{"id":20152,"date":"2021-12-01T20:58:03","date_gmt":"2021-12-01T20:58:03","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=20152"},"modified":"2021-12-02T16:09:36","modified_gmt":"2021-12-02T16:09:36","slug":"china-data-privacy-law-pipl","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/compliance\/china-data-privacy-law-pipl\/","title":{"rendered":"China’s Data Privacy Law Poses Challenge for International Companies"},"content":{"rendered":"

Businesses that have spent the past three-plus years adapting to the European Union\u2019s far-reaching data privacy law<\/a> now have to decide how they will respond to a similar law in China that has been criticized as being more vague in its wording and harsher in its penalties.<\/p>\n

China\u2019s Personal Information and Privacy Law (PIPL), enacted early last month, is designed to give more than 1.4 billion people greater control over the data collected by private companies and what those companies can do with the data while preserving the Chinese government\u2019s broad access to their citizens\u2019 personal information.<\/p>\n

The regulation will have a broad ripple effect in the international IT and business world, given that it covers the world\u2019s second-largest economy and a country that has been asserting greater influence on such home-grown tech giants as Alibaba and Tencent and has made it more challenging for outside tech companies to do business within its borders.<\/p>\n

Spread of Data Privacy Laws<\/strong><\/h2>\n

Despite the concern, the new law is a significant step forward in the international push to protect citizens\u2019 data privacy rights at a time when companies are able to collect vast amounts of personal information and use it in myriad ways.<\/p>\n

The new law is \u201cnot all good or all bad,\u201d Jake Williams, co-founder and CTO at cybersecurity firm BreachQuest, told eSecurity Planet<\/em>, adding that it\u2019s \u201cprobably somewhere in between.”<\/p>\n

“Chinese citizens need privacy protection just like anyone else,” Williams said. “That said, the law gives the CCP additional control over and access to private sector data under the guise of protecting privacy. Given the long history of state-sanctioned IP theft and abuses, organizations are right to be concerned.\u201d<\/p>\n

PIPL is designed to enable people to get the personal data that has been collected by companies and correct or delete it and control how it\u2019s used. In addition, they have to consent before their data is collected and that consent can be withdrawn. Companies that collect and process data need to take measures necessary to ensure the data collected is protected and to create compliance<\/a> systems and internal audits.<\/p>\n

Also read: Top GRC Tools & Software<\/a><\/p>\n

Responsibilities and Penalties<\/strong><\/h2>\n

Companies that send data outside of China\u2019s borders also are required to create a specialized data processing site in China or name a person who is responsible for data protection. Companies that violate the law face penalties that include the possibility of being banned from doing business in China. In addition, companies that violate the law could face fines of up to 5 percent of their annual revenue and personal penalties against executives of those companies.<\/p>\n

\u201cFor organizations handling personal information collected in China, this law will require an additional layer of data governance,\u201d Nader Henein, privacy research vice president at Gartner, wrote in Fortune<\/a>. \u201cOperationally, this new layer is intended to deliver consumer privacy rights and crucially realign corporate strategies regarding where to store, where to process, and with whom they can share customer data.\u201d<\/p>\n

PIPL vs. GDPR<\/strong><\/h2>\n

Multinational companies since 2018 have had to wrestle with a broad array of data privacy challenges in the wake of the EU\u2019s General Data Protection Regulation (GDPR)<\/a> in such areas as where the data is stored, how it\u2019s transferred and how it\u2019s used.<\/p>\n

\u201cThe good news is that the PIPL is similar to the GDPR in many ways,\u201d Henein wrote. \u201cIt\u2019s not as comprehensive, and it will likely be heavily supported with ongoing guidance from the regulatory bodies. But for organizations that have taken the last few years to put in place a modern privacy program, satisfying these new consumer privacy rights should not represent a challenge.\u201d<\/p>\n

However, there are differences between the two that organizations will have to adapt to, he wrote, noting that \u201cprocessing data as part of a contractual or legal obligation is covered, but critically, the concept of \u2018legitimate interest\u2019 continues to be absent, which means that\u00a0many use cases that involve the processing of personal information will have to rely on informed consent.\u201d<\/p>\n

