Publication
Ireland
On 31 October 2023, the Screening of Third Country Transactions Act 2023 (the “Act”), which establishes a new foreign direct investment ("FDI") screening regime in Ireland, was enacted.
Global | Publication | January 2018
On 29 December 2017 the Standardization Administration of China issued an Information Security Technology – Personal Information Security Specification (GB/T 35273-2017)(the “Specification”), which will come into effect on 1 May 2018. Although the Specification is not a mandatory regulation, it nonetheless has a key implementing role in relation to China’s Cyber Security Law (“Cyber Security Law”) in respect of protecting personal information in China. In this client update we address the key requirements of the Specification in relation to collecting personal data from either employees or third parties. Such requirements give rise to significant compliance issues for business operations in China. We set out some guidance in relation to such issues.
Comparing the definition of “personal information” under the Cyber Security Law with that under the Specification, the latter expressly expands the scope of personal information to cover (in addition to the personal identity information) information reflecting the activities of certain individuals, including the personal location, personal correspondence records, online browsing history and so forth.
The expanded definition is consistent with the definition of “personal information” used in several newly-drafted regulations, such as the draft Measures for Security Assessment of Cross-border Transfer of Personal Information and Important Data (which remains in draft as at the date of this client update). The expanded scope reflects a trend among the relevant authorities of providing more comprehensive criteria as to what constitutes personal information, casting the net more widely.An appendix attached to the Specification sets out typical examples of what constitutes personal information as a practical guidance in relation to screening personal data.
The Specification introduces a concept of “sensitive personal information”, distinguishing such information from other personal information. Sensitive personal information is any personal information which, if lost or misused, may endanger personal security or property, cause damage to personal reputation, mental health and physical health, or lead to discriminatory treatment.
Under the Specification, sensitive personal information includes ID card numbers, biological identifying information, bank accounts, religious belief, sexual orientation (other typical sensitive personal information is listed in the appendix to the Specification). In addition, personal information relating to minors under 14 years old is generally deemed to be sensitive personal information.
The Specification sets out different rules regarding the collection and use of personal sensitive information. We set the details out below.
The minimization principle requires that the type of personal information to be collected should be directly related to carrying out a relevant business activity or service; and the frequency and amount of personal information should be limited to the minimum standard necessary for performing the business activity or service. In practice, whether the minimization principle has been properly complied with in collecting the personal information shall be determined on case-by-case basis.
Similar to the Cyber Security Law, the Specification confirms that the basic principle for legally collecting personal information consists of the following: (i) the collecting entity needs to explicitly notify relevant individuals of the rules regarding collecting personal information; and (ii) the collecting entity shall obtain consent from relevant individuals.
As a supplement to the general principle under the Cyber Security Law, the Specification sets out different types of requirements for respective categories of collecting personal information. These are set out as follows:
The Specification provides a few exceptions to the consent requirement. In the following circumstances the collection and use of personal information can be carried out without prior consent by individuals:
The exempted circumstances set out above are relatively broad and vaguely drafted. The Specification is silent on any detailed mechanism on how to determine whether an exemption might apply - for instance, it does not say whether businesses are obligated or entitled to consult with any authority when intending to rely on an exemption.
In addition, given the Cyber Security Law does not provide for any exemption for mandatory consent in relation to personal information collection, the Specification appears to be inconsistent with the Cyber Security Law. Since the effectiveness of the Specification is subordinated to the Cyber Security Law, it is possible that the authorities and courts may take a strict approach to interpreting the exemptions under the Specification, making them available in only limited circumstances.
If a business proposes to rely on such exemptions to avoid having to obtain consent from individuals, we suggest great care should be taken by the business to determine whether the specific circumstances it seeks to rely on fall squarely within the relevant exemption. A comprehensive review of the details of each case, and consulting with the relevant authorities and legal counsel in advance, is recommended in order to reduce the risk of non-compliance.
Although the Specification is not a mandatory regulation, because it was enacted by the National Information Security Standardization Technical Committee under the lead of the Cyberspace Administration of China, we consider that the Specification could be deemed to be an example of good practice and practical supplementation guidance under the framework envisaged by the Cyber Security Law. Upon the Specification becoming effective, we will continue to monitor any practical cases under the Specification and provide updates on any significant developments.
Publication
On 31 October 2023, the Screening of Third Country Transactions Act 2023 (the “Act”), which establishes a new foreign direct investment ("FDI") screening regime in Ireland, was enacted.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023