China’s Personal Information Protection Law (PIPL) and the EU’s General Data Protection Regulation (GDPR) are two comprehensive data privacy laws with a global reach.
They both grant their residents certain privacy rights and impose strict data obligations on businesses. However, their rules feature differences worth paying attention to if your business that deals with Chinese or EU residents.
In this article, we’ll compare these laws, walking you through their key similarities and differences to help streamline your compliance efforts.
Let’s dive in!
Key Takeaways
The PIPL is China’s data protection law that oversees the privacy protection of Chinese citizens and regulates how businesses handle their personal information.
The EU’s GDPR is a legal framework widely regarded as the world’s most stringent. It oversees the handling of EU resident’s personal data and strengthens their privacy rights in an increasingly digital world.
By and large, both these regulations are similar. However, they contain several key distinctions that mustn’t be overlooked.
What is China’s PIPL?
What is China’s PIPL.png
The PIPL is a robust data privacy law that regulates the lawful and responsible handling of personal information in China. It was passed by China’s top legislature in August 2021 and became effective two months later, on November 1, 2021.
The PIPL is regulated by the Cyberspace Administration of China (CAC), highlighting its governmental backing and dedication to comprehensive privacy practices.
So, who does this law impact? Well, if your business collects, handles, or stores the personal information of individuals in China (directly or indirectly), the PIPL applies to you regardless of your location. Whether you run an international company with a presence in China or solely operate online but engage with Chinese consumers, the PIPL applies.
It imposes consent requirements, data usage limitations, and—in some instances—requirements for appointing a dedicated Personal Information Protection Officer (PIPO) to supervise data protection operations.
While the PIPL notably draws some inspiration from the EU’s GDPR and borrows many of its concepts, both laws differ in certain key areas.
What is the EU’s GDPR?
What is the EU’s GDPR.png
Effectively the most popular data protection law today, the EU’s GDPR holds a position of importance in the privacy landscape. It was enacted on May 25, 2018, marking a pivotal shift in data privacy by redefining global data protection practices.
The GDPR reinforces EU residents’ rights over their personal data and imposes specific data protection duties on applicable organizations.
Its provisions are enforced by the Data Protection Authorities (DPAs) of each 27 EU member states under the European Data Protection Board (EDPB).
The GDPR applies to all organizations that collect, process or store the personal data of individuals located in the EU/EEA, regardless of location.
This includes European companies, foreign organizations with operations in the EU, and even individuals who collect or process the personal data of EU residents in a commercial or professional capacity.
Differences Between China’s PIPL and the EU’s GDPR
Differences Between China’s PIPL and the EU’s GDPR.png
Since its enactment, China’s PIPL has often been compared to the GDPR, given its many similarities with the European law.
Let’s take a look at their most prominent differences:
Territorial Scope
As mentioned, the PIPL and GDPR were enacted for different regions. The PIPL applies to organizations (regardless of where they’re based) that process the personal information of individuals in China to:
Offer them products or services
Assess their behavior, or
Fulfill other purposes under administrative laws and regulations
The GDPR, on the other hand, applies to organizations that process the personal data of EU/EEA residents regardless of location — whether you’re targeting them to offer products or services or monitoring their behavior (online or offline).
Definition of Personal and Sensitive Information
The PIPL and GDPR define personal information similarly, with the only notable difference being the PIPL’s exclusion of “anonymized data” from its scope.
When it comes to sensitive personal information (SPI), the PIPL takes things a step further by providing a broader definition.
Specifically, the PIPL defines SPI as information that may easily cause material harm if leaked or illegally used. Cited examples under the law include financial details, biometrics, and religious beliefs, to mention a few.
In contrast, the GDPR defines sensitive data using the term: “special category.” They include political opinions, philosophical views, racial/ethnic origin, and sexual orientation, to mention a few.
Primary Roles
The PIPL refers to organizations under its scope that handle and determine purposes of data as “personal information handlers.”
Conversely, the GDPR classifies applicable organizations in two based on their data processing functions. They include:
Data controllers – persons or businesses who decide purposes and means of data processing
Data processors – persons or businesses who process data on behalf of controllers
Data Localization
The PIPL requires certain personal information collected from individuals in China to be stored in China unless an exemption applies. In contrast, the GDPR doesn’t have an explicit data localization requirement.
Lawful Basis for Data Processing
The PIPL in China and GDPR in Europe both require companies to have a good reason before they can use personal data. However, the particulars of what counts as a “good” reason differ between the two.
For example, under European law (GDPR), one acceptable reason is if it’s genuinely necessary or beneficial (“legitimate interest”) so long as it doesn’t harm people’s rights. But this isn’t considered an okay excuse by Chinese law (PIPL).
Moreover, two unique aspects come into play when providing a legal foundation under PIPL:
Utilization of Public Personal Information
Otherwise Prescribed by Laws and Administrative Regulations
Data Subject Access Requests (DSARs)
Under both laws, consumers have a right to request access to their personal information. The exercise of this right is known as a Data Subject Access Request (DSAR).
The GDPR requires businesses to respond to DSARs within one month, except in cases where the request is complex or numerous. In contrast, the PIPL lacks a specific timeframe for responding to DSARs.
