The Cyberspace Administration of China (CAC) has, for the first time, issued legislation dedicated to protecting child privacy online. The Regulation on Protection of Children's Personal Information Online is due to take effect on 1 October 2019.
The Cyber Security Law (CSL) lays down general principles on data protection in China, but there has not been any dedicated regulation specifically on the protection of children's privacy online until the new regulation. The Personal Information Security Standards (Security Standards) are a set of recommended standards for personal information protection which took effect on 1 May 2018. These expressly require data controllers to treat the personal information of children as sensitive personal information and to obtain express consent from the children's guardians for processing of personal information. The special protection measures applicable to sensitive personal information under the Security Standards will also apply to children's personal information. These required measures including separate consent for each function of a service or product, encryption of data for storage and transmission, request-based internal access authorisation, prior notification and express consent before data sharing or transferring. The model privacy policy attached to the Security Standards also includes a section on processing of children's personal information.
The CAC released the draft new regulation for public consultation on 30 May 2019, the eve of the International Children's Day in China. With the formal version released less than three months later, the CAC is expediting the new regulation through its legislative process. The new regulation has made mandatory some of the data protection measures in the Security Standards and also created a range of measures designated to enhance protection of child privacy.
We have prepared a detailed bulletin setting out the key provisions of the regulation and our observations. These can be accessed in full here.
Despite the many issues to be clarified and questions to be answered, the new regulation marks the first regulatory step towards stepping up protection of children's online privacy in China. Network operators processing personal information of children should prepare themselves for the implementation of the new regulation which will take effect in the coming month.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
