German fitness app with Chinese users and a Shanghai subsidiary
NordFit GmbH is a German fitness-app company with no legal entity in mainland China. Its app is offered in Simplified Chinese, priced in RMB, supports WeChat login, and has 180,000 monthly active users in mainland China. It stores data in Frankfurt and uses a Shanghai CDN provider for content delivery. The app collects heart rate, sleep, GPS route, name, phone number and device ID, and runs a recommendation engine that scores users' health habits. NordFit also owns a Shanghai subsidiary with 300 employees that handles local customer support and uses a separate HR system for its staff. NordFit's lawyer argues that PIPL does not apply because the company is outside China, and that the data is 'anonymized' because names are replaced by random user codes. A China user has complained about targeted health advice.
1. Does the PRC Personal Information Protection Law apply to NordFit's processing of the fitness app users' data, and to the Shanghai subsidiary's employee data? Explain the tests you apply.
Read the worked answer
Two separate tests apply. For the Shanghai subsidiary, Article 3(1) applies because an organization established in China processes personal information in China in the course of its operations; the HR data of its 300 employees is therefore covered. For NordFit in Germany, Article 3(2) applies extraterritorially if it processes PI of natural persons in China (a) to provide products or services to them, or (b) to analyze or evaluate their behavior. The Chinese-language interface, RMB pricing, WeChat login and 180,000 mainland users point strongly to (a); the health-habit scoring engine points to (b). The Shanghai CDN does not by itself decide the issue, but the targeting does. Because NordFit processes from outside China, it must also designate a local representative or establish a dedicated entity under Article 53 unless an exemption applies. The lawyer's premise that 'outside China' equals 'outside PIPL' is wrong.
2. The lawyer says replacing names with random codes anonymizes the data. Assess this under PIPL, and identify the compliance consequences if the data includes heart rate and GPS route.
Read the worked answer
Replacing names with random codes is pseudonymization/de-identification, not anonymization. The data remains personal information if the codes can be linked back to users, directly or indirectly, by the holder or another party. PIPL's anonymization exception requires the information to be impossible to identify a specific natural person and irreversibly so. Here, the app must maintain a mapping to operate accounts, so the data is identifiable. Heart rate is medical-health information and GPS route reveals whereabouts; both are sensitive PI under Article 28. That triggers specific purpose, sufficient necessity, strict protection measures, separate consent under Article 29, notification of necessity and impact, and a DPIA under Article 55. The 'anonymized' label would not remove those duties.
3. What minimum obligations follow from the cross-border element, assuming NordFit must comply and does not establish a China entity?
Read the worked answer
The cross-border transfer needs an Article 38 mechanism: CAC security assessment, certification, or standard contract, depending on volume and data type. It also needs Article 39 notice and separate consent, covering the overseas recipient's name and contact details, purpose, method, categories, and how the individual can exercise rights. Article 53 requires a dedicated local entity or representative in China, with filing. NordFit should also check whether it meets the volume threshold for a DPO under Article 52 and keep transfer records. A privacy policy clause alone is not a transfer mechanism, and consent for general app use does not automatically cover the export.