China's New Personal Information Protection Law (PIPL): Implications for Companies and Human Resources Management

Abstract

This thesis examines China’s new Personal Information Protection Law, which was promulgated in August 20, 2021 and entered into force on November 1, 2021. This law, together with the Cybersecurity Law and the Data Security Law, is the result of the reform achievements and practices in China’s data protection regime and its main goal is to protect Chinese citizens’ privacy and personal information. The PIPL is considered the Chinese equivalent of European Union GDPR, as these two regulations have several similarities. Among them, they both have a huge impact on how both domestic and foreign companies manage their business operations and how they process individuals’ personal information. This thesis starts with an introduction to the law, which includes the historical and regulatory context, the evolution of the law and its key points. The introduction is followed by an analysis of the law’s main impacts on companies, including enterprises’ obligations, as well as the sanctions for the violation of the law. In addition, the main impacts on domestic companies and FIEs are examined, and an in-depth analysis on the Didi Chuxing 滴滴出行 case is provided. The analysis of the law’s impacts on companies ends with a focus on the areas of digital marketing and online advertising. The final part of this thesis examines the PIPL’s impacts on enterprises’ human resource management, which include how employees’ sensitive personal information is handled, how and under which circumstances employees’ data can be transferred overseas, and how employees’ consent affects the way companies process individuals’ personal data.