2 March, 2013

The Standing Committee of the National People’s Congress promulgated the Decision to Enhance the Protection of Personal Information on Network (the “Decision“) on December 28, 2012, which took immediate effect. The Decision aims to “ensure network information security, protect the lawful rights and interests of citizens, and safeguard national security and social public interests” and is a significant step forward in the protection of personal online privacy in China.

The Decision emphasizes the following key aspects:

A) Protection of Personal Information

Personal electronic information of any citizen (the “Personal Information”), which refers to electronic information through which the Government can identify a citizen’s identity or in which a citizen’s privacy is involved, is protected under the Decision. No person shall steal, illegally obtain, sell or illegally provide to others any Personal Information. Under the Decision, network service providers and other enterprises and institutions are required to:

• express the purpose, manner and scope for collection or use of any citizen’s Personal Information and obtain prior consent from the citizen;
• make public the rules for collection and use of any citizen’s Personal Information; and
• adopt necessary measures to keep the Personal Information strictly confidential and not disclose, sell or illegally provide any Personal Information to third parties. 

B) Anti-Spam Messages

Due to the increase in spam messages, the Decision prohibits entities and individuals from sending promotional messages to any user’s fixed-line phone, mobile phone or personal e-mail address without the user’s prior consent or request.

C) Obligations of Online Service Providers

The Telecoms Regulations issued by the State Council in 2000 provide that, if an online service provider discovers that any illegal information has been transmitted over its network, it shall immediately discontinue the transmission of this information, keep records of the publication and report it to the relevant state authorities. The Decision reiterates this obligation.

More importantly, the Decision formally requires that any service provider which provides network access services, fixed-line telephone services, mobile phone services or information posting services must require the user to provide genuine identification information. 

Previously, real-name registration was required by local governments in the microblog industry only in limited Chinese cities. Now the Decision extends and expands the scope to all network information publication services in China. 

The Decision in Practice

This is the first national legislation which specifically aims to protect Personal Information in China. In the event of a privacy infringement, network users are entitled to seek remedies under the Decision, such as requesting the online service provider to delete relevant Personal Information or bring a lawsuit against the infringer. 

While the Decision is a positive development for Internet users, naturally there are still issues that need to be considered further. For example, the Decision requires relevant government authorities to take necessary measures to prevent, stop and deal with illegal and criminal activities relating to online information, and online service providers are expected to cooperate with such authorities. However, the Decision does not specify which authorities the service providers are expected to cooperate with or what measures shall be taken by the authorities in order to prevent, stop or deal with illegal and criminal activities. Such uncertainties may lead to overlapping authority within the telecommunications service sector.

In addition, the real-name registration requirement may greatly impact social-media service providers such as Sina, which runs the popular Twitter-like Weibo service. If this requirement is strictly enforced , social-media services will be less attractive to Internet users who are reluctant to register their genuine name. Further, network service providers would need to increase resources and efforts to comply with verification requirements.

It is as yet unclear when implementing rules may be issued to clarify and/or implement this Decision