China’s data protection laws aim to help curb the country’s technology giants

GUANGZHOU, China – China is trying to tighten rules on how its citizens’ personal data is collected as it moves to further curtail the power of tech giants like Alibaba and Tencent.

A strong data framework could also help countries define the look of the next generation of the Internet, said one expert, stressing that it could become a geopolitical problem as China tries to challenge the US in the field of technology.

But the movement has also raised the debate that the same rules will apply to one of the largest data processors in the country – the government.

Last year, Beijing published the preliminary version of the Law on the Protection of Personal Information (PIPL), establishing for the first time a comprehensive set of rules on data collection and protection. Previously, various elements of the partial legislation governed the data.

It is seen as part of a larger effort to curb the power of Chinese technology giants, which have managed to grow steadily in recent years through the vast collection of data to train algorithms and build products, experts said.

In February, China issued revised antitrust rules for so-called “platform economy” companies, which is a broad term for Internet companies operating a variety of services from e-commerce to food delivery.

“The government wants to put a stop to some … of those tech giants,” Rachel Li, a Beijing partner at law firm Zhong Lun, told CNBC by telephone. “This legislation … goes along with other efforts, such as antitrust.”

Globally, there has been a push for stronger rules to protect data and consumer privacy as technology services continue to expand.

In 2018, the General Data Protection Regulation of the European Union entered into force. Named GDPR for short, it gives citizens in the bloc more control over their data and gives authorities the opportunity to fine companies that do not follow the rules. The US has not yet adopted a national data protection law, such as Europe.

Now China is trying to do something similar.

“After years of Chinese internet companies building business models around the Chinese people’s lack of awareness of privacy, users are becoming more and more aware and angry at companies that abuse their personal information,” said Winston Ma, an adjunct professor. at New York Law School, he told CNBC by email.

China’s Personal Data Protection Act applies to the country’s citizens, as well as to companies and data controllers.

Here are the key parts of the law:

• Data collectors must obtain the user’s consent to collect information, and users have the right to withdraw that consent;
• Data processing companies may not refuse to provide services to users who do not accept the data collection – unless such data is necessary for the provision of that product or service;
• Strict requirements and rules for transferring data to Chinese citizens abroad, including obtaining government permission;
• Individuals can request their personal data that is held by a data processor;
• Any company or non-compliant person could be fined more than 50 million yuan ($ 7.6 million) or 5% of annual turnover. They may also be forced to stop some of their business.

But there are signs that control could be extended. Reuters reported last month that Pony Ma, founder of gaming giant Tencent, had met with antitrust officials to discuss compliance with his company. Tencent owns the social networking application WeChat, which has become ubiquitous in China.

Ma from NYU noted that the data protection law will have a “balanced approach to the relationship between individual users and Internet platforms.” But combined with other regulations, it could slow the growth of tech giants, he said.

“In general, the era of ‘exponential growth in the wild’ for the expansion of Chinese technology companies is over, whether it is domestic or foreign,” he said.

He added that some companies may be forced to change their business models.

Experts have previously told CNBC that China’s efforts to regulate its internet sector are part of its ambition to become a technological superpower as tensions between Beijing and Washington continue. Data protection regulation is part of this pressure.

“To a large extent, cyberspace and the digital economy remain undefined, the data law framework has become a geopolitical factor,” Ma said at NYU. “Any country can take the lead in making progress in its legislation or development model, it can provide a model for the next generation of the Internet.”

Ma told me that if there is a digital economy version of the World Trade Organization rules, countries with strong data laws can have “leadership power”. The WTO is a group of 164 Member States that aims to create rules around global trade.

“That’s why more and more people are talking about what China’s model is.”

China’s data protection law contains a section on state agencies that process information.

In theory, the state should adhere to similar principles when it comes to data collection as a private company – but there is debate about this.

“We often think of PIPL in terms of its applications to Alibaba or Tencent, but we forget that Chinese state agencies are the largest data processors in the country,” said Kendra Schaefer, a partner at Trivium China, a research firm. based in Beijing.

“There are lively debates in the Chinese legal and academic communities about how the PIPL should be applied to administrative activities,” she said. “A specific problem is that the PIPL gives individuals the right to give informed consent when their data is collected, but this may conflict with, for example, police investigations by law enforcement agencies.”

“What’s interesting is that a national conversation is starting around what the Chinese government may or may not do with citizens’ data and how the law should define state obligations,” Schaefer added.