top of page

XL INSIGHTS+
Legal Alerts and News Updates

First Cross-Border Data Transfer Decision in China

  • On August 9, 2024, the Guangzhou Internet Court published an opinion in the first cross-border data transfer case in China.

  • The case established the following with respect to the Personal Information Protection Law (“PIPL”): the exercise of PIPL rights other than rights to be informed and make decisions must be first addressed to the handler; agreeing to the handler’s personal information protection policy does not constitute separate consent for purposes of specific personal information handling; the scope of recipients must be defined and is necessary for the performance of the contract if the cross-border transfer relies on contractual necessity; and transfer for commercial marketing purposes does not meet the contractual necessity exemption and still requires consent.

 

In August 2024, the Guangzhou Internet Court (“Court”) published the first judgment in a Chinese cross-border data transfer case that was concluded in September 2023. The plaintiff, a Chinese individual, purchased accommodation services from a French corporation through the company’s WeChat public account, which was operated by the French corporation’s PRC entity. Specifically, the plaintiff booked a Myanmar hotel using the French corporation's mobile app. During the booking process, the Plaintiff clicked on the checkbox to indicate consent to the French corporation's Customer Personal Data Protection Charter (“Charter”) and provided the requested personal information including the plaintiff’s name, nationality, telephone number, e-mail address and bank card number. Afterwards, the plaintiff found out that the personal information the plaintiff had submitted would be transferred and shared with multiple regions and recipients around the world in accordance with the Charter. Based on the plaintiff’s belief that the French corporation and its PRC entity’s cross-border handling of the plaintiff’s personal information violated the PIPL, the plaintiff filed a lawsuit with the Guangzhou Internet Court against the French Corporation and its PRC entity (collectively “defendants”).

 

The Court held that the defendants collected the personal information for the purpose of booking overseas hotel services for consumers, and the transfer of personal information was necessary for the performance of the contract, which did not require separate consent. However, based on its review of the Charter, the Court found that the defendants failed to comply with the principles of openness and transparency that undergird the PRC’s Personal Information Protection Law (“PIPL”) by failing to inform the plaintiff of its personal information handling rules in a truthful, accurate and complete manner in accordance with PIPL. The Court also found that the defendants, for commercial marketing purposes, transferred the plaintiff’s personal information to a third party located in the United States and Ireland. Such transfer of personal information was not necessary for the performance of the contract with the plaintiff, the Court stated, and the defendants did not adequately inform the plaintiff and obtain separate consent for the additional handling purpose (i.e., commercial marketing). Finally, the Court ordered the defendants to delete the plaintiff’s personal information and compensate the plaintiff RMB 20,000 (approx. USD 2,807).

 

Implications for U.S. Institutions

The analysis of the legality of cross-border data transfer in this case was based primarily on the PIPL. Key takeaways include the following:

 

  • The data subject may exercise their rights to be informed and make decisions under the PIPL through the court at any time; however, the data subject may only enforce other PIPL rights (i.e., rights to consult and copy, transfer, correct, supplement, and delete) in a court if the personal information handler has already failed to fulfill the data subject’s rights.

  • PIPL Article 17 requires the personal information handler to truthfully, accurately and fully inform the data subject of relevant matters in an easy-to-notice manner and in clear and easy-to understand language. The court ruled that, for certain circumstances requiring separate consent (including the handling of sensitive personal information, the cross-border transfer of personal information, and the provision of personal information to another handler), an “enhanced” (i.e., separate) notice and consent are required. In other words, a generally worded privacy policy and a simple click-through acknowledgement are not sufficient for PIPL compliance purposes. Clicking or checking a box to indicate agreement with the handler’s personal information protection policy does not constitute separate consent for the purpose of specific personal information handling, the Court emphasized.

  • If the legal basis for cross-border data transfer is contractual necessity, the personal information handler must ensure that the list of recipients is defined and necessary for the performance of the contract.

  • The transfer of personal information for commercial marketing purposes does not meet the contractual necessity exemption and still requires consent from the data subject. For cross-border data transfer for commercial marketing purposes, a separate consent is required.


The central tenet of the PIPL is the requirement to obtain informed consent from individuals before handling or transferring their personal information. The Court’s opinion provides helpful guidance to U.S. institutions whose educational activities in China require coordinating with Chinese entities to ensure that any cross-border transfer of personal information complies with this tenet. Of course, institutions should also continue to monitor Chinese laws and regulations and other judicial decisions related to cross-border data transfer. We note that, under China’s legal system, the Court’s opinion in this case is not binding; rather, it is one court’s interpretation and can be helpful in construing and applying the law.




 

© 2024 XL Law & Consulting P.A. - A U.S. Corporation - Privacy Policy - Cookies Policy - Contact Us

 - 

The information provided on the XL Law & Consulting website is for educational purposes only. Nothing on this website should be construed as or relied upon as legal or other professional advice, nor does use of this website create an attorney-client relationship.

bottom of page