personal information protection in china - recent development of the chinese civil and criminal...

57
Personal Information Protection in China - Recent Development of the Chinese Civil and Criminal Cases Prepared for The Third Asian Privacy Scholars Network Conference, Faculty of Law, UHK, 8-9 July, 2013 Dr George Tian Senior Lecturer, Faculty of Law University of Technology Sydney (UTS) Email: [email protected]

Upload: deirdre-palmer

Post on 22-Dec-2015

214 views

Category:

Documents


1 download

TRANSCRIPT

Personal Information Protection in China - Recent Development of the

Chinese Civil and Criminal Cases

Prepared for The Third Asian Privacy Scholars Network Conference, Faculty of Law, UHK, 8-9 July, 2013

Dr George TianSenior Lecturer, Faculty of Law

University of Technology Sydney (UTS)Email: [email protected]

Part I: Overview of Personal Information Protection Laws in China

Part II: Recent Cases on Personal Information Protection in China 2.1. Recent Development of the Chinese Civil Cases 2.2. Recent Development of the Chinese Criminal Cases

Part III: Challenges & Recommendations 3.1. Challenges of protecting personal information in

China 3.2. Suggestions for future Legal Reform

Structure

1.1. General Feature 1.2. Existing Laws and regulations 1.3. Comments and Remarks

Part I: Overview of the Personal Information Protection Regime in China

China is still in the process of establishing a comprehensive legal framework to regulate the use

and disclosure of personal data not currently have

a national level law that delineates how a company can legally collect, process and retain personal data.

“The country’s information protection regime consists of a patchwork of sector-specific laws and guidelines, stand-alone provisions in broader laws, and regional laws”.

--- (Cave, 2013)

1.1. General Feature

But … it seems that such a situation is changing gradually….

New Efforts of Harmonization Particularly in the recent two or three years, China

made a good progress in harmonizing its personal data protection laws. E.g. making law, regulations and guidelines for protecting

personal information protection on the Internet E.g. MIIT Guideline 2013 (more details will be discussed later)

Draft of Personal Information Protection Law (since 2005)

1.1. General Feature

6 6

1.2. Existing Personal Data Protection Rules in China

1.

Constitution Law

Articles 38 and 40

Rights that relate to privacy, e.g. - right of dignity of the person, - prohibitions against insult,

defamation, false accusation or false information directed against Chinese citizens, and

- right of freedom and secrecy of correspondence.

2.

Civil Law Article 120 the General Principles of the Civil Law

protect a citizen’s right of - personal name, - portrait, - reputation or honor.

7 7

Existing Personal Data Protection Rules in China

3.

Criminal Law(7th Amendment)

Article 253

(1)make working personnel of state agencies, or of organizations in particular industry sectors, potentially subject to criminal liability,

- if they sell or illegally provide to other persons individual information of citizens obtained - during the course of such organization’s performance of official duties or provision of services.

(2) An organization and its responsible officers could also be made subject to the same criminal liability, - if it obtains information that had been misappropriated in this way.

8 8

Existing Personal Data Protection Rules in China

4.

Tort Liability Law 2009 (effective on July 1st, 2010)

Articles 2, 6, 3, 15, 36,61, 62

contains provisions which establish a right of a private citizen to sue for damages or other remedies in tort, - in cases where medical

records are mishandled and

- in cases where the internet is used to harm the interests of the private citizen or, more generally,

- in cases where the private citizen’s right of privacy, health, name, reputation, honor or portrait has been infringed upon and damages have occurred

5.

Interpretation of the Supreme People’s Court on Issues regarding the Ascertainment of Liability for Compensation for Psychological Damages in Civil Torts

protect an individual’s rights of personality, including an individual’s privacy, - by granting a right to claim for psychological damages.

