The 72-Hour Assumption

PIPL Article 57 requires the handler to take immediate remedial measures, notify the affected individuals, and report to the competent authorities without delay. There is no Chinese statutory 72-hour safe harbor. The 72-hour rule is a GDPR concept and does not displace the PIPL's immediate duty. The company may spend time containing the incident and preserving evidence, but it cannot sit on notification for 11 days or use the GDPR clock to justify delay. The individual notice should state the categories of data, the likely cause, the possible harm, the remedial measures taken, and a contact point for questions. The report to the CAC should include the same core facts, the number of records, the sensitive categories, the containment steps and the vendor involvement. Because 2,000 ID card numbers and 7,500 health-related purchase records are involved, the incident should be treated as a sensitive-PI incident. If the company can show that effective measures prevent harm, Article 57 allows it to omit individual notification, but it must still report to the authorities, and the authorities can order notification. Given the public bucket and the customer post, reliance on that exception is weak. Sectoral rules may impose shorter clocks, so check telecom, finance and health rules. Document every decision and timestamp.

Beyond the security failure under Article 51, the marketing practice creates separate violations. A pre-ticked box is not voluntary and explicit consent under Article 14. Sharing mobile numbers with 45 advertising partners is a provision to third parties under Article 23, which requires separate consent plus notice of each recipient's name and contact details, purpose, method and data categories. A broad “partners” clause does not satisfy that. If the shared data includes sensitive PI such as health-related purchase history, Article 29 separate consent and an Article 55 impact assessment are also missing. Under Article 66 the CAC can order correction, issue a warning, confiscate illegal gains, and impose fines. For serious violations the fine can reach RMB 50 million or 5% of the previous year's turnover, and responsible individuals can be fined up to RMB 1 million; suspension of business or revocation of licenses is possible. Civil liability under Article 69 reverses the burden of proof, and a procuratorate can bring a public-interest suit. Mitigation matters: contain and remediate, preserve logs, notify promptly, cooperate, map data flows, appoint a responsible person if the Article 52 threshold is met, re-paper partner contracts, and obtain fresh consent. Remediation does not erase past violations, but it affects the enforcement outcome.

First, determine the role of each partner. If a partner only processes on Eastbridge's instructions, it is an entrusted processor under Article 21 and needs a written entrustment agreement, security requirements, audit rights and deletion obligations. If a partner uses the data for its own advertising, it is a separate handler and the transfer is a third-party provision under Article 23. The existing broad clause fails because it does not identify recipients or purposes and the pre-ticked box is not valid consent. Eastbridge should suspend new sharing, send stop-processing and deletion notices to the 45 partners, and obtain confirmation. It cannot retroactively cure the past sharing with a new consent, but it can regularize future sharing by giving a clear notice and obtaining separate opt-in consent for each category of recipient or a well-defined category with named partners. It should also offer an easy opt-out and honor refusals. If any partner refuses to delete, escalate and document. The company should update its privacy policy, train marketing staff, and add a vendor register. Because the data includes health-related purchases, any future sharing should be treated as sensitive PI and require separate consent and a DPIA. The CAC will look for whether the company stopped the conduct and fixed the consent design, not just whether it published a new policy.