ChinaPersonal Information Protection Law, Anonymization, De-identification and Security Measures
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- none
As of .
What it requires
- Treat information as outside the definition of personal information on the strength of anonymization only if the processing leaves a specific natural person unidentifiable and cannot be reversed (Article 4 and Article 73, item 4).
- Do not treat de-identification as anonymization: information processed so that it cannot identify a specific natural person without additional information is de-identified (Article 73, item 3), and the exclusion in Article 4 is written for anonymized information alone.
- Take the technical security measures Article 51, item 3 names, encryption, de-identification and similar measures, in the form that fits the purpose and method of the processing, the type of personal information, the impact on individuals' rights and interests and the security risks, so as to prevent unauthorized access and the leakage, tampering and loss of personal information (Article 51).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Articles 4, 51 and 73 define personal information, de-identification and anonymization and list the security measures a handler takes: internal management rules and operating procedures, classified management, encryption and de-identification, operating authority and training, and an emergency plan. None of them requires a log, register or record of processing. The records of processing and the impact assessment report are required by Articles 55 and 56, held on a separate row.
- Kind
- None
- As of
What this law does
Article 4 of China's Personal Information Protection Law defines personal information as all kinds of information, recorded electronically or otherwise, relating to an identified or identifiable natural person, and names anonymized information as the category that definition excludes.
Article 73, item 4 defines anonymization as processing personal information so that a specific natural person cannot be identified and the information cannot be restored, and item 3 defines de-identification as processing personal information so that it cannot identify a specific natural person without the aid of additional information.
The Law's text gives de-identified information no exclusion from the definition of personal information, and Article 51, item 3 lists encryption, de-identification and similar technical security measures among the measures a personal information handler takes, according to the purpose and method of the processing, the type of personal information, the impact on individuals' rights and interests and the security risks, to prevent unauthorized access and the leakage, tampering and loss of personal information.
When LexLint raises it
When your app profile says your app processes personal data.