Large video platform dissolving its external privacy oversight body
WaveVideo is a short-video platform with 80 million daily active users in China. Its board wants to dissolve the Privacy Oversight Committee, a body of five external members that reviews algorithm changes, to cut costs. Management also plans to use 18 months of user viewing data, including comments and watch history, to train a new recommendation model, and to publish a new rule allowing suspension of accounts that repeatedly post privacy complaints. The company has a privacy office of three people, no published social responsibility report, and no records of DPIAs for the model. A regulator has warned about 'large platform' duties. The board asks what governance obligations apply and who can be personally liable.
1. Is WaveVideo subject to the enhanced governance duties for large platforms under Article 58? What must it do about the oversight committee?
Read the worked answer
Article 58 applies to personal information processors that provide important internet platform services with a large number of users and complex business types. With 80 million daily active users and an algorithmic recommendation business, WaveVideo is likely within that category, although the official designation matters. The duties include establishing a sound PI protection compliance system, setting up an independent oversight body composed mainly of external members to supervise PI protection, adopting platform rules, suspending service to users who seriously violate PI rules, and publishing social responsibility reports periodically. Dissolving the external committee to cut costs would remove a required governance control. The committee should be retained and made genuinely independent; the three-person privacy office may also be insufficient for the scale and should be assessed against the DPO and compliance-system requirements.
2. What accountability records and controls should WaveVideo have before training the new recommendation model on 18 months of user data?
Read the worked answer
Because the model uses large-scale viewing and comment data and drives automated recommendations, WaveVideo should complete a DPIA under Article 55 and retain the report and processing records for at least three years under Article 56. It needs a lawful basis and, where consent is relied on, clear notice and separate consent for new purposes. If sensitive PI or minors' data is involved, stricter rules apply. It should document the model's purpose, data minimisation, retention, access controls, de-identification or anonymisation where feasible, and human review of significant decisions. The proposed rule suspending accounts for privacy complaints would create a chilling effect and should not be adopted; complaint handling must remain accessible under Article 50. The board should also receive a written compliance assessment, not just a cost-saving proposal.
3. If the regulator finds serious violations, what penalties and personal liabilities can arise, and how does PIPL treat proof of harm?
Read the worked answer
Article 66 allows orders to correct, warnings, confiscation of illegal gains, and fines. For serious violations, the fine can reach RMB 50 million or 5% of the previous year's turnover, and the authority can suspend business, revoke licences, and disqualify responsible personnel. Directly responsible persons such as the legal representative, the head of compliance and the privacy lead can be fined up to RMB 1 million. Article 69 applies a fault presumption in civil claims: the processor must prove it is not at fault, which is difficult without DPIAs, training records and audit trails. Article 58 also supports suspension of service for serious violations. The board should treat the oversight committee, DPIA records and complaint channels as legal risk controls, not discretionary spending.