EXIN PIPL Foundation flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal information definition

Any information relating to an identified or identifiable natural person, recorded electronically or otherwise, excluding anonymised information, under the PRC Personal Information Protection Law.

Sensitive personal information

Biometrics, religious belief, specific identity, medical health, financial accounts, whereabouts, and information of minors under fourteen, which require separate consent and strict necessity.

Anonymisation

Processing that makes information unidentifiable to a specific natural person and impossible to restore; anonymised data falls outside the scope of the law.

Extraterritorial application

The law applies to processing outside the PRC that serves the purpose of providing products or services to persons in the PRC or analysing their behaviour.

Deceased person's rights

Relatives may exercise access, copying, correction and deletion rights for their own lawful and legitimate interests, unless the deceased arranged otherwise.

Processing definition

Any operation on personal information, including collection, storage, use, processing, transmission, provision, disclosure and deletion.

Minors under fourteen

Personal information of minors under fourteen is treated as sensitive, and consent must be obtained from parents or other guardians.

Seven legal bases

Consent, contract necessity, statutory duty, public health or emergency, news reporting, public opinion supervision, and other circumstances provided by law.

Valid consent

Consent must be voluntary and explicit, given with full knowledge, and obtained through a prominent, clear and easily accessible notice.

Separate consent

A distinct consent is required for sensitive information, third-party provision, public disclosure, and automated decision-making, beyond general processing consent.

Withdrawal of consent

Withdrawal must be as easy as giving consent; processing before withdrawal remains lawful, and prior acts are not affected.

Change of purpose

Consent must be re-obtained when the purpose, method or category of processed personal information changes from the original notice.

Bundled consent ban

Processors may not bundle consent with unrelated services or make consent a condition of service where processing is not necessary.

Consent burden of proof

Where processing relies on consent, the processor bears the burden of proving that valid consent was obtained and can be demonstrated.

Emergency exception

Processing is permitted without consent for public health emergencies or to protect life, property and other vital interests where consent is impossible.

Right to know and decide

Individuals may know how their information is processed and decide whether to allow processing, restrict it, or refuse it.

Deletion request grounds

Deletion may be demanded where the purpose is achieved, service stops, consent is withdrawn, processing is unlawful, or the agreement is breached.

Technically difficult deletion

Where deletion is technically difficult, processing and storage must stop, the information must be protected, and the individual informed.

Access and copy costs

Access and copy requests are answered free of charge; charges apply only to repeated requests beyond a reasonable limit under published standards.

Refusal of a request

A refusal must state reasons, and the individual may complain to the competent authority or bring a lawsuit in court.

Automated decision refusal

Individuals may refuse decisions made solely by automated means that significantly affect their rights, and may demand an explanation.

Portability right

Individuals may obtain their information in a structured, commonly used, machine-readable format and request transfer to another processor.

Request verification

Processors verify identity to prevent impersonation but may not demand excessive personal data as a condition of handling a request.

Protection officer

Where processing volume reaches the threshold set by the authority, a personal information protection officer must be appointed and filed.

Impact assessment triggers

Required before sensitive information processing, automated decision-making, entrusting, third-party provision, public disclosure, and cross-border transfer.

Record retention period

Impact assessment reports and processing records must be kept for at least three years after the processing activity ends.

Entrusted processing

A written agreement must specify purpose, period, method and protection measures; the entrusted party processes only as instructed.

Third-party provision

The individual must be told the recipient's name and contact details, purpose and method, and separate consent must be obtained.

Cross-border transfer

Requires a security assessment, professional certification, or filed standard contract, plus separate consent and notification of the overseas recipient.

Breach notification

The processor must take immediate remedial measures and notify the authority and affected individuals of the cause, harm and remedies.

Joint processors

Two or more processors jointly determining purpose and method must agree on obligations and bear joint liability for harm caused.

Maximum administrative fine

Serious violations may bring fines up to RMB 50 million or five percent of the prior year's turnover, plus suspension or licence revocation.

Fault-based liability

In compensation disputes the processor must prove it is not at fault; otherwise it bears liability for harm caused to the individual.