PILP: More Information

China’s Personal Information Protection Law (PIPL) is a comprehensive privacy law similar in many respects to the EU GDPR but with its own unique requirements. PIPL was enacted on August 20, 2021, and became effective on November 1, 2021.

PIPL is intended to protect the personal information of persons physically located in Mainland China, which refers to the continental landmass under the direct control of the People’s Republic of China (PRC), including the islands of Hainan Province and five major autonomous regions (i.e., Tibet, Inner Mongolia, Xinjiang, Ningxia and Guangxi).

PIPL does not apply to the Hong Kong Special Autonomous Region (SAR), the Macao SAR, and Taiwan.

PIPL defines personal information broadly as information related to an identified or identifiable natural person recorded electronically or by other means. Personal information does not include anonymized information but does include deidentified information.

• The University has obligations under this law because PIPL applies not only to entities physically located in Mainland China that handle people’s personal information, but also to entities located outside Mainland China when they engage in certain activities involving the personal information of persons physically located in Mainland China. Violating PIPL when it applies may result in institutional liability, personal liability, and even criminal liability.
• PIPL applies to personal information handlers (someone who determines the purposes and means of how personal information is handled) and entrusted parties (someone who handles personal information at the direction of a personal information handler) in three circumstances:
• When they are located in Mainland China and are handling people’s personal information; or,
• When they are located outside Mainland China but are handling the personal information of people physically located in Mainland China and the purpose of the handling is to:
  • Provide products or services to people physically located in Mainland China; or,
  • Analyze or evaluate the behaviors of people physically located in Mainland China.

Most frequently, the types of university activities that potentially trigger PIPL requirements are those involving providing products or services to people physically located in Mainland China or where the university is analyzing or evaluating the behaviors of people physically located in Mainland China. Examples of such activities could include undergraduate and graduate admissions programs, distance learning courses, study abroad, international programs (especially where participating students are from Mainland China), collecting data using cookies on university websites, entering into a contract with a 3^rd party that will process data from Mainland China, and research involving persons physically located in Mainland China.