Personal information protection in two Chinese Laws
To protect personal information, it is essential to balance PI rights and interests and the fair use of PI. Photo: CFP
The Personal Information Protection Law of the People’s Republic of China (hereinafter referred to as “PIPL”) is China’s first specialized law to protect people’s personal information (PI). It was the first law in China to introduce the concept of “PI rights and interests,” while making PI protection one of its legislative purposes. In addition to the Civil Code, PIPL made further improvements on PI protection.
PI and civil law
Legal protection of PI started in the 1960s, when personality rights were threatened, with the development of computers and automated information systems. Up till now, academia has reached a consensus on the diversity and multiplicity of interests in regard to PI. Since PI bears multiple interests, instead of a single kind of personal or property interest, it would be wrong to simply categorize PI interests and rights as a certain type of property or personal right. That is why PIPL adopted the concept of “PI rights and interests.”
From the civil law’s perspective, among the interests carried with PI, many have already been protected by the Civil Code in its stipulations regarding personality rights.
For example, the right to privacy and an undisturbed private life are protected by the right to privacy. Although a natural person’s name is a part of his PI, the person’s right to name, determine, use, change, or allow others to use his name in accordance with law, falls into the category of “the right to name.” Another example is a natural person’s right to likeness, including making, using, publicizing, or authorizing others to use his image in accordance with law.
Any violation of the above-mentioned personality rights and interests, either by illegally leaking or using PI, is considered an infringement of rights to privacy, name, or likeness.
Apart from these interests on PI protected by specific personality rights, a natural person also enjoys other interests that must be protected by law. These interests are defensive, or protective, so to speak. They refer to the impact of illegal PI collection, leaking, buying, selling, or exploiting PI, all of which can cause damages to personal or property rights and interest, or even personal dignity and freedom. These interests are not fully covered by existing personality rights, yet they deserve legal protection.
In the era of big data and while living in an information society, PI collection, storage, transfer, and usage have become part of daily life. However, when handling PI, government offices, enterprises, and public institutions are likely to pose a danger to or even directly infringe on a natural persons’ rights. For instance, PI leaks and data theft can lead to identity theft, fraud, reputation damage, and even threaten personal safety. Even if victims have not directly experienced these damages for the time being, they are susceptible to the following three impacts.
The first impact is emotional disturbance, namely the emotional unease that victims may feel when their PI or personal data is leaked. The second impact is increased future risk. When a victims’ PI is leaked, their future risk of identity theft or fraud also goes up. Third, to reduce future risks, victims must spend time and money on registering for a credit monitoring account, contacting credit reporting agencies, or placing a fraud alert on their accounts.
In addition, even when the PI is legally collected, the handlers might still infringe upon others’ personality dignity and personality freedom if they conduct social sorting, discriminatory treatment, or completely automated decisions using algorithms.
To cope with these new dangers, the law must recognize and protect the defensive interests that a natural person has over their PI. This is the only way to build a solid legal protection shield over every natural person in the information society.
Systematic positioning
The rights and interests of PI are different from personal rights and interests, or the rights that individuals have in information processing. Personal rights and interests cover the largest scope within rights and interests, including all the rights and interests stipulated in both civil and public law.
As previously mentioned, in civil law, PI interests and rights refer to the personality interests that a person enjoys over their PI, i.e., their autonomous interests when handling information. Obviously, PI rights and interests comprise a personal interest. In contrast, the rights that a person has when handling their PI is a remedial right, or a means to protect PI rights and interests. Article 1037 in the Civil Code made relevant stipulation which encompassed the right to retrieve, make copies of, or delete one’s PI. PIPL further enriched individual’s rights in handling one’s PI by adding the rights to request processors to transfer or supplement their PI, and explain decisions made solely by an automated process.
Meanwhile, it is important for PI processors to establish easy access for individuals to exercise their rights so that they can request processors to handle their PI. It is also necessary to stipulate that if the PI processor denies an individual’s request to exercise his/her rights, he/she can file a lawsuit in the court in accordance with the law.
In summation, individuals’ rights when handling their PI are stipulated in the Civil Code and PIPL, both of which effectively protect individuals’ PI rights and interests.
PI rights and interests are different from specific personality rights such as privacy rights and portraiture rights. In China’s law, PI rights and interests are closest to privacy rights. It is highly complicated.
PI contains private information, which is also connected to privacy. Thus, private information concerns both privacy rights and PI rights and interests. To elaborate, private information, being private, must be protected by privacy rights. In the meantime, since it is also PI, rules and regulations for individual information protection also applies to private information. Paragraph 3, Article 1034 in the Civil Code stipulated: “The provisions on the right to privacy, or, in the absence of which, the provisions on the protection of personal information, shall be applied to the private personal information.”
Nevertheless, PI rights and interests remain independent from privacy rights and neither contains the other. For one thing, privacy rights, as a specific personality right, is generally effective against any person, since they feature absolute rights and the right to control. Hence, any institution or individual shall respect, and avoid infringing on, or cause a nuisance to, other’s privacy rights.
However, the Civil Code has not regulated the “right to PI.” Even PIPL opts for a more cautious phrase when referring to it, namely, the PI rights and interests. This stands as a clear signal that PI rights and interests are not an absolute right or within the right to control. The root cause of this is that even legal subjects cannot exclusively control one’s PI, otherwise they would put information networks technology and the digital economy in a difficult circumstance, since they depend on the fair use of PI for their development.
Therefore, to protect PI, it is essential to balance PI rights and interests and the fair use of PI. Take Article 999 in the Civil Code as an example, “The name, entity name... may be reasonably used by those engaged in news reporting, supervision of public opinions, or the like, for public interests.” Article 1037 also made specific stipulations on exemptions for PI abuse. These stipulations are non-existent in relevant regulations. Whereas privacy rights make no such exemptions.
For another, in regard to the content the rights regulated by the two laws, the Civil Code specified privacy rights from a defensive and negative perspective in Article 1032 and 1033. Both articles listed in detail the prohibited acts that infringe upon others’ privacy rights. In contrast, the Civil Code and PIPL stipulated on PI rights and interests from both positive and negative perspectives. Article 1037 in the Civil Code gave natural persons the right to retrieve, make copies of, or delete their PI, while Article 44 to 50 in Chapter 4 of PIPL made specific regulations on PI rights and interests. It is apparent that PI rights and interests can be distinguished from privacy rights in view of the content covered.
Cheng Xiao is the vice chairperson of the Law School Council at Tsinghua University and Wang Yuan is an assistant research fellow at the School of Law at Tsinghua University.
Edited by WENG RONG