China’s Personal Information Protection Law is Here. What’s Changing?

You go out for a bowl of noodles, and have to share your name and phone number to order. You ride in a taxi, and leave a trail the company can use to see where you work. If you walk outside, dozens of cameras train their face recognition algorithms on you. In Chinese cities, there’s no escaping data collection.

Many people are fed up. Most restaurants in large Chinese cities require diners to scan a QR code to order food — sharing personal information stored in WeChat — or follow the establishments’ official social media accounts for future promotions. Over 98.5% of participants in a March survey by Shenzhen Consumer Council said they disliked the practice, but 240 out of 260 surveyed supermarkets and restaurants, or 92%, made the authorization mandatory.

China’s first comprehensive legislation on personal data protection, the Personal Information Protection Law (PIPL), effective today, says data collectors can only handle personal information when “there is a specific purpose and a need to fulfill, and under circumstances of strict protection measures.” Restaurants, for example, will have to reduce requests for data to what they need to provide food orders.

Read more