Clarifications of Legal Bases for Cross-Border Data Transfers in Landmark Judgment by the Guangzhou Internet Court in China

By: Sarah Kwong, Dan Wu, and Amigo Lan Xie

The Guangzhou Internet Court in China (Court) issued a landmark judgment under the Personal Information Protection Law (PIPL) (Judgment). This marked the first court decision in China regarding cross-border personal information transfers. In the case, the plaintiff expressed concerns about his personal information being transferred internationally without his explicit consent, while the defendants argued that the data processing was necessary for contractual obligations and aligned with industry standards.

The Judgment sheds light on the complexities of PIPL, emphasizing the balance between individual privacy rights and multinational companies’ operational needs. Key issues addressed include the actionability of the case, legal bases for data processing, necessity of informed consent, criteria for determining damages, and compliance requirements for cross-border personal information transfers.

The Court clarified that while consent is a crucial legal basis for data processing, contractual necessity can also justify processing personal information without consent. However, the Court also emphasized the need for explicit consent for specific cross-border personal information transfers beyond contractual necessity.

The Judgment highlights the significance of localizing global data protection policies to comply with PIPL requirements, stressing the standard of transparent notifications and the need for separate informed consent where cross-border personal information transfers are subject to a data subject’s consent.

As China strengthens its data protection regulations, businesses must proactively adapt their compliance strategies to meet local requirements to navigate the evolving regulatory landscape in China.

Please click here for our team’s more comprehensive article discussing the Judgment and its implications and takeaways.