Regulating Personal Data Protection in China: Practices and Future Directions

Аннотация

Personal data protection in China has become a focal point in the country's evolving digital economy. With the rapid expansion of data-driven technologies, the Chinese government has enacted and enforced several laws and regulations to safeguard personal information, including the Cybersecurity Law of 2017 and the Personal Information Protection Law (PIPL) of 2021. This paper explores the practices and prospects of personal data protection regulation in China, focusing on the existing regulatory framework, enforcement mechanisms, and the challenges faced by both the government and businesses in ensuring compliance. Additionally, it discusses China's evolving stance on data sovereignty and its alignment with global data protection standards, particularly the General Data Protection Regulation (GDPR). The paper concludes with an outlook on the future trajectory of personal data protection in China. Keywords: Personal Data Protection, China, Data Privacy, Cybersecurity Law, Regulatory Framework, Data Security, GDPR, Personal Information Protection Law, Compliance, Data Sovereignty. Introduction: In recent years, China has become a Building upon this foundation, in 2021, China passed global leader in data-driven technologies, including the Personal Information Protection Law (PIPL), artificial intelligence (AI), big data analytics, and e- marking a milestone in the country’s commitment to commerce. With the increased collection and data privacy. The PIPL has been seen as a major step processing of personal data in various sectors, there forward in aligning Chinese data protection practices has been growing concern about how personal with global standards, particularly the European information is handled, particularly regarding privacy Union's General Data Protection Regulation (GDPR). violations, data breaches, and misuse. The Chinese METHODS government has responded to these concerns by The research for this paper involved a comprehensive introducing a range of data protection laws and review of primary and secondary sources, including regulations aimed at safeguarding personal legal texts, government publications, reports from information. international organizations, and academic articles. Historically, China has been criticized for its lax Specifically, the following steps were undertaken: approach to privacy and data protection, with many 1. Review of Primary Legislation: The primary international observers highlighting the absence of sources of data were China's Cybersecurity Law (2017) comprehensive legal safeguards for personal data. and Personal Information Protection Law (2021). These However, as data-driven businesses and technologies documents were analyzed to understand the legal proliferate, China has made significant strides toward provisions, obligations, and frameworks for data strengthening its data protection regime. In 2017, protection in China. Additionally, other relevant China passed the Cybersecurity Law, a foundational regulations, such as the Data Security Law (2021), were piece of legislation that laid the groundwork for future reviewed to provide a holistic view of China's data data protection policies. The law set out basic principles governance landscape. for the protection of personal data and introduced broad cybersecurity obligations for businesses. 2. Case Study Analysis: A selection of case studies International Journal of Law And Criminology 48 https://theusajournals.com/index.php/ijlc International Journal of Law And Criminology (ISSN: 2771-2214) highlighting enforcement actions taken by Chinese monitor compliance, particularly in small and medium- authorities under the Cybersecurity Law and PIPL was sized enterprises (SMEs). Additionally, businesses, reviewed. This analysis provided insight into the real- particularly those in tech, face ambiguity in some world application of these laws and how businesses provisions of the PIPL, leading to confusion regarding and individuals are held accountable for non- their compliance obligations. compliance.