The Standing Committee of the National Congress recently adopted the Personal Data Protection Law. Foreign media described it as the world’s strictest privacy law perhaps because Chinese internet companies do not protect personal data well enough. I would like to discuss connections between this law and internet companies.

I. What Personal Data Protection Law protects?

I think it mainly protects privacy and related property rights. Article 2 of the Personal Data Protection Law provides that personal data of natural people are protected by law and none of organizations and individuals can infringe interests in personal data. Interests in personal data are privacy in nature. To put it more easily, things I searched on a search engine, bought on an online shopping website, watched on a news website and discussed with others by using social software are the term personal data in the Personal Data Protection Law, which for internet companies are my privacy.

The main aim of the Personal Data Protection Law is to protect our privacy by preventing internet companies operating search engines, e-commerce websites, news websites and social software from misusing their records of our uses of their services. All internet companies accept this. You can see links to personal data protection policies usually called privacy agreements or clauses on front pages of their websites.

A lot of Chinese internet companies make money from private data. “Chinese users are often willing to exchange privacy for convenience”, Li Yanhong said. Personal data protection laws are against interests of internet companies. Internet companies should adapt to these changes by making their business models comply with the adopted law, or they will have serious outcomes.

II. Serious outcomes of violating Personal Data Protection Law

The Personal Data Protection Law protects personal data mainly by regulating government authorities and internet companies collecting and processing personal data and contains a lot of related principles such as legality, justification, necessity and good faith principles under which personal data should be processed without misleading, deceiving or coercing any person; definite and reasonable purpose for which personal data should be processed in a way that is directly related to the purpose and has least effect on personal interests and to the smallest extent that is necessary to meet the purpose; and openness and transparency principles under which personal data processing rules should be open and the purpose, way and scope of processing personal data should be indicated expressly.

In case of breach of these principles by a state organ, its superior or the department responsible for protecting personal data will give an order to correct the breach and legally punish directly responsible supervisors and persons. Staff members of the department responsible for protecting personal data who are negligent in performing their duties, abuse their powers or act dishonestly will be legally punished.

In case of breach of these principles by an internet company in serious circumstances, the department responsible for protecting personal data at the provincial or higher level will give an order to correct the breach, forfeit illegal profits and impose a penalty of less than RMB 50 million or 5% of last year’s turnover, which for internet companies whose turnover often exceeds RMB 100 billion, is a huge amount. For example, Alibaba Group paid a penalty of 4% of its sales of RMB 4.55712 trillion in China in 2019, amounting to RMB 18.228 billion for violation of the Law Against Monopoly. In the Personal Data Law, the upper limit on a penalty is 5%.

III. Internet companies will have less advantages in algorithms.

Restrictions on algorithms given by the Personal Date Protection Law will weaken competitive advantages of internet companies over traditional businesses that they gain from algorithm strategies that may not be reasonable. For example, these restrictions will affect algorithms used by online car hailing platforms for driver performance assessments and calculation of charges payable by customers. An article available on the Xinhua website said the Consumer Protection Committee of Shanghai and a study team under Sun Jinyun from Fudan University conducted anexperiment to compare distance and time calculation results of different online car hailing platforms and found different prices for the same software and route in many cases; people hailing cars by using more expensive cellphones were more likely to get a price “increase”; and the actual price was much higher than estimated each time.

The Personal Data Protection Law states that people processing and using personal data to make automatic decisions should ensure the transparency of the decision-making processes and the fairness of the decisions without giving individuals unreasonable different treatments in transaction conditions such as prices. When this clause becomes applicable to online car hailing platforms, in case of price discrimination, they will face administrative regulation and legal proceedings. If an administrative authority or a court finds unreasonable algorithms during an algorithm audit, they could suffer public opinion crisis and loss of customers’ trust besides serious legal outcomes mentioned above.

Moreover, online car hailing platforms use algorithms to manage drivers. Media reports pointed out a lot of defects in algorithms for driver management, including bad control of tired drivers, excessive commissions, an indirect way of encouragement to run red lights and bad management of negative customer comments. The Personal Data Protection Law includes provisions against unreasonable and untransparent algorithms, stating that decisions that have important effect on individual interests should be made automatically and individuals are entitled to ask people processing personal data for explanations and refuse decisions made by them entirely automatically. Drivers given unreasonable punishment by algorithms can require the platform publish and explain algorithms according to openness and transparency principles and refuse punishment decisions made entirely by algorithms.

IV. Threats to internet companies that have advantages in user data

Pursuant to Article 45.3 of the Personal Data Protection Law, people processing personal data should provide approaches to transfer of personal data to designated persons processing personal data at individual request according to provisions of the national network and information authority. This is a big challenge of companies that have advantages in user data like Tencent.

Here is a well-known case. Duoshan, social software of Byte Dance sent users a pop-up window saying “Tencent requires change of your photo and name on Duoshan or Wechat” because Tencent filed a request for behavioral preservation with the court of Tianjin by claiming Duoshan was involved in unfair competition when copying users’ names and photos on Wechat and the court decided that Duoshan should stop copying users’ names and photos on Wechat, finding that Wechat/QQ products of Tencent were valuable brands with a large customer base and identity data of its users such as photos and names were its business resources that gave it competitive advantages.

The decision made by the court of Tianjin was all right in 2019 according to the Law Against Unfair Competition. After the Personal Data Protection Law becomes effective, courts will be more prudent to find user data are business resources that give Tencent competitive advantages because users will have the statutory right to transfer their personal data. Tencent’s rivals will be able to obtain personal data of Wechat users as long as they have a reasonable personal authorization process and comply with provisions of the national network and information authority. Tencent could not justifiably prevent its rivals from obtaining personal data it processes.

Finally, Chinese internet companies have taken advantage of the personal data protection system for years when laws developed more slowly than the industry’s growth. The benefit of being in the grey area infringes consumers’ privacy and adversely affects long-term good development of the industry. After the Personal Data Protection Law is promulgated, internet companies should work harder to deal with compliance matters to improve personal data protection policies and make a solid foundation for better development. In this sense, they should embrace the Personal Data Protection Law rather than be afraid of it.