Karimi & Associates Law Firm presents according to Reuters:
China’s legislative body, the National People’s Congress, passed a law aimed to protect online user data privacy, state media Xinhua reports. The law’s passage is to be considered as another step forward in the country’s endeavor to regulate cyberspace and is expected to add more compliance requirements for companies in the country. Tech giants in China have been instructed to ensure better secure storage of user data and to amid public complaints about mismanagement and misuse which have resulted in user privacy violations.
According to this law, handling of personal information must have a clear and reasonable purpose and shall be limited to the “minimum scope necessary to achieve the goals of handling” data.
It also determines conditions for which companies can collect personal data, including obtaining an individual’s consent, as well as laying out instructions for ensuring data protection when data is transferred outside the country.
Moreover, the law obligates handlers of personal information to have an individual in charge of personal information protection, and for handlers to conduct periodic audits to verify compliance with the law.
On the same day of Xinhua’s announcement of the data privacy law’s passage, the National People’s Congress published an op-ed from state media introducing the legislation. It called for entities that use algorithms for “personalized decision making” such as recommendations to first obtain user consent.
“Personalization is the result of a user’s choice, and truly personalized recommendations must ensure the user’s freedom to choose, without compulsion,” the op-ed read. “Therefore, users must be given the right to not make use of personalized recommendation functions.”