• Corporate affairs teams face a thicket of privacy norms, regulations and customer expectations in the world’s largest internet market
• COVID-19 tracking apps add fresh urgency to increasing the safety of digitized personal data

The people of Wuhan, China suffered a second and unexpected indignity after enduring the outbreak of COVID-19. Several residents of the original epicenter of the virus found their names, addresses, daily movements and other personal data leaked online. It was an apparent attempt by vigilantes to protect the rest of the population from those presumed to carry the virus.

The personal data was leaked from one of over 100 quick response (QR) programs that city governments across China rolled out to track individuals considered high-risk. 

This episode added fresh urgency to the issue of digital privacy in China. A researcher from a think tank affiliated with the Chinese tech giant Tencent called China’s existing laws inadequate for protecting health data and proposed laws to minimize data collection and increase protections.

The Tencent researcher tapped into a growing vein of contention in Chinese society. A rash of phishing scams and leaked personal data has stoked concerns over companies’ responsibilities to safeguard digitized information. In response, a patchwork of official agencies, quasi-government bodies and private companies have put forward a number of initiatives to address these concerns.

This unstructured and fluid approach has created a confusing array of laws, regulatory imperatives, and expectations from the general public to protect personal information as more aspects of daily life – from banking and transportation to education and health care – move into the digital ether.

A growing scourge

Concerns about safeguarding digital privacy have skyrocketed among Chinese citizens in recent years. Many have posted public complaints on social media detailing accounts of phishing scams and marketing calls after their personal information leaked to unauthorized parties.

Although the wide-scale use of facial recognition technology in China has  faced little public resistance, it has nonetheless compounded privacy concerns. Last year, People’s Daily, the official newspaper of the Communist Party’s Central Committee, reported that facial data was available for sale on the internet. It called for a crackdown on “those who violate people’s rights with their own facial information.”

A legal case has sprung up that will test consumers’ rights to take action against companies. A Chinese professor sued a zoo in Hangzhou last year for breach of contract after it replaced its fingerprint-based entry system with one that requires facial recognition. The professor alleged that using facial scans violates China’s consumer protections,  taking legal action when the zoo refused to refund his membership. The outcome of the lawsuit, which underscores the rise of privacy concerns among ordinary citizens, could affect the regulation of biometric technology.

The winding road to national privacy regulation

Various government bodies have claimed a stake in regulating China’s cyberspace. Some have real teeth and can issue punishments including fines. Others are advisory, issuing recommendations for privacy protections. Their actions have been uncoordinated and are independent of each other.

Further complicating the landscape, private sector groups are advocating for their own approach to protecting privacy.

National data privacy laws are reportedly in the works. In April 2019, a spokesperson for the National People’s Congress said authorities were drafting a law to protect personal data.

It may be years before China establishes privacy laws and regulations akin to the European Union’s General Data Protection Regulation. Until then, corporate affairs teams of MNCs in China are best served by taking the following steps:

• Apply practices and standards from other markets such as the EU or Hong Kong to protect data and prevent misuse of it by internal teams and business partners.
• Track the policies and recommendations from various agencies and bodies (see table below), and find a way to accommodate them. Where possible, hew to more stringent standards.
• Monitor the actions of domestic Chinese firms who have a better read on public sentiment and whose data privacy policies may set a de facto baseline standard that the public expects.
• Track related announcements by the National People’s Congress and its affiliated media outlets.

^{1 http://www.miit.gov.cn/n1146290/n1146402/n1146440/c7575066/content.html
2 http://chinainnovationfunding.eu/dt_testimonials/publication-of-the-new-generation-ai-governance-principles-developing-responsible-ai/}