China’s Personal Information Protection Law (PIPL) was enacted on November 1, 2021. The PIPL lays down the fundamental framework for personal information protection in the People’s Republic of China (PRC), providing both principles and specific rules regulating the procedures involved in processing personal information. Hence, compliance in respect of personal information processing has become increasingly important in China.

The recruitment and employment of individuals is one area of business where collecting personal information is essential. Companies with many employees have to handle a huge amount of personal information, which makes corporate data compliance more challenging. Below, you can find a discussion of some of the key issues connected with different procedures for conducting personal information compliance in the context of employment.

Collection of personal information

If a company wants to legally collect personal information from its job candidates or employees, it has to obtain one of the preconditions set out in Article 13 of the PIPL.

Article 13 of the PIPL sets out three main ways for companies to gain a legal basis for collecting employees’ personal information:

1. Obtain the individual’s consent;
2. The collection is necessary for (a) performing an agreement to which the individual concerned is a party, or (b) implementing HR management rules in line with the labor rules formulated in accordance with the law  and with legally concluded collective contracts;
3. The collection is necessary for the performance of statutory obligations.

In the context of (2) or (3), companies do not need the individual’s consent when collecting personal information. But the scope of collection is strictly restricted. Article 8 of the Implementation Regulations for the PRC Labor Contract Law provides that a labor contract must contain the employee’s personal information, including the name, ID card number, address, contact information, etc. Article 72 of the Labor Law of the PRC stipulates that an employer and its employees must participate in China’s social insurance schemes and pay social security premiums in accordance with law. So it is legitimate for companies to collect certain required personal information without consent when entering into labor contracts with their newly-recruited employees or when paying social insurance for their employees.

However, companies usually collect more personal information in order to fulfill their HR management requirements. For example, a company often collects a lot of information when doing background checks for potential employees or when purchasing business insurance for employees. The “notice-and-consent” model is preferable; employers can clearly inform employees through written notices of all the details about the personal information collection and obtain explicit consent, which greatly reduces the chance of ambiguity. Therefore, it is recommended that companies attach notices to labor contracts. It is also important to point out that companies need to obtain a separate consent from employees when collecting sensitive personal information.

It is also possible for companies to set up facial recognition access control systems and surveillance cameras in the company for security management. Article 26 of the PIPL specifies that such technical equipment in public places may only be used for maintaining public security and only with conspicuous signage informing employees of this use. All personal images and personal identification information collected may only be used for the purpose of maintaining security except when the individual provides a separate consent.

Storage and deletion of personal information

In terms of the storage location, Article 40 of the PIPL provides that Critical Information Infrastructure Operators (CIIOs) and personal information handlers (Handlers) that handle personal information in an amount prescribed by the Cyberspace Administration of China (CAC) must store all personal information collected and generated within the PRC in the PRC. Even if companies are not CIIOs or Handlers, it is still suggested that they store employees’ personal information collected within the territory of China in China.

Regarding the retention period, Article 19 of the PIPL specifies that Handlers must store personal information for the minimum period necessary for achieving the purposes of the handling unless otherwise prescribed by law. Companies should delete or anonymize personal information in a timely manner, especially the personal information of previous job interviewees and former employees.

Cross-border transfers of personal information

Multinational companies may need to transfer employees’ personal information to other countries. There are several key steps in making cross-border data transfers. According to the PIPL, companies shall initially obtain the employees’ consent and complete a corresponding impact assessment on personal information protection. Next, in accordance with Article 38 of the PIPL, companies shall fulfill one of the following conditions:

1. Complete the CAC security assessment;
2. Obtaining a certificate for personal information protection from an agency specified by the CAC;
3. Enter into a contract with a foreign data recipient in line with the CAC’s standard contract;
4. Other conditions prescribed by law and the CAC’s administrative rules.

In conclusion, corporate personal information compliance consists of many components, and companies have the obligations to handle many different types of employee personal information differently, according to the law. Therefore, it is recommended that companies establish a tailored-made data classification system that will ultimately facilitate data compliance procedures.