The current session of the 13th National People’s Congress (NPC) is taking up China’s first civil code since the Chinese Communist Party took power in 1949, which is slated to become active in January of 2021. Among other things, the code would substantially enhance privacy rights for both individuals and businesses. However, the contradiction of Chinese law has always been that there are fairly strong privacy laws on the books but it is entirely at the discretion of the government as to whether they will be respected and enforced; it is unclear to what extent the new civil code will change that state of affairs.
Drafting the civil code
The new civil code has been in the works since 2014 and serves several purposes for the Chinese government. One is to combat the perception that, in spite of its authoritarian reputation, the country does not really have “rule of law” in the sense that democratic nations would define it . Another is financial; it would provide businesses in the country with protections designed to spur investment and economic growth.
China has had a patchwork civil law under the present government, but not one that provides either individuals or businesses with any sort of inalienable privacy rights. Issues of civil rights generally fall to the Supreme People’s Court, which simply issues new directives as novel cases appear.
For businesses, the new civil code will amalgamate many of these existing laws while providing some extra protections and clarifications in terms of contracts, property rights and torts. These are significant steps given that the legal system was only granted some level of independence from the government in 2001, a move that enabled China to join the World Trade Organization. However, the new civil code will apply only to disputes between private parties. It does not grant businesses any added privacy rights or legal protections in cases of criminal charges or asset seizure by the state.
For individuals, the civil code carves out the country’s first definitions of private spaces and private information. However, as with the business terms, this applies only to private individuals and organizations. It does not enumerate any new privacy rights that apply to state snooping.
Individuals will now at least have some formal recourse when they are spammed, however. Article 812 of the new civil code grants protections for harassment by various means of communications such as email, instant messages and phone calls.
The new civil code also expands the scope of protected personally identifiable information. Geographic location and email addresses are now in this category, and there are added rules regarding obtaining consent and making purposes transparent when businesses collect this type of personal data.
There is also a robust new set of data protection terms that apply to data security, cross-border transfers, and special protections for the personal information of children.
And though this particular branch of the law will only be of use to celebrities and public figures, the new civil code clarifies and strengthens “personality rights” such as the right to use of the name and likeness of any natural person. There has been a longstanding issue of the likenesses of foreign celebrities being used by private businesses to promote their products in the country without their knowledge or permission. The celebrities (or in some cases their estates) have had limited legal recourse in the country when this happens. This area of privacy rights also addresses the potential use of deepfake videos for profit or reputational harm, something that leapt to the forefront of public awareness with the release of the Zao face-swapping app in late 2019.
Privacy rights and geofencing
Online services have become increasingly skittish about allowing data to be stored on servers physically located in China given the privacy situation to date. It is not uncommon to see these services to put up a “geofence” that limits the use of Chinese servers to customers who are physically located in China, as Zoom did earlier this year when it was criticized for its data routing practices.
While these new privacy rights laws will not do much to address concerns over the Chinese government seizing or intercepting data, they might calm some concerns about lack of legal recourse against breached vendors in the country.
Enforcement is key
Though the civil code is a step in the right direction for privacy rights, the fact that it does not establish independent courts means that it will be enforced at the pleasure of the government. Nevertheless, it will likely produce at least some amount of improved results. Non-state privacy violations are likely to be significantly reduced, with the responsibilities of private businesses made more clear and punishments for violations being strengthened.