9 9

6 The Guidelines for Payment and Clearing Organizations on Anti-money Laundering and Anti-terrorist Financing 2009 (issued by the People’s Bank of China)

require payment and clearing organizations and their branches - to establish internal control systems to

prevent money laundering and terrorist financing, and

- to establish systems for the ascertainment of client identities, for the reporting of suspicious transactions, and for the preservation of client identity and transaction records..

7 Interim Measures for the Administration of the Basic Data of Individual Credit Information 2005(issued by the People’s Bank of China)

prohibit governmental authorities and other organizations, as well as their staff, from disclosing personal information which they may obtain in the course of their work. Violators will be subject to administrative punishment and civil compensation.

Existing Personal Data Protection Rules in China

10 10

Existing Personal Data Protection Rules in China8. The Norms for

Electronic Medical Records of Traditional Chinese Medicine (for Trial Implementation) 2010

(issued by the State Administration of Traditional Chinese Medicine)

require medical organizations to - set up information security schemes for

electronic medical records and - establish corresponding powers for

doctors, nurses and other management staff in the hospital to read, copy, and type electronic medical records, and

require hospitals to establish usage records for the electronic medical records. prohibit any entity or individual from reading or copying electronic medical records without due authorization.

9. The Basic Norms for Electronic Medical Records 2010(issued by the Ministry of Health)

prohibit unauthorized review of patients’ medical records - by other institutions and persons besides

the medical personnel that perform the medical activity and quality control personnel.

[Exemption]permit the review of medical records, after obtaining consent of the medical institution, for the purpose of scientific research and education.

11 11

Existing Personal Data Protection Rules in China

10.

Social Insurance Law 2010

prohibit governmental authorities and other organizations, as well as their staff, from disclosing personal information which they may obtain in the course of their work. Violators will be subject to administrative punishment and civil compensation.

11.

The Provisions on the Management of Social Insurance Records (for Trial Implementation) 2009( issued by the Ministry of Human Resources and Social Insurance and State Archives Administration)

require - that social insurance records, including

medical insurance records, comply with applicable requirements on storage, confidentiality, use, transfer, validation, and destruction of archives,

- that they be stored properly, and - that damage to or destruction, loss, and

disclosure of social insurance records be prevented.

12 12

Existing Personal Data Protection Rules in China

10.

MIIT Regulation of December 2011 (effective 15 March 2012) - ‘Several Regulations on Standardizing Market Order for Internet Information Services’

11.

The Decision of the Standing Committee of the National People’s Congress on Strengthening Information Protection on Nation Network – December 28, 2012

12

MIIT Guidelines for Personal Information Protection within Public and Commercial Services Information Systems (2013)

Sectorial and Provincial Laws..Administrative Laws and regulations…

Group 1: Laws on Internet: 2 Decision of the Standing Committee of the National

People’s Congress on the Internet Security 2000 Digital Signature Law 2004

Group 2: Other laws related to Internet governance: 21

E.g. Patent Law, Trade Mark Law, Copyright Law, et al Group 3: Administrative regulations & Ministerial

Rules. Administrative regulations: 51 Ministerial rules: 843.

China’s internet Laws & RegulationsPKU Report 2011 – Existing Internet

Laws in China

Group 4: Juridical interpretations E.g. digital copyright and ISP safe harbour

provisions Group 5: Self-regulations: 46. After 2011…. New Development in 2012:

Laws on the Internet Decision of the Standing Committee of the National

People’s Congress on Strengthening Information Protection on Na Network – December 28, 2012

China’s internet Laws & RegulationsPKU Report 2011 – Existing Internet

Laws in China

MIIT Guidelines for Personal Information Protection within Public and Commercial Services Information Systems (2013)  In theory, these voluntary guidelines are not as

important as the two regulatory instruments of 2011/12 covering part of the same territory (primarily Internet IISPs), The Decision of the Standing Committee of the

National People’s Congress on Strengthening Information Protection on Nation Network – December 28, 2012

the MIIT Regulation of December 2011 (effective 15 March 2012) - ‘Several Regulations on Standardizing Market Order for Internet Information Services’.

