ChinaPersonal Information Protection Law, automated decisions
PIPL Art. 24, Art. 55(2) and Art. 56 (automated decision-making)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Ensure transparency and non-discriminatory treatment in any automated decision made using personal information, and do not use it for unreasonable differential pricing.NIST Privacy FrameworkID.RA-P2NIST Privacy FrameworkCM.PO-P1
- Offer a non-personalized option or a convenient opt-out wherever automated decision-making is used to push marketing or commercial information.NIST Privacy FrameworkCT.PO-P3
- Provide an explanation and honor an individual's refusal of a decision made solely by automated means where that decision has a major effect on their rights.NIST Privacy FrameworkCT.PO-P3
- Complete a personal-information-protection impact assessment before deploying automated decision-making, and keep the assessment report and the processing record for at least three years.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkCT.DM-P8
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- CM.PO-P1Transparency policies, processes, and procedures for communicating data processing purposes, practices, and associated privacy risks are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Log retention
Applies to the impact assessment report and the processing record.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 55 requires a handler to conduct a personal information protection impact assessment before using personal information for automated decision-making and to keep a record of the processing, and Article 56 sets what the assessment covers and requires the assessment report and the processing record to be kept for at least three years. Article 24 requires transparency and fairness and gives the individual a right to an explanation and to refuse a solely automated decision, which names no log. The articles say nothing on who may demand the record; the regulator's inspection power is in Article 63, held on a separate row.
- Kind
- Explicit
- As of
- Provision
- PIPL Arts. 55 and 56
- Trigger
- automated_decisions
- personal_data_processing
What this law does
Article 24's first paragraph requires a personal information processor using personal information for automated decision-making to ensure the decision-making is transparent and its results are fair and impartial, and bars unreasonable differential treatment of individuals in transaction conditions such as price.
Its second paragraph requires a non-personalized option or a convenient way to decline wherever information push or commercial marketing toward an individual is itself carried out by means of automated decision-making. Its third paragraph gives an individual the right to an explanation and the right to refuse a decision made solely through automated decision-making where that decision has a major effect on their rights and interests.
Article 55(2) requires a processor to carry out a personal-information-protection impact assessment in advance, and keep a record of the processing, before using personal information to conduct automated decision-making.
Article 56 requires that assessment to cover whether the purpose and method of the processing are lawful, legitimate and necessary, the impact on individual rights and the security risk, and whether the protective measures taken are lawful, effective and proportionate to the risk, with the assessment report and processing record kept for at least three years.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or sends automated outreach.
Back to the example · Lint your app
Page updated .