China’s National People’s Congress has tabled a second draft of its data protection law, PIPL. Open for public comment until May 28. See English translation here: https://digichina.stanford.edu/news/translation-personal-information-protection-law-peoples-republic-china-draft-second-review (credit @gwbstr @DigiChn) This is a fascinating document in many ways. Quick comments below.

Much like the first draft, the law is heavily focused on consent. (The word appears 30 times in the text!) This is interesting for a country as collectivist as China. But reflects the government’s intent to rebalance the power dynamics bet tech platforms, the state & individuals.

At the same time, this draft adds a new legal basis for processing, beyond consent, necessity for contract and a legal obligation. Processing publicly available data “within a reasonable scope”. Interesting which stakeholder comments were accepted to introduce this change.

Also, businesses may not refuse service because a consumer opts out of tracking, unless tracking is integral to the service (Art 17).

The law requires businesses processing large quantities of data to appoint a DPO (Art 52). Foreign companies subject to PIPL must appoint a representative in China (Art 53). In both cases, companies must report their name to the CAC.

Fascinating new requirements for large tech platforms in Article 57. Very forward thinking! 1. Appoint an external review board. (Note: “Facebook supreme court”). 2. Cut off actors who violate the law. (Think: Cambridge Analytica). 3. Publish ESG reports.

In a week when the SCOTUS clips the wings of the FTC, restricting disgorgement remedy, China introduces privacy sanctions including “Corrective orders and orders to confiscate unlawful income”. (Art 65). Also rules on compensating individuals for harm, inc statutory damages (68).

China is a global leader on AI. The law addresses AI in several section, including rights for transparency in ADM (Art 25), limitations on facial recognition except for “public safety” (Art 27), risk assessments for ADM (Art 55) and DPA responsibilities (Art 61).

China’s status as a trade super power is evident in Art 42 (blacklisting foreign companies for “harming the rights and interests of PRC citizens”) and 43 (retaliatory measures against countries that “adopt discriminatory DP prohibitions or limitations” against China).

In this vein, also note Article 66: DP violations will be listed on social credit scores.

All in all an outstanding document. Look forward to hearing other views and seeing the third (and likely final) draft later this year.