3.2. Recent development of the personal data regulations

3.2.1. MIIT Guidelines 2013

However, these 2013 Guidelines apply to a much broader range of businesses, and

they cover key issues (such as data exports, sensitive data, and subject access and correction rights), and

provide some details, not covered in the earlier instruments.

Definition of Personal Information

3.2. Recent development of the personal data regulations

3.2.1. MIIT Guidelines 2013 - PI

Remarks: The current features of the Chinese personal

information protection framework do affect the effective enforcement of PI

protection laws at both civil and criminal levels.

1.3. Remarks: Existing Laws and regulations

2.1. Recent Development of the Chinese Civil Cases 2.1.1. Overviews 2.1.2. Civil Case – Mr Guo vs Minsheng Bank

2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics 2.2.2. Criminal Case against Individual - China

vs. Xu [2013] 2.2.3. Criminal Case against Company - China

vs. Shanghai XX IT Company [2013] 2.2.4. Progress vs. Uncertainty

Part II: Recent Cases on Personal Information Protection in China

“The country’s information protection regime consists of a patchwork of sector-specific laws and guidelines, stand-alone provisions in broader laws, and regional laws”.

--- (Cave, 2013) Challenges to the Courts

Civil Law Code Laws/regulations/guideline at different levels

2.1. Recent Development of the Chinese Civil Cases

2.1.1. Overview

Case: Tort of Privacy Invasion by Bank Mr. Guo, a citizen in Nanjing (Capital city of Jiangshu Province)

sued the Minsheng Bank in the Nangjing Xuanwu District Court in 2012.

The Court held that the bank’s conducts constitute the tort of privacy invasion.

Mr Guo was a former Credit Card users of the Minsheng Bank Nanjing Branch.

But, in May 2011, he surprisingly discovered that, although he got his Minsheng credit card cancelled, without his authorization, the Minsheng Bank, has twice investigated his personal credit information from the Nanjing Branch of the People's Bank of China (his current bank) under the names of credit card approval and loan approval in 2010 and in 2011 respectively.

2.1. Recent Development of the Chinese Civil Cases

2.1.2. Guo vs. Minsheng Bank [2012]

Case: Tort of Privacy Invasion by Bank  The explanation given by the Minsheng Bank Nanjing Branch

was that the bank is conducting “2nd Round customer development”.

Mr. Guo did not accept this explanation, and filed a Complaint to the Management Division of the People’s Bank Nanjing Branch.

In December 2011, after investigation, the People’s Bank Nanjing Branch found that Minsheng bank indeed inspected the credit record of Mr. Guo without his authorization.

According to the Interim Measures for the Administration of the Basic Data of Individual Credit Information 2005 (issued by the People’s Bank of China),

It imposed 20,000 CNY (3,278 USD) monetary penalty to Minsheng Bank.

2.1. Recent Development of the Chinese Civil Cases

2.1.2. Guo vs. Minsheng Bank [2012]

Case: Tort of Privacy Invasion by Bank 

Mr. Guo believed that the conducts of the Minshen Bank infringed his privacy right, and initiated a civil litigation against Minshen Bank in the Nanjing Xuanwu District Court, and asked the bank to make a written apology on Newspapers.

In March 2012, the Xuanwu district court made a decision in favour of Mr. Guo, and requested the Minsheng Bank Nanjing Branch to make a written apology to Guo.

 

2.1. Recent Development of the Chinese Civil Cases

2.1.2. Guo vs. Minsheng Bank [2012]

Hints from this Case: Tort of Privacy Invasion by Bank 

Enforcement Agencies The People’s Bank Nanjing Branch Nanjing Xuanwu District Court

Relevant Laws and regulations: Civil Law Civil Tort of Liability Law Interim Measures for the Administration of the Basic Data of

Individual Credit Information 2005 (issued by the People’s Bank of China)

2.1. Recent Development of the Chinese Civil Cases

2.1.2. Guo vs. Minsheng Bank [2012]

Criminal Law (7th Amendment 2009) Crime of selling Personal Information of Citizens Crime of illegally providing Personal Information of

Citizens Crime of illegally obtaining Personal Information of

Citizens

Based on the information provided by the Public Prosecutate of Beijing Haidian District,

In 2010, they handled 31 cases (41 people involved), which were related to a breach of the Criminal Law for illegally obtaining to Personal Information of Citizens.

