The draft of the personal information protection law was submitted to the Standing Committee of the 13th National People's Congress (NPC) for first review on Tuesday.

Comprising eight chapters and 70 articles, the draft covers a broad range of areas surrounding personal information.

It lays down rules for processing as well as cross-border transfer of personal information. In addition, it clearly states the rights of individuals and the obligations of those involved in personal information processing, besides defining the duties of the department involved in personal information protection.

The draft addresses issues like random information collection, illegal acquisition, excessive use, illegal trading of personal information and the use of personal information to endanger the property and lives of the people.

As of March 2020, Chinese internet users had reached 900 million, with more than four million internet websites, and more than three million applications, according to official statistics.

Separate consent for sensitive information

One salient feature of this draft is that it requires the information processor to obtain a separate consent when it comes to processing sensitive information.

Per the draft, sensitive personal information is the one whose misuse may lead to discrimination or serious harm to the life and property of the individual involved. Such information may pertain to race, ethnicity, religious belief, biological traits, medical records, financial accounts and personal whereabouts. Therefore, the draft obligates the information processor to process such information only when absolutely necessary.

Processing rules centered on "informed consent"

The draft defines personal information as information of identified or identifiable natural persons recorded electronically or in other ways. And the processing of personal information includes the collection, storage, use, processing, transmission, provision, and disclosure of personal information.

The draft establishes a series of personal information processing rules with the idea of seeking "informed consent" at the core. It means that individual consent must be secured with full notice in advance before the processing of personal information. At the same time, the individual shall have the right to withdraw consent.

Moreover, it says that users can require platforms not to push personalized advertisements to them.

Fines up to 50 million yuan ($7.44 million)

Violations can result in fines up to 50 million yuan or up to 5 percent of the preceding year's turnover if the violator is a commercial entity.

Depending upon the seriousness of the violation, the authorities can also order suspension of business activity, revocation of business licenses and personal fines ranging between 100,000 yuan and 1 million yuan.

Information disclosure and remedial obligations

The draft is in line with the relevant provisions of the Chinese Civil Code. It provides stipulations for ensuring that personal information processors ensure compliance and fulfill their security obligations.

It also requires them to develop internal management systems, adopt corresponding technical measures for security, and designate personnel to supervise information processing.

Expert voice

Commenting on the draft law during a media interview, Zhu Wei, deputy director of the Communication Law Research Center in China University of Political Science and Law, said that it was an important extension of the personal information and privacy rights enshrined in the Chinese Civil Code.

"It is actually an extension of the individual rights of citizens," he said.

Highlighting how personal information can easily be misused and even bought and sold in this era, Zhu said, "The right to peace and tranquility is the core of privacy and personal information protection, and it is also an issue that people are most concerned about. Under what circumstances users' big data can be used for commercial purposes needs to be clarified.”

Meanwhile, Xu Shenjian, a professor at the China University of Political Science and Law, said the law protected personal rights between companies and individuals. He termed the level of punishment as one of the highlights of the draft.

"The draft can be regarded as a 'responsive legislation' that responds to the needs of the public in a timely manner in the current information society," he said.