Chinese lawmakers on Tuesday started deliberating a draft law on personal information protection to further regulate the collection and use of personal data.
The draft was submitted for the first reading at the ongoing session of the Standing Committee of the National People's Congress, China's top legislature.
Personal consent should be obtained on the premise of prior notification for handling private information, and individuals have the right to withdraw their consent, said the draft, adding that when significant details change, consent shall be obtained again.
No product or service shall be denied on the grounds of personal disagreement, the draft noted.
Before processing personal information, the data processor shall inform the individual of matters such as the identity and contact information of the processor, the purpose and method of processing, the type of personal information to be processed, and the retention period, all in a conspicuous way and clear and easy-to-understand language, the draft required.
By March 2020, China had 900 million internet users, more than 4 million websites, and more than 3 million applications, according to an introduction of the draft law.
Personal information protection has become one of the most important and practical issues for ordinary people, said the introduction.
The draft considered responding to public health emergencies or protecting the lives and health of natural persons in emergencies as one of the lawful situations for processing personal information, and stressed that the obligation to protect personal information must also be fulfilled under the above circumstances.
Protection of sensitive personal information, including race, ethnicity, religious belief, biometrics, medical care, financial accounts, and personal whereabouts, was also highlighted in the draft.
Data processors can only process sensitive personal information when they have specific purposes and sufficient necessity and should obtain individual or written consent.
The draft law also made some provisions on the use of collected big data by platforms to push personalized advertisements to users, stressing that people have the right to refuse the processor making decisions only through automated decision-making.
Commercial marketing and information through automated decision-making should also provide options that are not specific to their characteristics, added the draft.