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

VII. An Article is inserted after Article 253 of the Criminal Law as Article 253 (A):

“Where any staff member of a state organ or an entity in such a field as finance, telecommunications, transportation, education or medical treatment, in violation of the state provisions, sells or illegally provides personal information on citizens, which is obtained during the organ’s or entity’s performance of duties or provision of services, to others shall, if the circumstances are serious, be sentenced to fixed-term imprisonment not more than three years or criminal detention, and/or be fined.

Whoever illegally obtains the aforesaid information by stealing or any other means shall, if the circumstances are serious, be punished under the preceding paragraph.

Where any entity commits either of the crimes as described in the preceding two paragraphs, it shall be fined, and the direct liable person in charge and other directly liable persons shall be punished under the applicable paragraph.”

Key Features of this type of criminal cases:

1. Measures of Crime – Online trading 20 of 31 cases happened on the Internet – 64.5% of the

total cases Step 1: Buyers search online via Baidu or Google to find

Sellers Step 2: Join in special QQ Group Step 3: communicate via QQ or Emails Step 4: Bank transfer and Data Transfer

7 of 31 cases – face-to-to trading – 22.5%

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

Measures of Crime

Via the InternetFace-to-FaceOthers

Key Features of this type of criminal cases: … 2. Purpose of Crimes – Expand their market & sell

for money

26 of 41 people used the obtained personal information for marketing purposes – 63.4%

14 of 41 is for selling to others – 34.1%.

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

Purposes of Crime

Marketing purposes Re-selling purposeOthers

Key Features of this type of criminal cases: … 3. Targeted Information

Car owner information – 15 of 31 cases – 48.3% Bank customer information – 10 of 31 cases – 32.2% Company CEO – 5 of 31 cases – 16.5% Phone records/ID card information/shopping records – 3

* 3 - 9.6% respectively Customer information of Carrier company & new-born

information – 2*2 – 6.4% respectively, et al… In many cases, parties involved obtained multi-type

information

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

Targeted Information Car owner in-formation

Bank customer information

Company CEO Phone records/ID card information/shopping records

Phone records/ID card information/shopping records

Phone records/ID card information/shopping records

Key Features of this type of criminal cases: … 4. High Risk Group – employees in marketing and

insurance sectors 11 of 41 people - salesman – 26.8%

5. New High Risk Group: Company leaders & private detectors companies Company leaders – 10 of 31 cases (13 of 41 people) –

32.2% Mangers of private detectors companies – 4 of 31

cases (5/41) – 12.9%

2.2. Recent Development of the Chinese Criminal Cases

2.2.1. Overview & Statistics

Criminal Case against Individual Criminal Judgments by the People’s Court of Shanghai Pudong

New District Case Number: (2013) Pu Criminal First 1087((2013)浦刑初字第

1087号 )

Prosecutor: People's Procuratorate of Shanghai Pudong New District

Defendant: Xu  On April 1, 2013, the Prosecutor initiated a criminal litigation

against the Defendant on the ground that the Defendant breached the Criminal Law by illegally obtaining personal information of citizens.

  On the same day, the Court filed the case and applied a

summary procedure (simplified) to this case. A single judge was appointed and the case was concluded. 

2.2. Recent Development of the Chinese Criminal Cases

2.2.2. China vs. Xu [2013]

The Prosecutor claimed that: On April 25, 2012, the Defendant Xu spent 500 Yuan (around

80 USD), and purchased more than one million pieces of Customer Order Information of the “No.1 Store” site - personal information of citizens – from Zhang (handled separately) via the Internet.

