Regulation Practice and Prospect of Privacy Protection of Data Flows in China

Privacy protection is a fundamental guarantee for secure data flows and serve as a basic requirement for data security. A reasonable privacy protection system acts as a catalyst for unlocking the financial value of data. The current legislative framework for privacy protection in data flows in China, adhering to the principle of proportionality, establishes the “informed-consent” rule for data collection and processing, data classification and grading management measures, and remedies for data leakage and other risks. In addition, in judicial practice, typical disputes regarding personal information protection and privacy rights have promoted to clarify the scope of collecting user personal information and biometric data. Despite ongoing improvements needed in legislative, judicial and technical approaches to data privacy protection, China’s commitment and practice in privacy protection of data flows are noteworthy. The existing legislation, law enforcement and technical practices are playing an increasingly vital role in realizing the financial value of data and are essential for international cooperation on data privacy protection. Furthermore, it is crucial to actively explore cooperation mechanism for cross-border data flows under the principle of data sovereignty, participate in developing international rules for cross-border data flows, and formulate different management norms for cross-border circulation of data in different industries.