Personal data protection in China: Progress, challenges and prospects in the age of big data and AI

In the big data and AI era, personal data protection is legally and academically challenging. Although China has made great progress in this regard by issuing a range of laws and sector-specific regulations, as well as bringing public interest litigation to safeguard personal data, challenges persist. However, there are few systematic studies on the progress and challenges in protecting personal data under the rule of law in China. In order to fill this gap, this article examine the evolution of personal data protection in the context of big data and AI in China, focusing on its constitutional foundations, legal improvements, and judicial applications and identify the unresolved challenges of personal data protection. Based on these, protection methods related to personal data are further proposed and discussed, such as refining the informed consent rule, bolstering personal data and risk governance via grading, contextual and privacy impact assessments mechanisms, and optimizing the Data Protection Authority system by establishing consultation and independent oversight bodies. By adapting these strategies to the unique conditions in China, this article proposes a holistic approach to better balance among personal data protection, security, and economic development. The findings of this article also hold value for developing countries seeking to align personal data governance with global standards, thereby contributing to a more robust international data protection system. • Identifies five key advancements China has made in personal data protection. • Analyzes persistent challenges in informed consent, monitoring, and remedy mechanisms. • Proposes enhancing informed consent through standardized contractual rules and dynamic consent. • Recommends a dual-faceted monitoring reform: graded and context-specific personal data governance and proactive risk governance. • Advocates institutional reforms in remedy mechanisms through CAC consultation bodies and independent monitoring of governmental data processing.