On November 23, 2013, the Defendant Xu was arrested and confessed all above facts.

The Defendant Xu has indicated no objection to the facts that the Prosecutor claimed above in the court proceeding.

2.2. Recent Development of the Chinese Criminal Cases

2.2.2. China vs. Xu [2013]

The Court also took into account the evidences, such as: - Testimonies made by Witness Wang and Witness

Zhang - QQ Screenshots, - Chat records - Alipay transaction records (Chinese PayPal) - the list of seized items, - and other evidences.

‘The Court found that the Defendant Xu illegally obtained personal information of citizens, and the circumstances are serious. As such, his conducts constituted a breach of the Criminal Law.’

2.2. Recent Development of the Chinese Criminal Cases

2.2.2. China vs. Xu [2013]

 ‘The Court upheld the claims made by the Prosecutor.

By virtue of Article 253 (1)(2), Article 67(3), Article 72, Article 73(2)(3) and Article 53 of the Criminal Law, the Court made a judgment as follows: Defendant Xu beached the provision of illegally

obtaining to personal information of citizens, and was sentenced to six months imprisonment,

suspended for one year (probation) and a monetary penalty of one thousand Yuan (around

163 USD) applied.’

2.2. Recent Development of the Chinese Criminal Cases

2.2.2. China vs. Xu [2013]

上海市浦东新区人民法院 刑事判决 ( 2013)浦刑初字第 1087号  被告人徐某,因本案于 2012年 11月 23日被刑事拘留,同年 12月 21日被逮捕, 2013年 1月 29日被上海市公安局浦东分局取保候审,同年 3月 22日被上海市浦东新区人民检察院取保候审。  辩护人赵振华,上海市世通律师事务所律师。  上海市浦东新区人民检察院以沪浦检刑诉〔 2013〕 969号起诉书指控被告人徐某犯非法获取公民个人信息罪,于 2013年 4月 1日向本院提起公诉。本院于同日立案并依法适用简易程序,实行独任审判,公开开庭审理了本案。上海市浦东新区人民检察院指派代理检察员席娜出庭支持公诉,被告人徐某及其辩护人赵振华到庭参加诉讼。现已审理终结。  上海市浦东新区人民检察院指控, 2012年 4月 25日,被告人徐某在互联网上从张某某(另案处理)处,以人民币 500元的价格购得一号店网站 100余万条(以收货人姓名为关键项去除重复处理后共计 28万余条)订单信息数据的公民个人信息。   2013年 11月 23日,被告人徐某被公安机关抓获,到案后如实供述了上述犯罪事实。  上述事实,被告人徐某在开庭审理过程中亦无异议,并有经庭审质证属实的证人王某某、张某某的证言, QQ截屏图片、聊天记录、支付宝交易记录,扣押物品清单,公安机关出具的案发经过及工作情况,被告人徐某的户籍资料等证据证实,足以认定。  本院认为,被告人徐某非法获取公民个人信息,情节严重,其行为已构成非法获取公民个人信息罪。公诉机关指控的事实及罪名成立,予以支持。被告人徐某到案后能如实供述并自愿认罪,系坦白,依法从轻处罚。依照《中华人民共和国刑法》第二百五十三条之一第一、二款、第六十七条第三款、第七十二条、第七十三条第二、三款、第五十三条之规定,判决如下:  被告人徐某犯非法获取公民个人信息罪,判处有期徒刑六个月,缓刑一年,罚金人民币一千元。  (缓刑考验期限,自判决确定之日起计算;罚金自判决生效后一个月内缴纳。)  被告人徐某回到社区后,应当遵守法律、法规,服从监督、管理,接受教育,参加公益劳动,做一名有益于社会的公民。  如不服本判决,可在接到判决书的第二日起十日内,通过本院或者直接向上海市第一中级人民法院提出上诉。书面上诉的,应当提交上诉状正本一份,副本二份。

代理审判员 师坤鹏 二〇一三年四月十八日 书记员 陆玮

Criminal Case against Company Criminal Judgments by the People’s Court of Shanghai Pudong

New District Case Number: (2013) Pu Criminal First 864((2013)浦刑初字第

864号 )  Prosecutor: People's Procuratorate of Shanghai XX District Defendants: Shanghai XX Information Technology Company

(referred to XX company); Legal Representative: Bai XX.  On March 13, 2013, the Prosecutor initiated a criminal litigation

against the Defendant on the ground that the Defendant breached the Criminal Law by illegally obtaining personal information of citizens.

