China adopts new data protection law

According to Reuters, China’s National People’s Congress has adopted a law, the Personal Information Protection Law (PIPL), designed to protect online user data privacy. It will implement the policy from November 1st, 2021. It has been deemed as ‘one of the world’s strictest data-privacy laws’ by the Wall Street Journal. This act states that the processing of personal information must have clear and reasonable purpose and shall be limited to the ‘minimum scope necessary to achieve the goals of handling’ data. The conditions for companies to collect personal data include obtaining individuals’ consent, as well as laying out guidelines for ensuring data protection when data is transferred outside China. TechCrunch reports that core elements of the law mirror provisions of the EU’s General Data Protection Regulation, including its extraterritorial scope. Indeed, if a company outside of China processes personal information of Chinese citizens, the PIPL requires that it set up a special institution or designate a representative in China for handling personal information protection matters.