In response to several recent, high-profile leaks of online personal information, the Chinese government has stepped up its efforts to protect personal data. In 2009, the Tort Law made it possible for users to sue ISPs for unlawful disclosure of their private data. In 2012 and 2013, new legislation and regulations put further limits on how user data can be handled. With the introduction of these laws and regulations, China's data privacy regime, at least on paper, is comparable to that of the EU. The landscape for ISPs and businesses dealing in personal data in China in 2013 is therefore now very different.

This presentation and the accompanying paper will review the historic background, set out the landscape today and look at the impact of the new regulations in their first year.

In particular the paper will set out how the 2012 Chinese National People’s Congress Decision on Strengthening Online Information Protection is the most important of these regulations. Echoing the European Union’s 1995 Data Privacy Directive in many respects, the Decision prohibits the sale or disclosure of any personal data to a third party, and requires ISPs to obtain informed consent when collecting data and to prevent leaks. Controversially, the Decision requires ISPs to obtain identifying information for all users.

The paper will also review the 2012 Ministry of Industry and Information Technology Regulations and the 2013 National Standard for data protection. It will show how the MIIT Regulations reflect the Decision’s emphasis on minimal data collection, keeping users informed, and maintaining strong security measures, while setting out financial penalties for violations. And it will also show how the National Standard lacks penalties, but is useful as a broad guideline for all organisations that deal with personal information.

Finally, the paper will look at case law and further guidance that has been developed since the Decision’s implementation.