  The Court filed the case and applied a (simplified) summary

procedure to this case. A single judge was appointed and the case was concluded.

2.2. Recent Development of the Chinese Criminal Cases2.2.3. China vs. Shanghai XX Information Technology

Company [2013]

The Prosecutor claimed that: In July 2012, in order to expand the Company’s market, the

Defendant Bai authorized Zuo (handled separately), the Manger of the Marketing Division of the Company, to purchase more than one million pieces of Customer Order Information - personal information of citizens – from Liu (handled separately) at the price of 900 Yuan (around 146 USD) via the Internet.

On February 21, 2013, the Defendant Bai went to the Public Security authority and make a voluntary confession.

The Defendants, XX Company and Bai, have indicated no objection to the facts that Prosecutor claimed above in the Court proceeding.

 

2.2. Recent Development of the Chinese Criminal Cases

2.2.3. China vs. Shanghai XX IT Company [2013]

The Court has also taken into account the evidences, such as: - Alipay transaction screenshot (Chinese PayPal) - Relevant invoices - Testimony by Witness Cui - Testimonies by related parties Zuo and Liu the list of seized items, - and other evidences.

2.2. Recent Development of the Chinese Criminal Cases

2.2.3. China vs. Shanghai XX IT Company [2013]

‘The Court found that the Defendants, XX Company and Bai, illegally obtained personal information of citizens, and the circumstances were serious.

The conducts of Bai, who was directly in charge of personnel of the Company, has constituted a breach of the Criminal Law.

Given that the XX Compand and Bai voluntarily confessed to the Public Security Authority and pleaded guilty in the Court, by virtues of relevant laws, the Court decided to apply a lighter punishment.’

2.2. Recent Development of the Chinese Criminal Cases

2.2.3. China vs. Shanghai XX IT Company [2013]

By virtue of Article 253 (1), Article 67(1), Article 72(1)(3), Article 73(2)(3) and Article 53 of the Criminal Law, the Court made a judgment as follows:  1. Defendant XX Company beached the provision of

illegally obtaining to personal information of citizens, and needs to pay a monetary penalty of 30,000 Yuan (around 5,000 USD). 

2. Defendant BAI beached the provision of illegally obtaining personal information of citizens, and was sentenced to six months imprisonment, suspended for one year and a monetary penalty of 10,000 Yuan (around 1,630 USD).

   Judge Ling Hong  March 21, 2013

2.2. Recent Development of the Chinese Criminal Cases

2.2.3. China vs. Shanghai XX IT Company [2013]

VII. An Article is inserted after Article 253 of the Criminal Law as Article 253 (A):

“Where any staff member of a state organ or an entity in such a field as finance, telecommunications, transportation, education or medical treatment, in violation of the state provisions, sells or illegally provides personal information on citizens, which is obtained during the organ’s or entity’s performance of duties or provision of services, to others shall, if the circumstances are serious, be sentenced to fixed-term imprisonment not more than three years or criminal detention, and/or be fined.

Whoever illegally obtains the aforesaid information by stealing or any other means shall, if the circumstances are serious, be punished under the preceding paragraph.

Where any entity commits either of the crimes as described in the preceding two paragraphs, it shall be fined, and the direct liable person in charge and other directly liable persons shall be punished under the applicable paragraph.”

Progress: The new amendment started to be well enforced.

