Legal Update On The New Requirements For Employers Under The Personal Information Protection Law In China.

1. 

An employer must have a valid ground under PIPL for processing an employee’s personal information.
 

To process an employee’s personal information, an employer must have a valid ground under PIPL and the common grounds include:-
 

• the employee has given prior consent; or

• the processing of the personal information is necessary for human resources management in accordance with the internal rules and regulations or collective contracts.

2. 

An employee’s personal information can only be processed for a proper purpose and in a reasonable manner.
 

Even if an employee has duly consented, an employer still must ensure that the processing of the information is for a proper purpose and in a reasonable manner. For example, the collection of an employee’s information about his/her marital status or pregnancy is irrelevant to the establishment of employment relationship and lacks a proper purpose, which in practice may be regarded as violating PIPL.

3. 

An employer must ensure the security of an employee’s personal information.
 

Under PIPL, an employer has the duty to establish a system to ensure the security of the employees’ personal information. Depending on the purposes and manner of processing and the nature of the information, the employer needs to take measures including developing internal rules and procedures for processing the information, managing the information based on their different nature, adopting encryption and de-identification measures, duly authorising the data processing staff, providing regular training, and making emergency plans. In case future disputes arise, an employer may be liable if he/she cannot prove the implementation of such security measures.

4. 

An employer has the duty to ensure an employee’s rights in respect of his/her personal information.
 

PIPL has provided a series of rights to individuals in respect of their personal information, including right to information, decision, correction, and copying. The employer has the duty to ensure the employee’s access to these rights. For example, if surveillance cameras are installed at the workplace, the employees should be informed.

1. 

The primary principle is to obtain informed consent.
 

An employer must duly inform an employee before processing his/her personal information. In particular, the employer must inform the employee in a clear and comprehensible manner, and obtain the employee’s clear and voluntary consent. Should there be material change to the purpose or manner of processing or the type of processed information, the employer would need to obtain the employee’s consent again.

2. 

For processing sensitive personal information, specific consent is required.
 

“Sensitive personal information” refers to such personal information that the disclosure or unlawful use of which could endanger the individual’s dignity, personal safety or property, including biometric data, religion, medical data, finances and location, and all personal information of minors under the age of 14. It is only when there is a sufficiently necessary and specific purpose that an employer can process an employee’s sensitive personal information whilst the employer must also take strict protective measures. When processing such sensitive personal information, the employer must obtain the employee’s specific consent and inform him/her of the necessity of processing the information and the potential impact on him/her.

3. 

Personal information cannot be stored in excess of a necessary period.
 

An employer cannot retain an employee’s personal information in excess of a necessary period and the storage of which must comply with the relevant regulations. An employer should establish an internal mechanism to check and delete such information on a regular basis (e.g., check regularly and delete timely the personal information of previous employees).

4. 

Third-party information processor must be duly authorised and supervised.
 

If an employer engages a third party (e.g., human resources service providers) to process an employee’s personal information, the employer should carry out risk assessment in advance. The employer has the duty to supervise the third party’s processing of such information and ensure that the processing will not exceed the scope of authorisation.

5. 

Joint processing of personal information can result in joint and several liability.
 

If an employer processes an employee’s personal information jointly with a third party, the employer should agree in writing with the third party the requirements for secure processing of the information, and the respective responsibilities of the employer and the third party. Meanwhile, the employer should inform the employee of the fact of joint processing.

6. 

Specific consent is required for the transfer or disclosure of the personal information.
 

If an employer needs to transfer or disclose to a third party an employee’s personal information, the employer must inform him/her and obtain his/her specific consent.

7. 

Specific consent is required for publicising the personal information.

If an employer needs to publicise an employee’s personal information, the employer must obtain the employee’s specific consent.

8. 

An employee is entitled to withdraw the consent.
 

An employee is entitled to withdraw the consent previously given to the employer for processing his/her personal information, though the withdrawal would not affect the validity of the processing activities previously conducted.

1. 

Administrative liability

2. 

Civil liability

3. 

Criminal liability

1.

Review thoroughly the current internal management of the employees’ personal information
 

The issues for review, among the others, include:-
 

• whether the relevant persons in charge are aware of the new regulatory requirements under PIPL;

• whether there has been an adequate system established for protecting the employees’ personal information;

• whether the internal rules for protecting personal information have been effectively implemented; and

• whether there has been proper supervision over the third-party information processors.

2. 

Assess the risks of cross-border data transfer

PIPL raises additional requirements for cross-border transfer of personal information, which, among the others, includes a separate risk assessment process with the cybersecurity authorities.

3. 

Establish an effective system for protecting employees’ personal information

An employer should establish an effective system for protecting employees’ personal information, supervising the processing of such information and handling complaints from employees, which should all be evidenced in writing in internal rules and regulations.

4. 

Review and revise the relevant legal documents

An employer should review and revise the employment contracts, employees’ handbook, personal information collection statement, internal information protection policies, and the relevant guidance, so as to strengthen the internal compliance with data protection laws.