Practice and Prospect of Regulating Personal Data Protection in China

Privacy protection is a fundamental guarantee for secure data flows and the basic requirement for data security. A reasonable privacy protection system acts as a catalyst for unlocking the financial value of data. The current legislative framework for personal data protection in China, adhering to the principle of proportionality, establishes critical measures such as informed consent for data collection and processing, data classification and grading management, and remedies for data leakage and other risks. In addition, in judicial practice, typical disputes regarding personal information protection and privacy rights have been promoted to clarify the scope for collecting users’ personal information and biometric data. Although further improvements are needed in legislative, judicial, and technical approaches, China’s commitment and practice in personal data protection are noteworthy. The existing legislation, law enforcement, and technical practices play an increasingly vital role in realizing the financial value of data and are essential for international cooperation on privacy protection. Furthermore, it is crucial to actively explore cooperation mechanisms for cross-border data flows under the principle of data sovereignty, participate in developing international rules for cross-border data flows, and formulate different management norms for cross-border data flows across different industries.