Before 2019 came to a close, the Chinese government added another requirement to tech's growing compliance obligations. On Dec. 31, the country issued new guidelines requiring app makers to obtain users' permission and clearly notify app users before collecting their data. 

The new standard provides public notice to internet users and app operators of what the Chinese government considers a compliance violation, and it clarifies implementation of China's Cybersecurity Law (CSL), according to a translation of the new requirements from China Law Translate.

The CSL went into effect in 2017 and requires broadly defined "network operators" and other entities to adhere to specific data storage, cybersecurity and data transfer standards. While the law's jurisdiction only applies to companies based in a Chinese territory, lawyers have said the CSL still lacks clarity over its scope. The newest app guidelines, which are also limited to companies based in Chinese territory,  should provide some insight for China-based companies leveraging or developing apps that collect local citizens' personal information. 

The guideline orders app operators to clearly specify what private information will be collected about an app user. App operators must also inform users how and why it will collect or use the information, especially when collecting ID numbers, bank account numbers, location tracking and other sensitive information.

For app developers or companies leveraging apps, China's requirements are new but not unique, said solo practitioner Zachary Strebeck, who largely represents video game developers.

"I think if you have a global perspective for your game or app, I think it will have an impact," he said. "But I think if you're complying with other laws, you will be 90% there."

He noted the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) both include protection and disclosure requirements, which China's new app standards also require. "As long as you are disclosing [what and how information is being collected], that's generally what they want."

Although China's latest guideline doesn't regulate all electronic data, unlike the GDPR and CCPA, it echoes a growing call by regulators to force corporations to enact and follow a privacy policy and provide transparency to users.

Plus, a focus on smartphone apps could be useful. According to the South China Morning Post, more than 80% of China's internet users experienced data breaches in 2018, while more than one-third of apps in China are prone to data safety risk.

To be sure, a data privacy law from Chinese regulators is on the horizon. State-run chinadaily.com noted this latest guideline is an effort to assist law enforcement in detecting and combating privacy-related violations as lawmakers draft the country's first personal information protection law.

|