China's Personal Information Protection Law introduces the position of "personal information protection officer" — akin to the data protection officer role under the EU General Data Protection Regulation. When the amount of personal information processed by an organization reaches the threshold specified by the national cybersecurity administration authority, it is mandatory to appoint a PIPO to supervise the processing activities and protective measures implemented.
Definition of personal information protection officer
There is no definition of a personal information protection officer in the standard context of Chinese law prior to the PIPL. The role of the PIPO, however, is comparable to "Cybersecurity Officer" as defined in Article 21 of the Cyber Security Law, which was introduced in 2017. The CSL requires network operators to, in accordance with the requirements of the network security level protection system, designate a person for the responsibilities of network security protection.
In 2020, the National Information Security Standardization Technical Committee (TC260) issued the Information Security Technology-Personal Information Security Specification, GB/T35273-2020. Article 11.1 requires organizations to appoint a person in charge of personal information protection. This person shall have relevant management experience and personal information protection expertise and participate in all the important decisions about personal information processing activities.
Under PIPL Article 52, personal information handlers that process personal information up to the threshold specified by the national cybersecurity administration authority are required to designate a PIPO. In addition, activities outside of China that concern the personal information of natural persons in China shall also establish a specialized agency or designate a representative in China to handle matters related to the protection of personal information.
Article 53 of the PIPL states that personal information handlers outside the borders of China, as provided in Article 3, shall establish a dedicated entity, or appoint a representative within the borders of China to be responsible for matters related to the personal information they process, and are to report the name of the relevant entity or the name and contact method of the representative to the departments PIPL specifies requirements on audit.
Who needs to appoint a PIPO?
Although the PIPL is now enforceable, it remains unclear precisely which companies need to comply with the PIPO requirement. This is because the law only requires that organizations that process a certain threshold of individuals' personal information appoint PIPOs. In official guidance, organizations may look to analogous laws and statements by CAC, many of which indicate that the PIPO requirement will apply to organizations that process the personal information of hundreds of thousands or millions of individuals and depend on the sensitivity level of the information processed.
Two recent documents released by CAC support this conclusion: Article 4 of the draft Outbound Data Transfer Security Assessment Measures and Article 6 of the draft Cybersecurity Review Measures contain threshold figures of one million individuals whose personal information is handled by organizations. Another hint is found in the Personal Information Security Specification (GB/T 35273-2020), which encourages organizations to appoint a PIPO under any of the following circumstances:
- The organizations' main business activities involve personal information processing.
- The organization is staffed by more than 200 employees.
- The organization processes the personal information of more than 1 million people within a 12-month window.
- The organization processes the sensitive personal information of more than 100,000 people.
PIPO responsibilities
The PIPO serves a key compliance role under the PIPL. In short, the PIPO is the point of contact for both governmental and individual inquiries. While the PIPL requires that PIPOs be "responsible for supervising personal information handling activities as well as adopted protection measures," it does not specify that they must possess particular skills or expertise.
PIPOs are expected to exercise broad oversight functions throughout the entire personal information lifecycle in the organizations because of the law's compliance requirements and high penalties. This is mainly because the PIPL creates obligations for organizations to be responsible stewards of the personal information they process by preventing unauthorized access, leakage, distortion, or loss of user data. To achieve this, the PIPO should formulate internal management controls and operating rules, adopt technological security measures, such as encryption and de-identification, determine operational limits for data processing, regularly conduct security training for employees, and formulate and organize the implementation of security incident response plans.
Duties under the PIPL that likely fall to the PIPO include conducting protection impact assessments, incident response and compliance audits.
Protection impact assessment
Under Article 55 of the PIPL, a personal information handler must conduct a personal information protection impact assessment if it:
- Handles sensitive personal information.
- Uses personal information for automated decision-making.
- Entrusts personal information handling, provides personal information to other personal information handlers, or discloses personal information.
- Provides personal information abroad.
- Engages in other personal information handling activities that have a "major influence" on individuals.
The personal information protection impact assessment shall determine:
- Whether the personal information handling purpose and method are lawful, legitimate and necessary.
- What is the influence of the information handling on individuals' rights and interests, and what are the security risks involved?
- Whether the protective measures undertaken by the handler are legal, effective and appropriate given the risks.
Handlers should preserve reports and status records generated through personal information protection impact assessments for at least three years.
Incident response
Under Article 57 of the PIPL, whenever a leak, distortion, or loss of personal information occurs or might have occurred, handlers shall adopt remedial measures and notify the relevant departments and affected individuals of:
- The information categories, causes, and possible harm caused by the incident.
- The remedial measures taken by the handler and measures individuals can adopt to mitigate harm.
- A method of contact for the handler.
An exception to the notification requirement of Article 57 exists in that handlers that "adopt measures that are able to effectively avoid harm" to individuals from the incident are not required to notify individuals. However, where departments fulfilling personal information protection and responsibilities believe harm may have been created, they may require handlers to notify individuals.
Compliance audit
Under Article 54 of PIPL, personal information handlers are required to conduct regular compliance audits in line with related regulations and policies. The Article 54 compliance audit requirement differs from the Article 55 PIA requirement. Whereas compliance audits are often ratified at the procedural stage when personal information handling is in operation, PIAs should be used as prospective tools before an operation commences.
Under the PIPL Article 54 requirements, the compliance audit could be conduct by the handlers themselves. In other words, the compliance audit could be regarded as a type of internal audit. In addition to the PIPL, there are several rules and regulations published by the National Information Security Standardization Technical Committee, which could be followed by a compliance audit.
PIPO liability
Although the PIPL contains few detailed requirements regarding PIPOs, the law creates personal and criminal liability for officers in violation of their duties under the law. The PIPL allows enforcement authorities to personally fine PIPOs and other personnel involved in violations of the law, the amount of which will depend on severity and other circumstances.
Therefore, it is important to study the PIPO requirement and assess the feasibility of the responsibilities, which may differ for various organizations. Consequently, organizations in China, especially those enterprises with fewer compliance resources, may struggle to hire and retain PIPOs.
Conclusion
In China, PIPOs serve the critical oversight function of ensuring data protection law compliance, making it even more important for organizations to monitor rulemaking and regulatory announcements from Chinese authorities that could fill in some of the current gaps. A deeper understanding of the scope and application of the PIPL will continue as further details are released via additional regulations and practical guidance in the future.
Photo by Bruce Röttgers on Unsplash
