Why Does China's New Data Protection Law Matter to the UK Property Sector?

• Content
• Legal
• Why Does China's New Data Protection Law Matter to the UK Property Sector?

16 September 2021

China's new Personal Information Protection Law came in on August 20 – find out what the repercussions are for UK property owners.

David Smith specialises in property rights and agency and has experience in a wide range of property litigation. He also has substantial expertise in regulatory matters relating to property issues and has significant expertise in advising on the GDPR and its application in the UK and Europe. David joined JMW in April 2020 in the Commercial Litigation Department.

"Most UK developers and agents are not formally established in China and will use local agents or visits to trade shows or events to attract investors. Some of these practices will need to change."

Personal Information Protection Law (PIPL)

The People’s Republic of China passed the Personal Information Protection Law (PIPL). This legislation had been seen as being stalled and there was speculation about an extended delay but it was brought back to life in the early part of the summer and pushed through rapidly. 

It may seem a bit irrelevant to the UK what is happening to personal data in China. However, just like the GDPR, the PIPL has extra-territoriality provisions. In other words, if you are dealing with the data of any individual who is resident in China in order to sell goods or services to those residents them you must still comply with the PIPL, even if you are not based in China.

This is of course the same as provisions in the GDPR which state that anyone dealing with EU or UK residents’ data must comply with the GDPR even if they are established in another country. For businesses compliant with the GDPR such obligations are not usually a major concern as the GDPR generally has more onerous requirements than most other data protection regimes so compliance with the GDPR will tend to lead to compliance with other regimes.

However, it is worth noting that if the UK government carries through its proposals to soften the GDPR regime in the UK then there is a risk that it will be less onerous than the regime in other countries and so full compliance with the UK GDPR will not necessarily mean compliance with other regimes, including that in China.

Picture: a photograph of David Smith

Appointing a Data Protection Representative

However, China has also replicated another important provision from the UK and EU GDPR, that of data protection representatives. So, if a company deals with the data of Chinese residents then if it is not established in China it must appoint a data protection representative who is. Again, this is equivalent to similar provisions in the GDPR which require foreign-established firms to have data protection representatives in the UK or EU.

However, this is actually of substantial importance to the UK property sector. This is because a great many new build residential developments will market and sell units to individual investors in China, often at a very early stage in the development. Indeed, these off-plan sales are a key part of the funding stream for many developers providing an injection of cash early in the build process. There are developers and estate and lettings agents who specifically cater to and target the Chinese market. Therefore, they will be looking to sell property and associated services to Chinese nationals and will be obtaining personal data of Chinese residents which will put them squarely within the ambit of the PIPL.

Most UK developers and agents are not formally established in China and will use local agents or visits to trade shows or events to attract investors. Some of these practices will need to change. An agent or developer who is dealing with Chinese residents as part of their business will need to be established in China or have an appropriate data protection representative who is so established.

That representative will need to be clearly identified both to individuals whose data is being processed and also to the relevant Chinese authorities. This will be an additional overlay on top of the GDPR. Processing in the UK or EU will mean that the GDPR will apply while processing Chinese resident’s data will mean the PIPL will apply as well. This will mean that Chinese residents having their data processed by UK or EU companies will be able to avail themselves of rights under both the GDPR and the PIPL. Where data is being transferred outside China, the PIPL requires that an impact assessment is performed in relation to that processing which must be retained for at least three years.

Use of Consent

There are specific requirements of the PIPL which are different from the GDPR which will need to be considered. One of the most important is the use of consent. Generally, the GDPR has moved away from consent as a primary means of authorising the processing of personal data, especially where there are other processing bases such as a contractual relationship or the legitimate interest of the processor or a third party. The PIPL does not allow for data processing for legitimate interests and so consent will be needed for processing which is not directly connected to the contract being entered into or to comply with a legal obligation, such as money laundering checks. Consent is also required for all processing of more sensitive data, such as financial information.

As with the GDPR there is an obligation to notify the appropriate Chinese data protection regulator of a data breach. This will mean that organisations subject to the GDPR and the PIPL may find themselves making two sets of reports in the event of a data breach. One to the ICO or other relevant European regulator and a similar report to the Chinese regulator. This leads to the obvious risk that the two regulators might then require corrective action that is at odds. 

Failure to comply can lead to substantial fines being levied in China or restrictions on trading activities. Fines can also be levied directly on the relevant Chinese representative as well and so it may be difficult for non-Chinese businesses to find a local representative for PIPL purposes.

Businesses seeking to trade in China will need to act quickly as the PIPL comes into effect on 1 November 2021. They will need to either establish their own offices in China or find an appropriate PIPL representative. Documents to provide the specific information required by the PIPL and to secure consent in the correct fashion will also need to be prepared.

The PIPL should really be seen as part of an ongoing international move toward greater data regulation. Businesses looking to trade across borders will need to be increasingly aware of the requirements in each country that they are seeking to trade-in.

Picture: a photograph of some squares in a light show

Article written by David Smith  | Published 16 September 2021

Share

Related Articles