China’s Personal Information Protection Law （2）

Clear demarcation of processors’ responsibilities

The draft elected to categorize the way a processor handles personal information rendering the text more succinct and clearer than GDPR.

Where two or more processors are jointly to decide the processing purposes and methods, they should properly allocate their respective rights and obligations by an agreement.  Such agreement does not have any adverse effect on any individual data subject’s right to seek to redress wrongs done to him from either one of the processors.  In other words, the processors could be jointly and severally liable for infringing on individual data subjects’ rights (Article 21).

For the situation of processing personal information by delegation, for example, where Processor A delegates its processing responsibilities to Processor B, both parties (e.g., Party A and Party B) need to enter into an agreement in relation to the purposes of processing, methods of processing, types of personal information, protective measures and their respective rights and obligations.  Party A also needs to exercise oversight over Party B’s processing.  Party B shall not diverge from what is agreed in the agreement, and shall return or delete the processed personal information after the agreement is performed.  Party B shall not delegate the task of processing to any other third party without Party A’s prior consent (Article 22).

Notably informed and separate consent is required if a processor is to provide personal information to any third party.  The third party that received the personal information shall not act beyond the purpose why the information is transferred.  Especially, the receiving party shall not use any technology to re-identify the personal information that was already anonymized (Article 24). 

(Please enter the following QR code for the complete article)

<点击下列二维码阅读全文>或