The Chinese Ministry of Industry and Information Technology (MIIT) has set out a non-binding guideline that states that, as of 1 February, sensitive personal data collection and processing in China should only be conducted with individuals' prior permission, a report by Xinhua said.
The guideline differentiates between what information should be classed as 'sensitive' personal data and 'general' personal data. Sensitive information refers to such personal information which would result in negative implications on the data subject in the event of disclosure. Under the guideline, sensitive information should only be collected upon the express consent of the data subject, while the general personal information can be collected and processed as long as individuals show "no objection" to the activity, according to the news agency.
Organisations collecting personal data should have "specific and clear purposes" for doing so and must have good reason to want to process the information, it said. The organisations must delete the personal data they store once they have used it for the purposes for which it was collected, the guideline states, according to Xinhua. In addition, businesses should not collect any more personal data than they require in order to meet the purpose for that collection, it said. To transfer data outside PRC, express consent from the data subject is required.
Late last month the Chinese Government also established new rules that require citizens to provide their real names to service providers when using the internet. The service providers are required, under the terms of the rules, to immediately cease providing services to individuals if it is spotted that they have failed to provide their real names, according to another report by Xinhua.
"The decision aims to ensure internet information security, safeguard the lawful rights and interests of citizens, legal entities or other organizations and safeguard national security and social public interest," Wu Bangguo, chairman of the standing committee of the National People’s Congress, said in a statement, according to the Xinhua report.
The December 'decision' also created the offence of sending commercial digital information to fixed-line phones, mobile devices or personal email addresses without having the consent to do so, according to the news agency's report.