Executives Can Be Penalized<\/strong><\/h2>\n

Organizations are going to have to take the new law into account, given how many companies in the United States and other countries do business in China, Hank Schless, senior manager of security solutions at security firm Lookout, told eSecurity Planet<\/em>.<\/p>\n

\u201cThere was a similar concern around vague language when GDPR first came out, but the penalties weren\u2019t quite as harsh,\u201d Schless said. \u201cWhile the financial penalties are similar between China\u2019s laws and GDPR, China tacked on significant additional penalties, including revoking the ability to do business in China and personal penalties on a non-compliant firm\u2019s executives.\u00a0If business in China accounts for more than 5 percent of a non-compliant firm\u2019s revenue, then the revocation of being able to do business in China could be the most significant blow to an organization.\u201d<\/p>\n

BreachQuest\u2019s Williams agreed that the language in the PIPL is vague and noted that the timeframe between publication and enforcement also was short. PIPL was announced in September and enacted two months later. With the GDPR, regulators used the longer time between publication and enforcement to answer key implementation questions.<\/p>\n

\u201cThe accelerated time scale has removed that opportunity here,\u201d Willias said. \u201cGiven the potential for extremely harsh fines, I think some organizations will choose to opt out of business in China for some time. Data locality will likely have the largest impact to most businesses. Organizations can\u2019t transfer the data of Chinese people outside of China without prior approval. Many organizations weren\u2019t ready to build dedicated infrastructure for processing in China, so this will be a challenge.\u201d<\/p>\n

Will Businesses Leave China?<\/strong><\/h2>\n

John Bambenek, principal threat hunter for security company Netenrich, doubted that many companies will leave China.<\/p>\n

\u201cDoing business in China has always come with strings attached.\u201d Bambenek told eSecurity Planet<\/em>. \u201cI\u2019m much more concerned with businesses having to be complicit or at least turning a blind eye to flagrant human rights violations than I am with some additional overhead of compliance. Companies will whine, but they want the Chinese money, so they\u2019ll fall in line like they always do and China knows it. Ask anyone still doing business in Hong Kong.\u201d<\/p>\n

Will the U.S. Follow?<\/strong><\/h2>\n

The institution by China of PIPL coupled with GDPR also puts a spotlight on the United States, which has not yet instituted a similar country-wide data protection regulation. However, California in 2018 enacted the California Consumer Privacy Act (CCPA)<\/a>, which is similar to GDPR and allows California consumers to demand to see personal data that a company has collected on them as well as third-party organizations with whom the data has been shared. California consumers also can sue companies if the privacy law is violated, regardless if there has been a breach.<\/p>\n

Earlier this year, both Colorado and Virginia enacted their own consumer data privacy laws.<\/p>\n

Bambenek and Williams both said the United States eventually will have a federal law, but that the country is taking a different route from Europe and China.<\/p>\n

\u201cThe legal and political culture in the United States is different than Europe and especially China,\u201d Bambenek said. \u201cThe U.S. does have some data privacy laws, but the trend is towards limiting promiscuous data collection and usage. We do have restrictions on biometric data and California has a privacy law. Eventually we\u2019ll adopt something more comprehensive.\u201d<\/p>\n

Williams said that \u201cwhile the U.S. would benefit from federal privacy laws, this isn\u2019t something impacting businesses. Remember that privacy laws make it more difficult to do business. They don\u2019t attract it. I think we\u2019ll see federal privacy laws when complying with individual state laws is too onerous for businesses. In other words, the U.S isn\u2019t behind, we\u2019re just approaching the problem differently.\u201d<\/p>\n

Further reading: Best Risk Management Software<\/a><\/p>\n\n\n

\n \n\n \n\n
\n \n <\/path>\n <\/svg>\n <\/div>\n \n
\n
\n

\n Get the Free Cybersecurity Newsletter <\/h3>\n \n \n

\n Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday <\/p>\n <\/div>\n\n

\n
\n \n Email Address\n <\/label>\n \n <\/div>\n\n
\n
\n \n \n By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time. <\/label>\n <\/div>\n <\/div>\n \n