In this webinar (1 hour), Daniel Solove, Justin Antonipillai (CEO and Founder of WireWheel), Mingli Shi (Qualcomm), and Edward R. McNicholas (Ropes & Gray) discuss China’s Personal Information Privacy Law (PIPL). The discussion covers how China’s PIPL compares to the EU’s GDPR, keys to compliance, and potential future developments on privacy and security law in China.
In his book, Ari delivers an eviscerating critique of privacy law and of the approach to protect privacy through internal privacy programs at organizations. Although I diverge from Ari in that I believe that that many privacy law provisions and privacy programs are generally a good thing, his critique makes many salient points that must be reckoned with. Privacy law and compliance have significant shortcomings that should be addressed.
This cartoon is about implantable devices and privacy. Increasingly devices require subscriptions, and there is tremendous lock in, as the devices can only work with a particular company’s services. Implantable devices up the ante – a person could be locked in for life. The law must address lock in with more than data portability. When there are compelling reasons, such as devices that cannot readily be replaced, the law should require companies to allow other companies to supply necessary services to keep devices functioning.
How does China’s new Personal Information Protection Law (PIPL) compare to the European Union’s GDPR? In this post, I provide a quick PIPL vs. GDPR comparison. In comparing the PIPL with the GDPR, I will note a few key similarities and differences — my comparison is not comprehensive.
Comparing PIPL and GDPR: Similarities
A few notable similarities between the PIPL and GDPR include:
Both the PIPL and GDPR are extraterritorial.
The PIPL and GDPR define personal data as involving identified and identifiable natural persons.
The PIPL uses the GDPR’s lawful basis approach to data processing. Many other Asian privacy laws use the consent-based approach or an approach akin to the US approach of notice-and-choice.
Both the PIPL and GDPR have special protections for sensitive data, but they differ on the types of data they recognize as sensitive.
Both the PIPL and GDPR have a data breach notification requirement.
The PIPL and GDPR recognize many of the same rights.
Both the PIPL and GDPR require workforce training.
Under certain circumstances, both the PIPL and GDPR require DPOs.
Both the PIPL and GDPR require data protection impact assessments (DPIAs) in certain situations.
Comparing PIPL and GDPR: Differences
A few notable differences between the PIPL and GDPR include:
I am pleased to announce that I created a new whiteboard and training course for China’s Personal Information Protection Law (PIPL).
The PIPL is China’s first comprehensive privacy law, and it has several notable similarities to the GDPR. There are also some key differences. In an earlier post, I provide a comparison between the PIPL and GDPR.
We reordered the piece to discuss earlier on our theory of when harm should be required.
We added a discussion of why recognizing privacy harm is important.
We rethought the typology to add top-level categories and subcategories. We had received feedback from a number of people that the typology was unwieldy because we had too many categories and many seemed to overlap. Our new structure now has 7 top-level categories.
We added short descriptions of each type of harm at the beginning of each section.
We added commentary about the recent Supreme Court case on standing, TransUnion v. Ramirez.
We added a diagram of the harms, which is above.
There are other changes, too, but the ones above are the most relevant ones. We’re still editing the piece, so we welcome additional feedback. The piece will be published in 2022.
This cartoon is about profiling. A profile consists of a particular set of characteristics and behaviors that are deemed as suspicious by law enforcement. Profiles can be created by people or generated by algorithms that identify suspicious things from data of known criminals or terrorists.
Oscar Gandy is an emeritus professor with the Annenberg School for Communication at the University of Pennsylvania, having retired from active teaching in 2006. He has continued to publish in the areas of the political economy of communication and information, focusing most recently on the development and use of algorithmic technology.