The transfer of personal data from the European Union to the People’s Republic of China – the influence on consumer rights of the lack of transparency in data transfers

This paper addresses the issue of personal data transfers from a territory within the European Union to the People’s Republic of China (hereinafter: China). The underling research was designed to assess the privacy policy provisions on data transfer to third countries, particularly China. The analysis covered the privacy policies of selected Chinese entrepreneurs operating in the territory of the European Union, namely Xiaomi, Aliexpress and WeChat. These entities belong to the most popular Chinese businesses present in the European market. The analysis corroborated that ‘contractual clauses’ were most commonly used out of the ‘appropriate safeguards’ covered by Article 46 GDPR. However, what the analyzed privacy policies had in common was the lack of a transparent description of the data transfers they conduct. In particular, the privacy policies did not indicate whether all of the data transfers to third countries, including China, were covered by the same appropriate safeguards. In addition, Xiaomi, Aliexpress, and WeChat did not explain how third-country laws, particularly Chinese laws, would affect the effectiveness of the appropriate safeguards they apply. Thus, the analysis proved that appropriate safeguards do not ensure adequate protection of the rights and freedoms of individuals when their data are transferred to China. Therefore, it is proposed that a data transfer agreement should regulate data transfers from the territory within the European Union to China. Such an agreement should be modelled on the agreements between the European Union and the USA.