The new law was approved by China's ceremonial legislature and expands the ruling Communist Party’s crackdown on internet industries. In a major policy change, the new law would impose some of the world's strictest controls on private-sector handling of information about individuals but appears not to affect the ruling party's pervasive surveillance or access to those corporate data.
Seen as a major move to reimpose central control, its passage follows anti-monopoly and other enforcement actions against companies including e-commerce giant Alibaba and games and social media operator Tencent that caused their share prices to plunge.
The law, which takes effect from November 1st 2021, follows complaints that companies misused or sold customers' data without their knowledge or permission, leading to fraud or unfair practices such as charging higher prices to some users.
The new law curbs what information companies can gather and sets standards for how it must be stored. The full text wasn't immediately released, but earlier drafts would require customer permission to sell data to another company.
The market soon reacted to the announcement. Alibaba shares lost 2.6% in Hong Kong after news of the law's passage. Tencent sank after the announcement but ended up 1%. Pinduoduo, an online grocer, was down 1.2% in pre-market trading on the U.S.-based Nasdaq.
The law is similar to Europe’s General Data Protection Regulation, or GDPR, which limits the collection and handling of customer data. But unlike laws in Western countries, earlier drafts of the Chinese legislation say nothing about limiting ruling party or government access to personal information.
The ruling party has been accused of using data gathered about Uyghurs and other members of predominantly Muslim ethnic groups in the north western region of Xinjiang to carry out a widespread campaign of repression. This has been repeatedly denied by Beijing.
Paul Haswell of law firm Pinsent Masons said: "Chinese authorities are concerned at the volume of data big tech has in respect of the population and the power they can provide. He called the measure China's version of the GDPR. Most organizations, however, should be prepared after Chinese authorities imposed other restrictions on data oversight."
Rebecca Arcesati, an analyst at the Mercator Institute for China Studies. said: "The law reflects Beijing's new economic development strategy, in which growth has to be sustainable, beneficial for society and conducive to economic upgrading. The message from the government to internet platform businesses is clear : Future growth will only be possible within the limits of what is good for the Chinese nation, which in turn is defined by the Chinese Communist Party. Beijing wants tech giants to make money from the industrial internet, or the digitalization of public services, instead of people’s social media clicks."
In April, Alibaba was fined a record $2.8 billion for anti-competitive practices. This month, the government said online education companies are no longer allowed to receive foreign investment or operate as for-profit businesses.