The Leading News & Information Service For The Facilities, Workplace & Built Environment Community

Why Does China's New Data Protection Law Matter to the UK Property Sector?

Why Does China's New Data Protection Law Matter to the UK Property Sector?
16 September 2021
 

China's new Personal Information Protection Law came in on August 20 – find out what the repercussions are for UK property owners.

David Smith specialises in property rights and agency and has experience in a wide range of property litigation. He also has substantial expertise in regulatory matters relating to property issues and has significant expertise in advising on the GDPR and its application in the UK and Europe. David joined JMW in April 2020 in the Commercial Litigation Department.

 

"Most UK developers and agents are not formally established in China and will use local agents or visits to trade shows or events to attract investors. Some of these practices will need to change."

 

Personal Information Protection Law (PIPL)

 

The People’s Republic of China passed the Personal Information Protection Law (PIPL). This legislation had been seen as being stalled and there was speculation about an extended delay but it was brought back to life in the early part of the summer and pushed through rapidly. 

It may seem a bit irrelevant to the UK what is happening to personal data in China. However, just like the GDPR, the PIPL has extra-territoriality provisions. In other words, if you are dealing with the data of any individual who is resident in China in order to sell goods or services to those residents them you must still comply with the PIPL, even if you are not based in China.

This is of course the same as provisions in the GDPR which state that anyone dealing with EU or UK residents’ data must comply with the GDPR even if they are established in another country. For businesses compliant with the GDPR such obligations are not usually a major concern as the GDPR generally has more onerous requirements than most other data protection regimes so compliance with the GDPR will tend to lead to compliance with other regimes.

However, it is worth noting that if the UK government carries through its proposals to soften the GDPR regime in the UK then there is a risk that it will be less onerous than the regime in other countries and so full compliance with the UK GDPR will not necessarily mean compliance with other regimes, including that in China.

 

Image

Picture: a photograph of David Smith

 

Appointing a Data Protection Representative

 

However, China has also replicated another important provision from the UK and EU GDPR, that of data protection representatives. So, if a company deals with the data of Chinese residents then if it is not established in China it must appoint a data protection representative who is. Again, this is equivalent to similar provisions in the GDPR which require foreign-established firms to have data protection representatives in the UK or EU.

However, this is actually of substantial importance to the UK property sector. This is because a great many new build residential developments will market and sell units to individual investors in China, often at a very early stage in the development. Indeed, these off-plan sales are a key part of the funding stream for many developers providing an injection of cash early in the build process. There are developers and estate and lettings agents who specifically cater to and target the Chinese market. Therefore, they will be looking to sell property and associated services to Chinese nationals and will be obtaining personal data of Chinese residents which will put them squarely within the ambit of the PIPL.

Most UK developers and agents are not formally established in China and will use local agents or visits to trade shows or events to attract investors. Some of these practices will need to change. An agent or developer who is dealing with Chinese residents as part of their business will need to be established in China or have an appropriate data protection representative who is so established.

That representative will need to be clearly identified both to individuals whose data is being processed and also to the relevant Chinese authorities. This will be an additional overlay on top of the GDPR. Processing in the UK or EU will mean that the GDPR will apply while processing Chinese resident’s data will mean the PIPL will apply as well. This will mean that Chinese residents having their data processed by UK or EU companies will be able to avail themselves of rights under both the GDPR and the PIPL. Where data is being transferred outside China, the PIPL requires that an impact assessment is performed in relation to that processing which must be retained for at least three years.

 

Use of Consent

 

There are specific requirements of the PIPL which are different from the GDPR which will need to be considered. One of the most important is the use of consent. Generally, the GDPR has moved away from consent as a primary means of authorising the processing of personal data, especially where there are other processing bases such as a contractual relationship or the legitimate interest of the processor or a third party. The PIPL does not allow for data processing for legitimate interests and so consent will be needed for processing which is not directly connected to the contract being entered into or to comply with a legal obligation, such as money laundering checks. Consent is also required for all processing of more sensitive data, such as financial information.

As with the GDPR there is an obligation to notify the appropriate Chinese data protection regulator of a data breach. This will mean that organisations subject to the GDPR and the PIPL may find themselves making two sets of reports in the event of a data breach. One to the ICO or other relevant European regulator and a similar report to the Chinese regulator. This leads to the obvious risk that the two regulators might then require corrective action that is at odds. 

Failure to comply can lead to substantial fines being levied in China or restrictions on trading activities. Fines can also be levied directly on the relevant Chinese representative as well and so it may be difficult for non-Chinese businesses to find a local representative for PIPL purposes.

Businesses seeking to trade in China will need to act quickly as the PIPL comes into effect on 1 November 2021. They will need to either establish their own offices in China or find an appropriate PIPL representative. Documents to provide the specific information required by the PIPL and to secure consent in the correct fashion will also need to be prepared.

The PIPL should really be seen as part of an ongoing international move toward greater data regulation. Businesses looking to trade across borders will need to be increasingly aware of the requirements in each country that they are seeking to trade-in.

Picture: a photograph of some squares in a light show

Article written by David Smith  | Published 16 September 2021

Share



Related Articles

Building Collapses in China’s Hunan Province

A residential building in Changsha, in central China's Hunan Province, has collapsed. According to state broadcaster CGTN, the building in Changsha's...

 Read Full Article
Leeds Development First Outside London to Achieve NABERS 5 Star Target

A new development in the heart of Leeds, 11 & 12 Wellington Place, has been officially confirmed as one of the UK’s most sustainable office buildings. With a...

 Read Full Article
A New Methodology to Measure EPC Ratings – What is SAP 11?

The government’s current system for assessing the energy performance of UK homes is to be overhauled over the next three years. In collaboration with the...

 Read Full Article
Deepki Achieves Highest-Ever ClimateTech SAAS Fundraising in the Real Estate Sector

Deepki, an ESG data intelligence platform for the real estate sector, has raised €150 million in a Series C round of funding.  This is the largest ever...

 Read Full Article
Schroders Capital Obtains Planning Consent for 3 Ruskin Square

Detailed planning consent has been secured from Croydon Council for 3 Ruskin Square, a 14-storey office building adjacent to East Croydon Station. The building,...

 Read Full Article
FT Reports Prologis Bid on Blackstone’s Logistics Business

According to the Financial Times, Prologis has made a bid on Blackstone’s €21 billion logistics and warehouse arm. Prologis has allegedly made “a...

 Read Full Article
Stiles Harold Williams Appoints Head of FM and Sustainability

Stiles Harold Williams Partnership has appointed Tarniah Thompson as its Head of FM & Sustainability. Based in the London office of Stiles Harold Williams...

 Read Full Article
Madison International Realty Invests in 105 Victoria Street

Madison International Realty has invested in 105 Victoria Street, the UK's largest net-zero office development. This is in addition to the funding from Welput, the...

 Read Full Article
EPC Ratings for Commercial Buildings – What's Changing?

New research has revealed that thousands of commercial properties across the UK won’t meet new energy efficiency regulations, incurring fines for landlords,...

 Read Full Article
Real Estate Operations in Russia – The Industry Reacts

Several major players in the global real estate market have published statements on their stance on business operations in Russia.   CBRE to Discontinue Most...

 Read Full Article