China's top legislature has passed a new law on personal data protection, the first in the Chinese mainland solely dedicated to the issue. 

The Personal Information Protection Law stipulates that the processing of personal information shall be carried out legally and with due process. Buying, selling, and revealing other people's personal information without their consent are now illegal.

The hundreds of millions of people in China who enjoy the benefits of digitization may be unaware that their personal information may have been compromised in the course of using online and offline services.

"Not that I know. Maybe I'm used to the situation. All I care about is that the services make my life easier," said Peng Hao, a Beijing resident.

"I bought a shirt online two months ago. One day I received several spam calls. The callers even knew the exact date when I bought it," said a woman surnamed Lin.

"I get spam calls all the time. But I still don't know how my number gets leaked," recalled another resident Zhao Qifei.

One man turned to the legal system for help. Guo Bing, an associate law professor from Zhejiang Sci-Tech University in eastern China's Hangzhou, filed a case against a safari park in 2019 in what was widely considered China's first lawsuit against a party using facial recognition.

He accused the park, which had used fingerprint scans for annual pass holders like him to gain entry, had collected facial information and forced customers to submit to facial recognition. Guo said this was a breach of contract and violated consumers' legal rights.

"The zoo took a photo of me and assumed that I had agreed to the face-scanning system. The logic is just absurd," said the associate professor who received a message requiring him to provide facial information to enter the park.

The court ruled the facial information gathering invalid and ordered the park to delete it. "It's all about evidence at court," said the law expert, chuckling. "Even I found filing such a case difficult, since personal information rights were not enshrined in one specific law but dispersed in different clauses in several laws, including the consumer rights law."

But with the Chinese mainland's first Personal Information Protection Law coming into force in November, along with the existing regulations, ordinary citizens can now ensure that their data remains private.

"The new law is expected to help consumers raise awareness of their rights to the security of their personal data. It will also help them say no to illegal processing of their information," said Guo. He added that even people without legal expertise can report their cases or file complaints through dedicated channels to reach authorities for further inspections.

Guo said that with tougher and clearer regulations coming into effect, companies in this sector will likely exercise more caution and restraint when gathering customer information.