No organisation or individual may illegally collect, use, process, or transmit other people’s personal information, or illegally trade, provide, or disclose other people’s personal information, or engage in the processing of personal information that endangers the national security or public interests.
Author: Accessible Law
Article 11
The State establishes a sound personal information protection system, prevent and punish the infringement of personal information rights and interests, strengthen the publicity and education on personal information protection, and promote the formation of a good environment for the government, enterprises, relevant social organisations and the public to jointly participate in personal information protection.
Article 12
The State actively participates in the formulation of international rules for personal information protection, promotes the international exchange and cooperation in personal information protection, and drives the mutual recognition of the rules and standards for personal information protection with other countries, regions, and international organisations.
Article 13
Only under any of the following circumstances may a personal information processor process personal information:
(I) where the consent of the individual concerned is obtained;
(II) where it is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or to implement human resources management in accordance with labor rules and regulations formulated according to law and collective contracts concluded according to law;
(III) where it is necessary for the performance of statutory duties or statutory obligations;
(IV) where it is necessary for coping with public health emergencies or for the protection of the life, health, and property safety of a natural person;
(V) where such acts as news reporting and supervision by public opinions are carried out for the public interest, and the processing of personal information is within a reasonable scope;
(VI) where the personal information disclosed by individuals themselves or other legally disclosed personal information is processed within a reasonable scope in accordance with the provisions of this Law; and
(VII) other circumstances provided by laws and administrative regulations.
Individual consent shall be obtained for the processing of personal information stipulated in the other clauses of this Law, but in the circumstances specified in the preceding paragraph from (II) to (VII), the individual’s consent is not required.
Article 14
Where the processing of personal information is based on the consent of the individual concerned, such consent shall be given by the individual concerned in a voluntary and explicit manner in the condition of full knowledge. If laws and administrative regulations provide that the processing of personal information shall be subject to the individual’s separate consent or written consent, such provisions shall prevail.
If the purpose or method of processing personal information or the type of personal information to be processed changes, the individual’s consent shall be obtained again.
Article 15
Where the processing of personal information is based on the consent of the individual concerned, the individual is entitled to withdraw his/her consent. The personal information processor shall provide convenient means to withdraw consent.
The individual’s withdrawal of consent does not affect the validity of the personal information processing activities conducted prior to the withdrawal based on the individual’s consent.
Article 16
A personal information processor shall not refuse to provide products or services on the grounds that the individual does not agree to process his/her personal information or withdraws his/her consent, unless the processing of personal information is necessary for providing products or services.
Article 17
Prior to processing personal information, a personal information processor shall truthfully, accurately, and completely inform the individual of the following matters in an eye-catching manner and with clear and understandable language:
(I) the name and contact information of the personal information processor;
(II) the purpose and method of processing personal information, and the type and retention period of the processed personal information;
(III) the method and procedure for the individual to exercise the rights provided herein; and
(IV) other matters to be notified in accordance with the provisions of laws and administrative regulations.
If any of the matters provided in the preceding paragraph is changed, the individual shall be notified of such change.
Article 18
When processing personal information, a personal information processor may not notify the individual of the matters provided for in laws and administrative regulations where confidentiality shall be kept, or it is not necessary to notify the individual of the matters provided for in Paragraph 1 of the preceding Article.
In case of emergency, it is unable to timely inform the individual to protect the life, health and property safety of natural persons, the personal information processor shall inform the individual in time after elimination of emergency.
Article 19
The retention period of personal information shall be the minimum period necessary for achieving the purpose of processing, except for where the retention period of personal information is otherwise provided for in laws and administrative regulations.