Publication
Avoiding legal and regulatory pitfalls in digital transformation projects
This article first appeared in the September 2024 issue of Financier Worldwide.
China issues revised draft of the personal information security specification for consultation
China | Publication | March 2019
On February 1, 2019, the PRC State Administration for Market Regulation and the PRC Standardisation Administration jointly issued a draft Information Security Technology – Personal Information Security Specification (the Personal Information Security Specification or the Updated Version), along with a request for public comments.
The draft Personal Information Security Specification is an updated version of an earlier specification, which had become effective on May 1, 2018 (the Original Version). The Updated Version further implements requirements of personal data protection under the PRC Cyber Security Law, and is in line with relevant PRC laws issued recently – for example, the PRC E-Commerce Law (effective as of January 1, 2019).
Compared with the Original Version, the Updated Version includes the following major changes.
The Updated Version adds a definition of “personalised display” and regulations relating to this new concept.
Under the Updated Version
The Updated Version provides for certain rules in situations where personal data is collected for a third party product or service that has been incorporated or inserted into the master product or service.
In such situation, the data controller of the master product or service must
The Updated Version enhances risk management requirements for data controllers by laying down obligations for setting up a personal information security committee or designated personnel in charge of personal data protection, and their respective responsibilities and liabilities for personal data protection matters.
It has been just nine months since the Original Version was implemented that an Updated Version is now subject to consultation. This reflects the efforts made by Chinese regulators to promulgate new rules to improve regulation of personal data matters, and is aligned with multiple enforcement activities undertaken by Chinese authorities in the past months.
Although the Updated Version is still in draft form, we expect that the Personal Information Security Specification will soon be finalised and take effect. Once that occurs, it ought to be regarded as an example of good practice and practical supplementation guidance for personal information protection under the framework and requirements of the PRC Cyber Security Law.
It is possible, however, that the Updated Version could still be subject to further change before it is finalised. We will monitor any changes in relation to the Updated Version and other Chinese data and cybersecurity regulatory requirements and provide corresponding updates where appropriate.
Publication
This article first appeared in the September 2024 issue of Financier Worldwide.
Publication
The Digital Markets, Competition and Consumers Act (DMCC Act) received Royal Assent on 24 May 2024 and is generally expected to come into force in autumn this year.
Publication
On 26 July 2024, the People’s Bank of China (PBOC) and the State Administration of Foreign Exchange (SAFE) jointly released revised rules in respect of the investments into China’s financial market through the Qualified Foreign Institutional Investor and Renminbi Qualified Foreign Institutional Investor (collectively, QFII) regime (the New Rules).
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023