Data Collection and Processing in China: Personal Financial Information (Part 3)

* This article is reproduced from Practical Law with the permission of the publishers.

China's financial sector is undergoing a digital transformation and financial institutions are processing large amounts of personal financial information (PFI) in their daily operations. The PFI processing should comply with the following three levels of rules and national standards:

General rules on data protection, including:

• the Data Security Law of the PRC 2021;
• the Cybersecurity Law of the PRC 2016 (with effect from 1 June 2017); and
• the PI Protection Law of the PRC 2021 (2021 PIPL).

General rules on financial data protection. For example:

• the Measures for the Administration of Client Identification and Retention of Client Identification Data and the Transaction Records 2007 (2007 Client Data Retention Measures); and
• the Personal Financial Information Protection Technical Specification (JR/T 0171-2020) (2020 PFI Specification).

Special requirements for specific financial institutions. For example:

• the Guidelines on Classification and Hierarchy of Securities and Futures Data (JR/T 0158-2018); and
• the Guidelines on Data Governance for Banking Financial Institutions 2018 (2018 Banking Finance Data Governance Guidelines).

In order to provide an overview of the regulatory framework governing PFI processing activities in China, we prepared this three-part article covering the following topics:

• Basic Introduction of PFI: PFI and SPI, PFI Collection and Processing, Legal Basis for Processing
• PFI Processing Activities: PFI Storage, Third Party Processing, PFI Cross-Border Transfer
• Data Security Management: Rights of Individuals, Accountability, Legal Enforcement

Below is the third part of the series. Read the first part in this series here and the second part here.

Rights of Individuals

Right to Be Informed

Individuals have the right to be informed of the processing of their PI (Article 44, 2021 PIPL).

Specific to the financial sectors:

• Credit institutions. Individuals can check their information with credit bureaus (Article 2, Notice on Further Reduction of Service Charges of the Credit Reference Centre of the People's Bank of China 2019).
• Card issuers. They should provide to cardholders: 
  • free enquiry services on the list of special merchants, the balance of funds in the card, and transaction details within one year; and 
  • at least one 24-hour free enquiry channel. 
    (Article 34(2), Measures for the Administration of Prepaid Card Business of Payment Institutions 2012.)

Any organisation or individual has the right to lodge a complaint or report on unlawful PI processing activities with the department responsible for the protection of PI. The department receiving the complaint or report should handle it promptly in accordance with the law and inform the complainant or reporter of the results of the handling. (Article 65, 2021 PIPL.)

Specific to the business of credit institutions, if a data subject believes that a credit institution or an information provider or information user has infringed on their lawful rights and interests, the data subject may file a complaint with an agency dispatched by the State Council's supervisory and regulatory authority. The agency that receives the complaint should carry out timely verification and processing and reply to the complainant in writing within 30 days from the date of acceptance. (Article 26, 2013 Credit Collection Regulations.

Accountability

DPO

General requirements on the role of a data protection officer (DPO) include:

• Article 21 of the 2016 CSL, which states that network security operators must identify the person in charge of network security and implement the responsibility for network security protection.
• Article 27 of the 2021 DSL, which states that processors of important data must identify the person in charge of data security and the management organisation, and implement the responsibility for data security protection.
• Article 52 of the 2021 PIPL, which states that a data controller that handles PI up to a specified quantity must designate a person in charge of PI protection. That person is responsible for supervising the activities of PI processing, the protection measures taken, and so on.

Specific to the financial sectors:

• Commercial banks. Banking financial institutions should set up full-time positions in the data governance focal point management department to meet their work needs, and set up full-time or part-time positions in other relevant business departments (Article 14, 2018 Banking Finance Data Governance Guidelines). Commercial banks should establish an organisational structure for emergency responses to operational disruptions, including an emergency decision-making layer, an emergency command layer, an emergency execution layer and an emergency protection layer (Guidelines on Business Continuity Supervision for Commercial Banks 2011).
• Credit agencies. Individual credit collection agencies and corporate credit collection agencies handling corporate information of more than one million households should have company executives serving as the person in charge of information security and the person in charge of PI protection, and should set up a full-time department (Article 34, 2021 Credit Collection Measures).

Audits

A data controller should conduct regular compliance audits of their handling of PI in compliance with laws and administrative regulations (Article 54, 2021 PIPL).

Specific to the financial sectors:

• Commercial banks. Non-bank payment institutions and bank card clearing organisations engaged in bank card acquiring business and network payment business should internally audit the security of payment-sensitive information at least twice each year, and file a report for reference (Article 1, Notice of the PBOC on Further Strengthening the Risk Management of Bank Cards 2016).
• Credit agencies. Credit collection agencies should conduct compliance audits of their own personal credit collection business every year and report them to the People's Bank of China (PBOC) in a timely manner (Article 43, 2021 Credit Collection Measures).

Assessment

A data controller must conduct a prior impact assessment of PI protection and record the processing in any of the following circumstances:

• Processing SPI.
• Using PI for automated decision-making.
• Entrusting the processing of PI, providing PI to other controllers, and disclosing PI.
• Providing PI outside the country.
• Other PI processing activities that have a significant impact on the rights and interests of individuals.

  (Article 55, 2021 PIPL.)

Specific to the financial sectors:

• Network payment service operators. Network payment service operators with automated decision-making mechanisms that can significantly affect the rights and interests of PI subjects should assess the impact on the security of PI at:
  • the stage of planning and design of automated decision-making or before the first use; and
  • regular intervals (at least once a year) while using automated decision-making.

  (Article 8.3, 2021 Network Payment Data Security Draft Guidelines.)

• Commercial banks. Commercial banks should develop an ongoing risk identification and assessment process to:
  • identify areas of potential risk in IT;
  • evaluate the potential impact of risks on their business;
  • rank the risks; and
  • prioritise risk prevention measures and resources required (including outsourcing vendors, product providers, and service providers).

  (Article 16, 2009 IT Risk Management Guidelines.)

Retention of Processing Records

PI must be kept for the shortest period of time necessary to fulfil the purposes for which it was processed (Article 19, 2021 PIPL).

Specific to the financial sectors:

In serious cases, the fines can be increased to up to RMB50 million or 5% of last year's turnover for the processor and up to RMB1 million for the persons responsible. The authorities may even order the data processor to suspend the relevant business or cease operation for rectification, have the relevant business permit revoked, or have its business licence revoked.

If banking financial institutions refuse or obstruct off-site supervision or on-site inspection, provide false statements, reports, and other documents and information, conceal important facts, or fail to disclose information in accordance with the regulations, they should be ordered to make corrections and be subject to a fine of not less than RMB200,000 and up to RMB500,000 (Banking Supervision and Administration Law 2006, with effect 1 January 2007).

Civil Liability

If the accidental access causes damage to the rights and interests of data subjects and the data processor cannot prove that it was not at fault, the processor should be liable for damages and other tort liability.

The processor's breaches of the 2021 PIPL may be recorded in its credit file and made public.

PFI Processing Enforcement Focus