Personal Information Protection Law of the People's Republic of China (PIPL)

Personal Information Protection Law of the People's Republic of China (PIPL)

Personal Information Protection Law of the People's Republic of China (PIPL) 

What is it?

China's PIPL became law in November of 2021. Like the GDPR, the PIPL is designed to help Chinese citizens control what happens to their personal and sensitive information. It gives citizens more power to decide how much data companies can access, and who those companies share that information with.

To view the law yourself, you can find a translated version of the PIPL over at the DigiChina Project from Stanford University.

Does Meetingmax Comply? 

Yes. Our GDPR practices also make us compliant with PIPL based on the following reasons:

  1. MMX has a lawful basis for processing personal data
    1. Individual consents (via checkbox*)
    2. Contract can’t be performed without the data 
  1. MMX uses checkboxes to secure PIPL compliant consent 
  2. MMX does not process any sensitive data so there is no requirement for additional consent. If we ever do collect sensitive data (defined below) then we need to secure consent from the attendee a second time. Sensitive data is defined as:
    1. Racial
    2. Political
    3. Sexual
    4. Health Data
    5. Financial account information
    6. Biometrics characteristics
    7. “any information which may cause material harm to an individual if it's leaked or illegally used”
  1. Under the PIPL, citizens have the right to:
    1. Know your data policies (MMX privacy policy & TOS listed on FER)
    2. Withdraw consent to data processing (attendee can opt not to make a reservation)
    3. Non-discrimination if they withdraw consent
    4. Make decisions regarding their data
    5. Request copies of their data (yes, through our privacy policy)
    6. Refuse automated profiling
    7. Amend their data
    8. Delete their data
  1. PIPL Obligations:
    1. Provide a Privacy Policy
    2. Get consent to sensitive data processing (N/A - see above)
    3. Help people exercise their privacy rights
    4. Comply with any relevant authorities
    5. Complete regular compliance audits
    6. Protect data and train staff in cybersecurity

Resources: