The Leading News & Information Service For The Facilities, Workplace & Built Environment Community

Why Does China's New Data Protection Law Matter to the UK Property Sector?

Why Does China's New Data Protection Law Matter to the UK Property Sector?
16 September 2021
 

China's new Personal Information Protection Law came in on August 20 – find out what the repercussions are for UK property owners.

David Smith specialises in property rights and agency and has experience in a wide range of property litigation. He also has substantial expertise in regulatory matters relating to property issues and has significant expertise in advising on the GDPR and its application in the UK and Europe. David joined JMW in April 2020 in the Commercial Litigation Department.

 

"Most UK developers and agents are not formally established in China and will use local agents or visits to trade shows or events to attract investors. Some of these practices will need to change."

 

Personal Information Protection Law (PIPL)

 

The People’s Republic of China passed the Personal Information Protection Law (PIPL). This legislation had been seen as being stalled and there was speculation about an extended delay but it was brought back to life in the early part of the summer and pushed through rapidly. 

It may seem a bit irrelevant to the UK what is happening to personal data in China. However, just like the GDPR, the PIPL has extra-territoriality provisions. In other words, if you are dealing with the data of any individual who is resident in China in order to sell goods or services to those residents them you must still comply with the PIPL, even if you are not based in China.

This is of course the same as provisions in the GDPR which state that anyone dealing with EU or UK residents’ data must comply with the GDPR even if they are established in another country. For businesses compliant with the GDPR such obligations are not usually a major concern as the GDPR generally has more onerous requirements than most other data protection regimes so compliance with the GDPR will tend to lead to compliance with other regimes.

However, it is worth noting that if the UK government carries through its proposals to soften the GDPR regime in the UK then there is a risk that it will be less onerous than the regime in other countries and so full compliance with the UK GDPR will not necessarily mean compliance with other regimes, including that in China.

 

Image

Picture: a photograph of David Smith

 

Appointing a Data Protection Representative

 

However, China has also replicated another important provision from the UK and EU GDPR, that of data protection representatives. So, if a company deals with the data of Chinese residents then if it is not established in China it must appoint a data protection representative who is. Again, this is equivalent to similar provisions in the GDPR which require foreign-established firms to have data protection representatives in the UK or EU.

However, this is actually of substantial importance to the UK property sector. This is because a great many new build residential developments will market and sell units to individual investors in China, often at a very early stage in the development. Indeed, these off-plan sales are a key part of the funding stream for many developers providing an injection of cash early in the build process. There are developers and estate and lettings agents who specifically cater to and target the Chinese market. Therefore, they will be looking to sell property and associated services to Chinese nationals and will be obtaining personal data of Chinese residents which will put them squarely within the ambit of the PIPL.

Most UK developers and agents are not formally established in China and will use local agents or visits to trade shows or events to attract investors. Some of these practices will need to change. An agent or developer who is dealing with Chinese residents as part of their business will need to be established in China or have an appropriate data protection representative who is so established.

That representative will need to be clearly identified both to individuals whose data is being processed and also to the relevant Chinese authorities. This will be an additional overlay on top of the GDPR. Processing in the UK or EU will mean that the GDPR will apply while processing Chinese resident’s data will mean the PIPL will apply as well. This will mean that Chinese residents having their data processed by UK or EU companies will be able to avail themselves of rights under both the GDPR and the PIPL. Where data is being transferred outside China, the PIPL requires that an impact assessment is performed in relation to that processing which must be retained for at least three years.

 

Use of Consent

 

There are specific requirements of the PIPL which are different from the GDPR which will need to be considered. One of the most important is the use of consent. Generally, the GDPR has moved away from consent as a primary means of authorising the processing of personal data, especially where there are other processing bases such as a contractual relationship or the legitimate interest of the processor or a third party. The PIPL does not allow for data processing for legitimate interests and so consent will be needed for processing which is not directly connected to the contract being entered into or to comply with a legal obligation, such as money laundering checks. Consent is also required for all processing of more sensitive data, such as financial information.

As with the GDPR there is an obligation to notify the appropriate Chinese data protection regulator of a data breach. This will mean that organisations subject to the GDPR and the PIPL may find themselves making two sets of reports in the event of a data breach. One to the ICO or other relevant European regulator and a similar report to the Chinese regulator. This leads to the obvious risk that the two regulators might then require corrective action that is at odds. 

Failure to comply can lead to substantial fines being levied in China or restrictions on trading activities. Fines can also be levied directly on the relevant Chinese representative as well and so it may be difficult for non-Chinese businesses to find a local representative for PIPL purposes.

Businesses seeking to trade in China will need to act quickly as the PIPL comes into effect on 1 November 2021. They will need to either establish their own offices in China or find an appropriate PIPL representative. Documents to provide the specific information required by the PIPL and to secure consent in the correct fashion will also need to be prepared.

The PIPL should really be seen as part of an ongoing international move toward greater data regulation. Businesses looking to trade across borders will need to be increasingly aware of the requirements in each country that they are seeking to trade-in.

Picture: a photograph of some squares in a light show

Article written by David Smith  | Published 16 September 2021

Share



Related Articles

Commercial Landlords – Priorities and Challenges in 2023

Nationwide research amongst property investors has revealed that one of their most significant challenges is the drive to upgrade their portfolio’s energy...

 Read Full Article
Great Portland Estates Acquires Two Central London Offices

Great Portland Estates has bought two Central London office buildings for £53 million. Bramah House, 65/71 Bermondsey Street, SE1 and  141 Wardour Street,...

 Read Full Article
Demand for Digital Infrastructure Drives Data Centre Uptake

A research paper from JLL shows that the mass adoption of cloud computing and AI is driving growth in the data centre industry. According to JLL’s Global Data...

 Read Full Article
Commercial Property Sales Data Shows 'It's a Buyer's Market'

A survey of UK commercial estate agents shows that commercial property sales price per square foot are set to fall by 1.6 per cent, as the market shows signs of...

 Read Full Article
Transport for London Signs Deal With Helical for Over-Station Offices

Transport for London is to partner with Helical to create a new sustainable commercial office portfolio across central London. TTL Properties Ltd, the property arm of...

 Read Full Article
Clean Heating Policies Improve Air Quality in Northern China

China’s centralised winter heating strategy has helped to prevent over 23,000 fewer premature deaths in 2021 than in 2015, a new study has revealed. From 2015 to...

 Read Full Article
Spotlight Interview Part One – James Massey | MRI Software

MRI Software is a global name in real estate technology. We spoke to James Massey, Managing Director of Facilities Management for MRI Software, about his career so far,...

 Read Full Article
BBP Launches Guide for Real Estate Climate Change Resilience

The Better Buildings Partnership (BBP) has launched a new guide for BBP Climate Commitment signatories and other real estate companies on climate...

 Read Full Article
deVere Group Pulls All UK Property Investment Projects

deVere Group will temporarily close its property investment division with immediate effect. The finance firm’s Investment Director cited the “availability...

 Read Full Article
Will HSBC Leave its Iconic Canary Wharf Home?

Leaked memos suggest that the banking giant is considering whether to keep its global HQ at HSBC Tower when the lease expires in 2027. HSBC has occupied the 45-storey...

 Read Full Article