Article by Shen Lu: “China’s National Congress passed the highly anticipated Personal Information Protection Law on Friday, a significant piece of legislation that will provide Chinese citizens significant privacy protections while also bolstering Beijing’s ambitions to set international norms in data protection.
China’s PIPL is not only key to Beijing’s vision for a next-generation digital economy; it is also likely to influence other countries currently adopting their own data protection laws.
The new law clearly draws inspiration from the European Union’s General Data Protection Regulation, and like its precursor is an effort to respond to genuine grassroots demand for greater right to consumer privacy. But what distinguishes China’s PIPL from the GDPR and other laws on the books is China’s emphasis on national security, which is a broadly defined trump card that triggers data localization requirements and cross-border data flow restrictions….
The PIPL reinforces Beijing’s ambition to defend its digital sovereignty. If foreign entities “engage in personal information handling activities that violate the personal information rights and interests of citizens of the People’s Republic of China, or harm the national security or public interest of the People’s Republic of China,” China’s enforcement agencies may blacklist them, “limiting or prohibiting the provision of personal information to them.” And China may reciprocate against countries or regions that adopt “discriminatory prohibitions, limitations or other similar measures against the People’s Republic of China in the area of personal information protection.”…
Many Asian governments are in the process of writing or rewriting data protection laws. Vietnam, India, Pakistan and Sri Lanka have all inserted localization provisions in their respective data protection laws. “[The PIPL framework] can provide encouragement to countries that would be tempted to use the data protection law that includes data transfer provisions to add this national security component,” Girot said.
This new breed of data protection law could lead to a fragmented global privacy landscape. Localization requirements can be a headache for transnational tech companies, particularly cloud service providers. And the CAC, one of the data regulators in charge of implementing and enforcing the PIPL, is also tasked with implementing a national security policy, which could present a challenge to international cooperation….(More)“