China: Adopted Data Regulations of the Shenzhen Special Economic Zone

On 29 June 2021, the Shenzhen Municipal People’s Congress adopted the Shenzhen Special Economic Zone Data Regulations. The act covers data rights, data processing, data sharing and introduces requirements for data management and security. It introduces the right to informed consent, consent withdrawal and gives users the option to refuse customized recommendations based on their profile analysis. Furthermore, the regulation protects the users' right to access, supplement, copy or delete personal data. In the area of data processing, the regulation states that processing shall be minimized and further rules are provided for special types of personal data. Also, the entities cannot use big data analysis to list different prices. This provision was added to avoid discriminatory pricing towards users. Finally, it introduces new restrictions on data collection and storage, since service providers will be allowed to collect data only if they have a reasonable and clear objective and will be required to delete or anonymize the data if that objective was fulfilled. In general, non-compliance can be sanctioned with a fine of up to 5% of turnover and no more than 50 million yuan. The Data Regulations will enter into force on 1 January 2022.