Uncertainty: Lack of a clear definition of “personal information” The meaning of “state provisions” The meaning of “if the circumstances are serious”/

“severe consequence”

Next, BACK to the issues at the national level…

2.2. Recent Development of the Chinese Criminal Cases

2.2.4. Remarks: Progress vs. Uncertainty

3.1. General Challenges of protecting personal data in China 3.1.1. Hints from 2013 BSA Global Cloud Computing

Scorecard Ranking improved Lack of laws and industrial rules

3.1.2. Challenges from Legal Tradition

3.2. Suggestions for future reform 3.2.1. Three models: US, EU and Australia 3.2.2. Enforcement Agencies

Part III: Challenges & Recommendations

The BSA survey examined the policy environment for CC in several countries around the world.

The BSA survey examined 24 countries, which together account for 80 percent of the global ICT market.

The BSA Scorecard Measuring CC Readiness

3.1. General Challenges3.1.1. Hints from 2013 BSA Global Cloud

Computing Scorecard

The BSA Scorecard Measuring CC Readiness It examines major laws and regulations relevant to CC

in seven policy categories as well as each country’s ICT-related infrastructure and broadband deployment. 1. Data Privacy 2. Security 3. Cybercrime 4. IPRs 5. Support for Industry-Led Standards & International

Harmonization of Rules 6. Promoting Free Trade 7. ICT Readiness, Broadband Deployment.

2013 BSA Global Cloud Computing Scorecard

China’s Ranking +2 (in comparison with 2011) 19th of 24

3.1. General Challenges3.1.1. Hints form 2013 BSA Global CC

Scorecard

Screen Shot 2013-07-05 at 1.08.10 PM

As mentioned above…. Progress:

Recent development – all about protecting personal information on the Internet (rather than general protection measures)

Further improvements: Lack of the Personal Information Protection Law at the

national level Lack of unified privacy enforcement authority at the

national level Challenges for the quick growth of Innovation Industry

3.1. General Challenges3.1.1. Hints form 2013 BSA Global CC

Scorecard

China’s overall regulatory approach may presents challenges to the development of innovation industry, such as cloud computing.

1. China’s preference for top-down mandatory regulation is often at odds with the type of public-private collaboration and industry self- regulation so critical to growing new technologies.

2. data protection and data sovereignty fears, as well as cybersecurity concerns, are creating barriers for deployment of leading global technologies.

3. complicating the policy environment is China’s drive to promote domestic industry, as well as preserve its existing market access controls.

(USITO, 2012)

3.1. General Challenges3.1.2. Challenges from Legal Tradition

EU Model: Centralized

US Model: Decentralized

Australia Model: Centralized law and principles + detailed industrial guidelines.

Recommendation 1 – May consider drawing on lessons from the experiences of Australian Model to harmonize the existing laws on personal data protection

3.2. Suggestions for future laws and policies reform

3.2.1. Three models: US, EU and Australia

Recommendation 2: May consider leaving privacy cases to Intellectual

Property Courts (IP, Antitrust, Personal Information Protection)

Recommendation 3: Courts may play a more active role in explaining

how existing data protection laws could be applied Chinese Supreme Court may issue a Guideline on

this issue – more judicial interpretations

3.2. Suggestions for future laws and policies reform

3.2.2. Enforcement Agencies

“Based on the global opportunity that Cloud Computing presents, each country’s policy changes will alter not just that country’s environment but the global market for CC as a whole.”

(BSA, 2013)

…. apply this idea broadly….

Conclusion and Remarks

“Based on the global opportunity that Information Economy presents, each country’s policy changes will alter not just that country’s environment but the global Information Economy as a whole.”

Conclusion and Remarks

Prof. Graham Greenleaf, Faculty of Law, UNSW

Mr. Yun Xuan, Director of IP Policy and Enforcement Division, Microsoft (China) Co., Ltd

Ms. Sophia Wang, Director & Chief Representative, China, BSA, The Software Alliance

Acknowledgment

Thank You !