Amendments to the Consumer Protection Law will come into effect on March 15, 2014. They will have a significant impact on both online and physical retailers through articles shifting the burden to the seller to prove products are without defect, introducing punitive damages and damages for mental suffering, dramatically increasing administrative fines, and introducing a kind of class action. They also include substantial privacy provisions, giving consumers the right to protection of their personal information when buying and using goods or services, and setting out a list of data protection obligations that businesses collecting or using personal information must meet, whether the information is collected online or otherwise.
Article 29 sets forth detail’s of the seller’s data privacy obligations introduced by the amended law. They include:
- explicitly inform consumers of the purpose, method, scope and rules for collection and use of their personal information, and obtain the consumers’ consent to the same
- disclose their rules for collecting personal information and abide by those rules, as well relevant laws and regulations and any contracts with consumers
- keep all personal information confidential and not disclose, sell or illegally provide it to others
- institute technical measures to adequately secure the personal information
- take immediate remedial steps to mitigate damage from actual or suspected unauthorized disclosure of personal information
- not send commercial or marketing information to consumers unless they consent to receive it or request it
China does not have a comprehensive data protect law but is gradually putting in place personal information measures for specific industries and in specific environments, such as the Internet (see Data Privacy/Real Name Decision and Privacy and the Internet). This amendment to the law puts in place comprehensive protections in the context of sales to consumers. However, it leaves some open questions.
First, it requires consumer consent for both use of personal information and marketing, but does not define “personal information” or the form of notification, whether written or oral. Second, it does not indicate whether consent may be oral or must be in writing, although of course written consent is advisable. Third, it does not indicate whether consent may be by opt-out or must be by opt-in. Finally, it does not distinguish between sensitive and non-sensitive information for consent purposes, or otherwise.
These amendments should be viewed in the broader social context in China. While providing needed protections, they are heavily weighted in favor of consumers and will likely increase business costs substantially and raise the bar for online sellers. The increase in administrative penalties alone is astonishing, up to 10 times “illegal profits” and a 50-fold increase in the amount of statutory penalties. The amendments will take effect on Consumer Protect Day and appear to be part of an effort, along with a crackdown on corruption, by the government to curry favor with the Chinese people. In any case, the provisions are likely to be enforced and online and offline retailers selling to consumers in China should review their data protection and other practices accordingly.
Your China Desk in Silicon Valley®
Questions? Contact Allan Marson at firstname.lastname@example.org or +1 408-738-0592 for a complimentary consultation.