China's new Civil Code will require internet service providers and online businesses to drastically improve the protection of personal information, even as more of the 1.4 billion people in the country become more digitized, with increased susceptibility to leaks and other cyber crimes.

Businesses will now need to pay closer attention to the protection of personal information or risk being penalized by law, said Kong Qingjiang, dean of the school of international law at the China University of Political Science and Law. 

The code, which will officially come into force by 2021, has for the first time enshrined the right to the protection of personal information and merged existing laws on consumer rights and cybersecurity to expand protection of personal and private data in China, and is even regarded among the world's best, said Kong.

"After the code comes into force, businesses like online operators or ISPs (internet service providers) will need to pay closer attention to the protection of personal information, such as the signing of virtual contracts or the disposal of virtual assets," he said. 

With the rise of the internet has come online infringement, which includes a host of potential violations such as the sale of counterfeit products and the theft of trademarks, company brands and personal information. 

Regulating online behavior has become a challenge for lawmakers around the world. China's new Civil Code, which comes into force at the start of next year, provides more detailed provisions concerning internet infringement.

Back in May, China's top legislature passed the country's first landmark civil code, the first in Chinese history that systematically integrated all of the country's private law norms as well as new provisions, which included those on personality and privacy rights.

The code for the first time stipulated the principles of privacy and protection of personal information, defines the concept of personal information, sets out the legal basis for processing personal information, regulates the obligations of personal information processors, natural persons' rights to their personal information and duties of administrative organs.  

"The civil code also has laid down the principles of protection of personal information, such strong protection of personal information as accorded by the civil code, can only be found in a few countries like European countries," said Kong, referring to Europe's General Data Protection Regulation (GDPR).

Kong said that the GDPR leads the world in terms of the scale of protection and standard of protection, and China's own laws are in line with its "style."

Kong summarized several instances of data protection covered by the code:  

— Businesses shall obtain the consent of an individual or his guardian before processing personal information.

— Businesses shall keep confidential and unaltered the personal information they have collected.

— Businesses must not provide personal information illegally to a third party.

— Businesses shall take technological or other necessary measures to ensure the security of personal information.

"If they fail to do so, they will be held liable for infringement on personal information, such as stopping further infringement, paying damages, offering an apology or being subject to revocation of business, or even subject to criminal liability," explained Kong.

He said that the Civil Code's provisions give a broad definition of personal information, which translates into stronger protection.

"The code extends protection to a wide range of personal and public data, such as a person's name, date of birth, ID number, biometric information, address, telephone number, email address, health information and location," he said.

Professor Long Jun from the school of law at Tsinghua University said that the new civil code will be an improvement upon current laws, which puts higher responsibilities of regulating online data in the hands of internet service providers.

"The current law has its advantage to prevent internet service providers avoiding liability on the grounds of technical neutrality, but it also leads to problems such as some ISPs replacing the function of judicial adjudication," said Long.

"In today's society, there are many forms of online infringement, and there are a large number of infringement cases. The judgment is very complex, even to the court, which also needs very in-depth consideration to make a decision. These cases should certainly not be decided by ISPs," he added. 

(CGTN's Ning Hong contributed to this story.)