China has passed a new data protection law to protect users’ personal data, state media reported. The new law comes as Chinese tech companies in the country are being re-examined and sets rules for how companies handle user information. The law comes into force on November 1st.
The law – officially known as the Personal Data Protection Act – was passed by China’s lawmakers on Friday, Reuters reported, urging companies to obtain user consent before collecting personal data, and sets out rules on how companies should ensure that the User data will be protected when it is transferred outside of China. Technology companies that handle personal information must hire a nominated person to oversee its protection, and companies must conduct regular audits to ensure they are complying with the law.
In addition, companies that handle user personal data must have a clear and appropriate purpose for it and, according to Reuters, limit it to the “minimum amount necessary to achieve the objectives” in order to process this data.
In a comment by the Chinese state-run media company People’s Court Daily, the National People’s Congress praised the new legislation, Reuters reported.
“Personalization is the result of the user’s choice, and true personalized recommendations must ensure the freedom of the user to choose without being forced to choose,” the comment said. “Therefore, users must be given the right not to use personalized recommendation functions.”