EXIN PDPF case studies
EXIN PDPF · Put your knowledge to work in context.
The EXIN Privacy & Data Protection Foundation based on PIPL is a Foundation-level certification on China's Personal Information Protection Law (中华人民共和国个人信息保护法), passed by the Standing Committee of the 13th National People's Congress on August 20, 2021. EXIN states that the certification equips candidates with local knowledge of what the PIPL is and how to lawfully process and protect personal data, and that it also supports comparison of PIPL principles with the GDPR for those who process data across multiple markets. The EXIN PDPF case studies are 5 cases and about 4,398 words.
1The Singapore payroll vendor with a Shanghai support desk
Nestor HR Pte Ltd is incorporated in Singapore and runs a payroll SaaS platform on Singapore servers. It has a Shanghai office of 14 sales and support staff.
822 words, about 4 min2The fitness app that bundled its consents
PulseRun is a Shenzhen-built fitness app with 2.3 million registered users in mainland China. On the single sign-up screen there is one check box reading: 'I agree to the User Agreement, the Privacy Policy, and to sharing my data with our partners.' The app collects step counts, continuous GPS routes, continuous heart rate, menstrual-cycle logs, and the phone's contact list, used for 'friend matching'.
891 words, about 4 min3Surge pricing and the model no one explains
Chuxing is a ride-hailing platform with 40 million riders in 120 Chinese cities. Fares are quoted by a model that uses distance, time of day, the rider's handset model, remaining battery level, historical tipping and a 'member score'; the same score also decides queue priority for cars during rain.
910 words, about 5 min4The courier API leak: 1.18 million waybills
Yousu Express handles last-mile delivery for e-commerce sellers in eastern China. On 3 March a security researcher reported that a cloud storage bucket with public read access had exposed 1,180,000 waybill records accumulated over 14 months.
873 words, about 4 min5Clinical follow-up data leaving for Boston
Shanghai-based MedCare Devices makes infusion pumps and runs a post-market follow-up app used by 62 hospitals. Since 1 January this year the app has enrolled 38,000 patients; 11,400 of those records contain cardiac rhythm readings, implant serial numbers and national ID numbers.
902 words, about 5 min