法》第十三条，个人信息处理的合法性基础包括：

　（一）取得个人的同意；

　（二）为订立、履行个人作为一方当事人的合同所必需，或者按照依法制定的劳动规章制度和依法签订的集体合同实施人力资源管理所必需；

　（三）为履行法定职责或者法定义务所必需；

　（四）为应对突发公共卫生事件，或者紧急情况下为保护自然人的生命健康和财产安全所必需；

　（五）为公共利益实施新闻报道、舆论监督等行为，在合理的范围内处理个人信息；

　（六）依照本法规定在合理的范围内处理个人自行公开或者其他已经合法公开的个人信息；

　（七）法律、行政法规规定的其他情形。

[6] According to Article 13 of the Law, the legal basis of personal information processing includes:

 

1) Obtaining the consent of the individual concerned;

2) Where it is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or for the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law;

3) Where it is necessary for the performance of statutory duties or statutory obligations;

4) Where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person;

5) Where such acts as news reporting and supervision by public opinions are carried out for the public interest, and the processing of personal information is within a reasonable scope;

6) Where it is necessary to process the personal information disclosed by the individual concerned or other personal information that has been legally disclosed within a reasonable scope in accordance with the provisions of this Law; and

7) Other circumstances prescribed by laws and administrative regulations.