ChinaPersonal Information Protection Law, Arts. 13(6) and 27 (processing already-public personal information)
Personal Information Protection Law of the People's Republic of China, Arts. 13(6), 27
In force since .
A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Confine processing of personal information someone has already made public to a reasonable scope tied to your stated purpose.NIST AI RMFMAP 1.6
- Stop processing an individual's already-public personal information once they expressly decline, even though no prior consent was required.NIST AI RMFMANAGE 4.1
- Obtain separate consent before any use of already-public personal information that would have a significant impact on the individual, including most AI-training uses.NIST AI RMFMAP 1.6
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What is a 合理的范围 ("reasonable scope") for processing already-public personal information that a handler collects by automated means?
- Which processing has a 对个人权益有重大影响 ("significant impact on individual rights and interests") so that consent is required under Article 27?
- How can an individual 明确拒绝 ("expressly decline") processing by a handler the individual cannot identify?
What it makes you log
Logging duty
Articles 13(6) and 27 permit processing of already-public personal information within a reasonable scope, subject to the individual's express refusal and to consent where the impact is major. Neither imposes a duty to create, keep, produce or review a log or record. The Law's record and audit provisions (Article 54 compliance audits, Article 55 and 56 impact assessments and their records kept at least three years) sit in articles this row does not cite and are not read into it. The cited articles carry no territorial test (the extraterritorial scope is in Article 3), so the hook is empty.
- Kind
- None
- As of
What this law does
Article 27 permits a personal information handler to process, within a reasonable scope, personal information an individual has disclosed themselves or that is otherwise lawfully public, unless the individual has expressly declined; processing that has a significant impact on the individual still needs separate consent.
Article 13(6) states the same ground as a general lawful basis for processing, functioning as China's analog to General Data Protection Regulation (GDPR) Art. 6(1)(f), with its own reasonable-scope ceiling and opt-out rather than a legitimate-interest balancing test. The 2023 Generative AI Interim Measures additionally require a lawful source for AI training data, which for personal information means satisfying this Article 27 basis; those Measures do not name robots.txt as part of that requirement.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .