What is China’s PIPL?
PIPL is the Personal Information Protection Law of the People’s Republic of China, effective November 1, 2021. China’s PIPL is similar to GDPR and other international privacy laws protecting the privacy and security of personal information of individuals in China.
When might PIPL apply to my Yale activities?
PIPL applies to individuals or organizations that handle identifiable personal information of individuals located in China. Yale researchers or programs that collect identifiable personal information of individuals who are located are China are required to comply with the new law.
What is Identifiable Personal Data under PIPL?
Any information about a person where it is possible to identify a certain natural person is considered to be identifiable personal data. This definition would include data that includes names, email addresses, identification numbers as well as data that is pseudonymized with a code that would link the data to identifiers.
In addition, certain personal information is considered to be sensitive and require additional protection. Information that if disclosed inappropriately may lead to personal discrimination or harm is considered to be sensitive. Sensitive data includes biometric information, religious beliefs, race & ethnicity, medical health information, financial information, location tracking and information on minors under 14 years of age.
What is required under China’s PIPL?
PIPL has a number of requirements including:
- Explicit consent for each proposed use and the export of personal information outside China.
- Secure storage and transmission of the data
- Breach reporting
- Timely response to data subject rights requests
- Requirements to register a local data contact
What steps should I take if a Yale project will involve collection of data about individuals in China?
The PIPL is a new law and some aspects are still in development. If you are or plan to collect data on individuals in China, please contact IOCC@yale.edu for assistance.