PIP Law: Its Impact on the Cross-Border Internal Investigation

The New PRC Personal Information Protection Law (the “PIP Law”) will take effect as of November 1, 2021. In general, the PIP Law provides more favorable protection on personal information and brings greater challenges to the cross-border transfer of personal information. This article will discuss the scenarios where potential cross-border transfer of personal information may occur in an internal investigation, the new challenges brought by the PIP Law, and the suggestions to mitigate compliance risks.

Under the PRC Civil Code and the PRC Cyber Security Law, the criterion for determination of personal information is whether the information may, by itself or accompanied by other information, identify a particular natural person; however, the PIP Law expands the scope to include the information relating to an identified or identifiable person, which is substantially identical to the GDPR.   

The PIP Law requires the processer to inform the individual: among others, name and contact information of the overseas recipient, purpose of processing, manner of processing, and types of the personal information to be processed. Furthermore, a separate consent on a cross-border transfer should be obtained rather than a general consent on all processing activities. Potential barriers associated with the informed consent might include, for instance, the individual is entitled to a withdrawal of the consent and the processer should delete the personal information accordingly, and a renewed consent is required if any of the informed elements changes.

Exemptions from an informed consent exist under particular scenarios, for instance, where the processing of personal information is necessary for the implementation of HR management in accordance with duly formulated labor rules and regulations, or where the processer processes the information already in the public domain (provided that the processing shall not be beyond the reasonable scope and does not have a material impact on the rights and interests of the individual). But each exemption might have its own limitation and might not fit well for the cross-border transfer of personal information in internal investigations.

As a dual requirement with the informed consent, security assessment or alternate protection requirements are required. 

For Critical Information Infrastructure Operators (“CIIO”) or processers holding a large volume of personal information, a security assessment by the authority is a prerequisite before cross-border transfer of personal information. For other processers, it is necessary to pass personal information protection certification, enter into standard contracts or meet other requirements. But none of these alternate requirements is clear so far.  

Under the PIP Law, a separate impact appraisal should be conducted by the processer regarding, among others, the appropriateness of the transfer, the impact and risk on the individuals, and the protection measures by the processer and the overseas recipient.

Prior approval must be obtained from the PRC competent authorities before transfer of personal information to foreign law enforcement or judicial authorities.

To anonymize personal information is theoretically effective to avoid all the burdens above as anonymized information is not personal information. However, it may be impractical to secure 100% anonymization unless we accept the consequence that a document after redaction may become meaningless as evidence.  

Whether the access to and processing of the personal information already transferred overseas will be regarded as a fresh transfer.  Whether the access from overseas or by a foreigner in China to personal information will be regarded as a transfer.

• Formulate internal management system and legitimate operating procedures for personal information identification and processing activities (including cross-border transfer);

• Lawfully collect and use personal information for the purpose of investigation. Be aware of due process in case of any dispute;

• Obtain separate consent of employees for the cross-border transfer of their personal information in an internal investigation (such as, a separate transfer acknowledgment, a special provision in a document hold notice, a particular notice before an employee interview, etc.);

• Carry out a security assessment, or satisfy its alternate requirement, and conduct an impact appraisal;

• Obtain approval of the competent authorities before submitting personal information to overseas authorities;

• De-identify or anonymize the personal information to be transferred as much as possible;

• Consider the possibility of conducting and completing internal investigations domestically.

责任编辑：单珊

编辑：刘清