Penalties for Non-compliance
Both the PIPL and GDPR provide stringent penalties for non-compliance. For sufficiently severe violations, the PIPL imposes a maximum fine of 50 million RMB or 5% of an organization’s annual turnover, whichever is higher.
Moreover, PIPL violations may significantly impact an organization’s reputation as they’re filed under China’s credit system.
Conversely, the GDPR sets out penalties maxing out at €20 million or 4% of an organization’s global annual turnover, whichever is higher.
Separate Consent
Although consent standards are fairly similar under both laws, the PIPL adds a layer of complexity by introducing distinct requirements for specific situations.
For instance, when sharing personal information with third parties or transferring it outside China, the PIPL requires separate and explicit consent.
In other words, you’ll need a general consent form while tailoring additional special consent forms for distinctive scenarios under the PIPL.
Data Protection Officer Requirements
Under the GDPR, appointing a Data Protection Officer (DPO) is only required in specific circumstances, such as when an organization’s core activities involve large-scale monitoring or processing of sensitive data. The DPO acts to advise and ensure compliance within these organizations.
The PIPL requires companies that process personal information above certain thresholds defined by Chinese authorities to designate someone who will be responsible for managing personal data protection. This role is called the Personal Information Protection Officer (PIPO), and this person holds liability for their performance, unlike their European counterparts.
Additionally, suppose a company does not have a physical presence in China yet provides services or products there. In that case, they must assign a Chinese representative specifically tasked with communicating with Chinese authorities.
International Data Transfers
Although both laws support international data transfers, their specific requirements differ. Under the GDPR, you can facilitate international data transfers using approved mechanisms such as:
EU adequacy decisions
Standard Contractual Clauses (SCCs)
Binding Corporate Rules (BCRs)
On the other hand, the PIPL aligns cross-border data transfer rules with existing Chinese laws like the Cyber Security Law and Data Security Law. Essentially, adequate data transfers under the PIPL require one of the following:
Security assessment by the CAC
Certification
Standard contracts with recipients
Similarities Between China’s PIPL and the EU’s GDPR
Similarities Between China’s PIPL and the EU’s GDPR.png
China’s PIPL and the EU’s GDPR share several core principles and requirements that are central to responsible data management for businesses. This makes compliance easier for organizations under the scope of both laws.
Below, we outline some of the key similarities between these robust compliance frameworks:
Purpose of Personal Data Protection
Both the PIPL and GDPR emphasize the significance of safeguarding personal data. They prioritize granting consumers control and transparency over their data — a crucial principle for business ethics and trust-building.
Accountability and Record-keeping
Both laws require organizations to be accountable for their data processing activities and to keep accurate, up-to-date records of their processing operations.
Data Breach Notification
The PIPL and GDPR require organizations to notify individuals and regulators in case of a data breach. Both laws also have similar requirements for the actual content of data breach notices.
Data Minimization and Purpose Limitation
Under both laws, businesses must limit data collection to what is absolutely necessary for the specified purpose(s). These principles are known as data minimization and purpose limitation.
Aside from being legally required, these principles also promote responsible data management practices and operational efficiency.
Consent Standards
An overarching similarity between the PIPL and GDPR is their strict standards when it comes to valid consent. In short, if you rely on the lawful basis of consent, your consent mechanism must be explicit, voluntary, and informed.
Non-discrimination
Both the PIPL and GDPR prohibit organizations from discriminatory actions, especially in price-related matters. This highlights the importance of ensuring fair and equitable treatment of consumers regarding their personal information.
Data Security
Both laws require organizations to implement appropriate technical and organizational security measures to protect data from unauthorized access, use, disclosure, or destruction.
Setting up strong security protocols also supports your corporate compliance programs and adds to your business’s credibility.
Closing
Now that you’ve gained insights into the distinctions between China’s PIPL and the EU’s GDPR, it’s time to take proactive steps toward compliance.
At Captain Compliance, we offer tailored services to guide you through the complexities of these laws. Our team of experts will assess your business, data handling practices, and customer base to design a custom compliance plan.
Get in touch today to start toward compliance success!
FAQs
Do I need to comply with both the PIPL and GDPR if my business operates in both China and the EU?
Yes, if your business operates in both China and the EU or if you collect personal information from individuals in both jurisdictions, you’ll need to comply with both laws. This means you need a comprehensive data privacy program in place that takes both laws into consideration.
Find out the GDPR’s key principles and requirements in this article
Are the penalties for non-compliance similar under GDPR and PIPL?
No, the PIPL imposes harsher penalties of up to 5% of your annual turnover and may potentially affect your reputation by recording your violations under China’s credit file system. In contrast, GDPR penalties max out at 4% of annual turnover or 20 million Euros.
See also: CCPA Fines Overview
How can I ensure compliance and avoid penalties under these laws?
To ensure compliance, we recommend conducting a thorough data audit, drafting comprehensive privacy policies and protocols, obtaining explicit consent when needed, limiting data collection and usage to the barest minimum, and educating your employees on data protection best practices.
Check out our article on Data Protection Compliance Services