China’s legislature, the Standing Committee of the National People’s Congress, is drafting a personal information protection law, and the draft was published on October 12, 2020. As of now, the draft has not been voted on.

The key points of this law are as follows:

1.This law is not only applicable to any entity or individual’s processing of personal information of natural persons in China, but also to specific activities of processing personal information of natural persons in China outside of China. (Article 1)

2.Sensitive personal information is specially protected. This information includes: race, ethnicity, religion, personal biological characteristics, medical health, financial accounts, personal whereabouts. (Article 29)

Information processors can only process sensitive personal information under the following conditions: (1) They must use the information under certain circumstances; (2) They have obtained the specific consent of the individuals involved in the information. (Article 29, Article 30)

3.If the information processor needs to provide personal information outside of China, it shall obtain the approval of the regulatory authority. (Article 38)

In international judicial assistance, if information processors need to provide personal information outside of China, they should obtain approval from relevant authorities. (Article 41)

4.When the personal information processed by the information processor reaches a certain amount, it should designate a certain person as the person in charge of personal information protection. The person in charge will supervise its personal information processing activities and protection measures. (Article 51)

5.If the information processor violates this law, not only will the illegal income be confiscated, but also a fine of less than 50 million yuan or less than 5% of the previous year’s turnover will be imposed. (Article 62) This should be the highest fine in all Chinese laws so far.