China: Implemented Data Regulations of the Shenzhen Special Economic Zone

On 1 January 2022, the Data Regulation of the Shenzhen Special Economic Zone becomes effective after its adoption on 29 June 2021 by the Municipal People’s Congress. The act covers data rights, data processing, data sharing and introduces requirements for data management and security. It introduces the right to informed consent, consent withdrawal and gives users the option to refuse customized recommendations based on their profile analysis. Furthermore, the regulation protects the users' right to access, supplement, copy or delete personal data. In the area of data processing, the regulation states that processing shall be minimized and further rules are provided for special types of personal data. Also, the entities cannot use big data analysis to list different prices. This provision was added to avoid discriminatory pricing towards users. Finally, the data regulations introduce new restrictions on data collection and storage, since service providers will be allowed to collect data only if they have a reasonable and clear objective and will be required to delete or anonymize the data if that objective was fulfilled. In general, non-compliance can be sanctioned with a fine of up to 5% of turnover and no more than CNY 50 million.