China set to pass one of the world’s strictest data-privacy laws

China’s top legislative body is expected this week to pass a privacy law that resembles the world’s most robust framework for online privacy protections, Europe’s General Data Protection Regulation. But unlike European governments, which themselves face more public pressure over data collection, Beijing is expected to maintain broad access to data under the new Personal Information Protection Law.

The national privacy law, China’s first, is being reviewed as frustration grows within the government, and in Chinese society at large, over online fraud, data theft and data collection by Chinese technology giants. The law is on its third round of reviews, usually the last before passage.

The law will require any organization or individual handling Chinese citizens’ personal data to minimize data collection and to obtain prior consent, according to the latest published draft. It covers government agencies, though lawyers and policy analysts say enforcement is likely to be tighter on the private sector.

While privacy in Europe and the U.S. is generally understood to mean protection from both private companies and the government, in China the government has aligned itself with consumers to fight data theft and privacy infringement, says Kendra Schaefer, a partner at Beijing-based consulting firm Trivium China.

“When the government makes laws about privacy, it’s not necessarily restricting its own access," she said.

The new draft law is a positive development in the eyes of Chinese citizens like Wu Shengwei, a lawyer who sued a Chinese video-streaming company last year after it revealed his personal movie-watching history during a separate lawsuit over membership fees.

Such tech giants “believe they can do whatever they want with user information," Mr. Wu said in an interview. “This kind of thinking is very serious, very wrong."

Over the past year, Chinese regulators have reined in the tech sector on several fronts, from antitrust to data security. The privacy law is expected to be a key component of the new landscape for tech companies that had previously enjoyed largely unfettered access to user data. It will unify a hodgepodge of rules, making punishment easier.

“For China’s technology firms, the era of free data collection and usage in China—as in, free of responsibilities and at no cost—is over," said Winston Ma, an adjunct professor at New York University’s School of Law, adding that the new law, combined with other regulations, will slow tech companies’ “unencumbered growth."

The Chinese public has increasingly called for a tightening of data collection. For years, loose rules on accessing data, combined with pervasive government surveillance, led some internet users to describe their online activity as “running naked."

In 2018, Robin Li, the chief executive officer of Chinese search giant Baidu Inc., framed the issue bluntly when he told audience members at a high-level forum that Chinese people in many situations were willing to “trade privacy for convenience, safety or efficiency."

The comments sparked controversy at the time, and public awareness has only grown since then, say lawyers in China. Mr. Li has since said that Baidu uses only personal data that users agree to provide.

In urban residential compounds around the country, where cameras equipped with facial-recognition technology have proliferated to verify residents and visitors, complaints from tenants have spurred local governments to take action against property managers, such as banning the collection of biometric data without consent. Last month, China’s highest court instructed managers to offer alternatives for residents who don’t want to submit to facial recognition.

Others have taken companies to court. In 2019, Chinese law professor Guo Bing mounted what was widely seen as the first legal challenge against facial-recognition technology, suing a local zoo for requiring members to register their faces as part of a new entrance system.

Last November, the judge ordered the zoo to compensate Mr. Guo the equivalent of $160 for “the loss of contractual benefits and transportation costs." The yearly membership had cost about $210.

Occasionally authorities are the target of privacy complaints. In the spring, a mobile application developed by a bureau within China’s Ministry of Public Security to combat online fraud by screening calls and messages incited a backlash for collecting data that included identification numbers and home addresses.

In the southern city of Shenzhen, some residents took to China’s Twitter-like Weibo platform to complain that schools were pushing students and parents to register for the app, and vaccination centers in two districts told The Wall Street Journal by phone that they had been visited by police officers to ensure people downloaded the app before getting their shots.

If app data is leaked, one user wrote in a review on China’s Apple App Store, “I can only get plastic surgery, change my name, change my phone, and get a fake ID."

The new draft law bars government organizations from collecting data beyond what is needed to perform “legally prescribed duties." But that is unlikely to affect police surveillance and tracking, said Jeremy Daum, a senior fellow at the Yale Law School Paul Tsai China Center. China’s new law, like its European counterpart, doesn’t explicitly mention police use.

“The theory is that the government is there to protect your rights, so it can be trusted not to violate them—it will only use your data as necessary for public safety," said Mr. Daum. Whether or not there are meaningful checks on that is another matter, he added.

Public safety is a vague and expansive notion in China, affording the government broad powers to monitor citizens. In the northwest Xinjiang region, where a network of internment camps and prisons has been built to subdue local ethnic minorities, surveillance cameras are ubiquitous. An ID swipe and facial scan are needed just to gas up a car.

The trade-off remains palatable to many citizens.

Deng Yufeng, a Beijing artist who mapped security cameras in the capital last November to highlight their ubiquity, said he could see where Baidu’s CEO was coming from when he implied that Chinese people cared less about privacy that security and convenience. Indeed, on a personal level, he said, surveillance cameras make him feel safer.

“Perhaps, on this Earth, we are willing to sacrifice some of our privacy for safety," said the artist. “But that is only my personal opinion…I don’t represent the Chinese people."

This story has been published from a wire agency feed without modifications to the text