... Protecting personal information is vital to safeguard individuals’ privacy, prevent identity theft, and ensure trust in digital interactions and services. In 1980, the Organization for Economic Cooperation and Development (OECD) issued guidelines on the protection of privacy and cross-border data flows, establishing foundational principles for data protection.1 In 1995, the European Union (EU) enacted the Data Protection Directive, harmonizing data protection laws across Member States and paving the way for comprehensive regulations.2 In 2016, the EU adopted the General Data Protection Regulation (GDPR), which, unlike a directive, is directly applicable and enforceable across all Member States without needing national transposition.3 As an example of the ‘Brussels effect’, the GDPR has become a model for data protection laws worldwide.4 Compared to Western societies, the protection of personal information in China received legislative protection relatively late. The earliest can be traced back to the Decision of the Standing Committee of the National People’s Congress on Strengthening Internet Information Protection in 2012.5 The Decision introduced a system of personal data protection inspired by international practices but implemented in a manner that allows for decentralized legislative development.6 In 2016, China established the Cybersecurity Law,7 marking the country’s first legislation to establish overall requirements for the protection of personal information. It stated that network operators must follow the principles of legality, legitimacy, and necessity when collecting and using personal information, and it also specified the rights of citizens regarding the deletion and correction of personal information. In 2020, China enacted the Civil Code,8 elevating the significance of personal information protection within the domain of civil law. Consequently, the regulation of personal information shifted gradually from decentralized legislation and lower-level industry standards to systematic legislative protection, affirming the independent status of personal information in civil law. Building on earlier regulations and legislation, as well as international precedents like the GDPR, China enacted the PIPL in 2021.9 This law is considered the cornerstone of personal information protection in the country.10
No takes yet. Share an insight, caveat, or question.
Shao et al. (2025) studied this question.