02.09.2021, 18:30
Beware the Long Arm of PIPL
David Smith, a Partner with The Lawyer “Top 100” firm JMW Solicitors, explains why China’s recently introduced data protection legislation matters to the UK and European property sector. JMW Solicitors LLP – one of The Lawyer’s “Top 100” Law Firm
Last month, the People’s Republic of China passed the Personal Information Protection Law (PIPL).
Although the legislation which comes into effect on 1 November 2021 may seem irrelevant to property professionals in Europe, just like the European Union General Data Protection Regulation (GDPR) it has extra-territoriality provisions.
A great many new build developments in the United Kingdom – and, most certainly the largest proportion in Europe, have units that have been sold to individual investors in China. So there are developers and estate and lettings agents who specifically cater to and target the Chinese market.
However, the majority of these developers and agents are not formally established in China and use local agents to attract investors which will soon have to change.
Under PIPL, any agent who is dealing with Chinese residents as part of their business will need to be established in China or have an appropriate data protection representative who is. Failure to comply can result in fines being levied in China or blocking of the right to trade which will likely include blocking of agencies’ online presence in China via the country’s national firewall.
PIPL: Key Takeaways
- PIPL requires processors to obtained informed consent from individuals before collecting or transferring any personal data, and to restrict any data collected to the minimum that is necessary to meet the requirements for which it is being used.
- “Sensitive personal information” including financial accounts, medical records and location data are subject to more stringent controls.
- The cross-border transfer of personal information requires a safety assessment from China’s national cyberspace authority, formal accreditation by an appointed agency or the use of standard form agreements that have been pre-approved by relevant national agencies.
- Individuals are required to opt-in to the transfer of their personal information across borders.
- PIPL is applicable to all information processing activities affecting residents of China, regardless of the location of the data processor if data is being used to support the supply of products or services, or to track behaviour.
