China's PIPL at 5: Enforcement, evolution and what comes next

In 2023, the fifth anniversary of the EU General Data Protection Regulation's implementation led to widespread reflection on its effectiveness, faults and international influence. The international cascade of regulations that followed the GDPR's introduction bolstered the idea of the Brussels effect, the phenomenon through which regulation within the European market influences global standards. 

One of the most prominent examples is China's Personal Information Protection Law, which shares many of the GDPR's fundamental concepts. Effective 1 Nov. 2021, the PIPL now celebrates its fifth anniversary. 

Comparable concepts include their respective principles, definitions of personal data and information and the roles and obligations of data handlers, the PIPL's equivalent to the GDPR's "controllers." 

While these comparable approaches may make it easier for organizations to harmonize their operations, the two laws are not like-for-like. Among the most notable deviations is the Chinese approach to lawful bases. The PIPL does not contain an equivalent to Europe's "legitimate interests" basis, with consent relied upon far more heavily. 

Now that the PIPL has had time to develop, the law's fifth anniversary provides its own opportunity for reflection on guidance and enforcement under the law to date.

Enforcement

Enforcement mainly comes under the remit of the Cyberspace Administration of China, though other authorities also contribute, primarily the Ministry of Industry and Information Technology and Ministry of Public Security and certain sectoral regulators. 

While landmark cases are handled by the CAC, enforcement actions involving mobile apps are often addressed by different authorities. Civil litigation has also emerged as a means for challenging unlawful processing, with multiple "guiding cases" now identified, providing greater clarity on specific PIPL compliance requirements.