Publication
Mission impossible? Teresa Ribera’s mission letter and the future of EU merger review
Executive Vice President Vestager’s momentous tenure as Commissioner responsible for EU competition policy is nearing its end.
China issues revised draft of the personal information security specification for consultation
China | Publication | March 2019
On February 1, 2019, the PRC State Administration for Market Regulation and the PRC Standardisation Administration jointly issued a draft Information Security Technology – Personal Information Security Specification (the Personal Information Security Specification or the Updated Version), along with a request for public comments.
The draft Personal Information Security Specification is an updated version of an earlier specification, which had become effective on May 1, 2018 (the Original Version). The Updated Version further implements requirements of personal data protection under the PRC Cyber Security Law, and is in line with relevant PRC laws issued recently – for example, the PRC E-Commerce Law (effective as of January 1, 2019).
Compared with the Original Version, the Updated Version includes the following major changes.
The Updated Version adds a definition of “personalised display” and regulations relating to this new concept.
Under the Updated Version
The Updated Version provides for certain rules in situations where personal data is collected for a third party product or service that has been incorporated or inserted into the master product or service.
In such situation, the data controller of the master product or service must
The Updated Version enhances risk management requirements for data controllers by laying down obligations for setting up a personal information security committee or designated personnel in charge of personal data protection, and their respective responsibilities and liabilities for personal data protection matters.
It has been just nine months since the Original Version was implemented that an Updated Version is now subject to consultation. This reflects the efforts made by Chinese regulators to promulgate new rules to improve regulation of personal data matters, and is aligned with multiple enforcement activities undertaken by Chinese authorities in the past months.
Although the Updated Version is still in draft form, we expect that the Personal Information Security Specification will soon be finalised and take effect. Once that occurs, it ought to be regarded as an example of good practice and practical supplementation guidance for personal information protection under the framework and requirements of the PRC Cyber Security Law.
It is possible, however, that the Updated Version could still be subject to further change before it is finalised. We will monitor any changes in relation to the Updated Version and other Chinese data and cybersecurity regulatory requirements and provide corresponding updates where appropriate.
Publication
Executive Vice President Vestager’s momentous tenure as Commissioner responsible for EU competition policy is nearing its end.
Publication
On 10 October 2024, the UK government published its long awaited response (the Response) to its January 2024 consultation on “Designing a policy framework to enable investment in long duration electricity storage” (the Consultation).
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023