Personal Data Protection (Chinese-English Comparison)

Author: Zhang Xinbao
Reviewers:
Publisher:
Publish Date: 2006-11-01
Features: Personal data protection and privacy rights are not new concepts. However, since privacy rights were proposed over a hundred years ago, there has been little change at the fundamental level: the task of the discipline under the title "data protection" remains to ensure that everyone has the right to self-determination regarding personal information related to them. In the era we call the "information society," the new problem is that there are clearly so many ways to collect, store, and publish personal information. The traces we leave while surfing the internet can be read more clearly than footprints in fresh snow: this can be to our advantage (when online retailers know our preferences and improve the information they provide to us) or to our disadvantage (when malware tracks our usage patterns and passwords and sends "private" information to abusers). Someone who once registered for an online newsletter or participated in a competition online may have experienced personal data appearing through unexpected channels: you enter a television streaming website, and it returns to you a surprising amount of unwanted commercial emails or popular product information specifically targeted at your region. The information society is sometimes also called the "information jungle," which is not just about the difficulty of finding imports and exports, but also means that to discover something very valuable and useful—information—in there, one must engage in a brutal struggle with the jungle beasts.
Personal data protection and privacy rights are not new concepts. However, since privacy rights were proposed over a hundred years ago, there has been little change at the fundamental level: the task of the discipline under the title "data protection" remains to ensure that everyone has the right to self-determination regarding personal information related to them. In the era we call the "information society," the new problem is that there are clearly so many ways to collect, store, and publish personal information. The traces we leave while surfing the internet can be read more clearly than footprints in fresh snow: this can be to our advantage (when online retailers know our preferences and improve the information they provide to us) or to our disadvantage (when malware tracks our usage patterns and passwords and sends "private" information to abusers). Someone who once registered for an online newsletter or participated in a competition online may have experienced personal data appearing through unexpected channels: you enter a television streaming website, and it returns to you a surprising amount of unwanted commercial emails or popular product information specifically targeted at your region. The information society is sometimes also called the "information jungle," which is not just about the difficulty of finding imports and exports, but also means that to discover something very valuable and useful—information—in there, one must engage in a brutal struggle with the jungle beasts.
The legitimacy of privacy rights does not need to be proven. It stems from the right of individuals to self-determination, and this right is based on the idea that the individual is the ultimate and sole source of legitimacy (which can be called a "methodology of individualism"). This means that as a fundamental principle, everyone has the right to self-determination over what personal data can be collected, stored, or published. Recently, the Federal Constitutional Court of Germany once again emphasized that privacy rights have a core component that no state may infringe upon. Since the 1980s, privacy rights have held the status of fundamental human rights in the EU. However, why ensuring privacy and protecting personal data is a core concern for everyone in the process of social modernization has very practical, factual, and commercial reasons. The lack of such protection would lead to a lack of trust between business partners in e-commerce and between citizens and the government in e-government. Online users would doubt that online retailers would sell their data to other companies, which would then launch anonymous spam campaigns via email or other conventional methods. As a result, online users would abandon providing their data (knowing and the risk). Citizens would doubt that housing authorities would share their data with tax authorities, and as a result, citizens might first reconsider registering when moving to a new home.
Most potential beneficial inventions of the information society (e-government, e-commerce, e-social networks, online participation, etc.) depend on mutually trustworthy commitments that personal data will not be used for purposes consent. This is even more important because it sometimes conflicts with efforts to make processes more efficient and citizen-friendly. For example, the electronic government one-stop shop must integrate the back-office processes of different government departments. A necessary step in these integrations is establishing a single database to gather information stored by departments such as tax authorities, housing authorities, and public health departments. Clear and explicit institutional frameworks and regulations are needed here. Balancing these conflicting objectives is what data protection laws and regulations aim to address. A perfect data protection system would create an environment where, on one hand, it encourages the use of electronic communication methods, and on the other, individuals retain primary control over the use of their data (and they can also influence this balance, for example, if companies are willing to share benefits with affected individuals by consciously allowing the sale of personal information to "affiliate partners" in e-commerce and thus affecting this balance).
Does the EU have a perfect data protection system? No. There is no perfect solution to such a complex issue. However, the EU has relatively comprehensive systems to protect personal data and ensure privacy. Further detailed review is needed to determine which theoretical and practical considerations can be introduced into China's personal data protection regulations. EU countries have numerous privacy and data protection regulations, not all of which originate from EU institutions (the Organization for Economic Cooperation and Development, the European Parliament, and the United Nations have all adopted highly relevant principles of core data protection rules). The 1995 EU Data Protection Directive is the cornerstone of EU data protection regulations. It established a series of principles and rules that all member states must implement. It ensures the free flow of data within the EU and sets common standards for personal data protection. The principles it establishes apply to all areas of private or commercial life.
One of the fundamental principles may be Article 7, which states that the processing of personal data is generally an exception that requires justification (similar to and substantially akin to the provisions typically found in freedom of information laws, which establish transparency principles and require justification for retaining information). Since 2002, the Privacy and Electronic Communications Directive (following earlier telecom service provisions) has supplemented the general directive by explicitly defining privacy provisions for all forms of electronic communication. Although the interdependence between these two main data protection directives is sometimes debated among experts, these documents have proven to be crucial in establishing the institutional framework for the European information society.
Personal data protection will always be a hot topic of discussion. With the emergence of new technologies, new policy issues, or new approaches (such as RFID, counterterrorism efforts, e-government integration projects, to name a few examples), the basic principles need to be continuously interpreted. If the principles are good and strong, they will withstand these challenges and not only guide EU member states but also provide good examples for other countries willing to share this experience.
The EU-China Information Society Project was initiated to support this knowledge sharing. It aims to support China's economic and social reforms by fostering the information society through joint efforts by the European Commission and the Chinese government. Part of the project focuses on supporting specific government projects in all partner cities in China. The other part includes the regulatory environment of the information society, striving to support the establishment of a sound, comprehensive legal and policy system to allow all members of society to derive the maximum specific benefits from what is called the information society. Supporting the development of personal data protection policies is part of this effort.
Of course, there is no doubt that the EU and China's current and future data protection systems will have some significant differences: one important difference is that the EU is not a single country, and the subsidiary principle that is in all EU policies leads to different institutional approaches to ensuring privacy. This is why it is not only necessary to examine EU-level regulations but also to examine how different member states implement these regulations, i.e., how data protection is interpreted differently within Europe. These interpretations will show very interesting aspects for those examining the EU from the outside and looking for useful principles and details that can be transferred to their own societies. Publications like this one play an important role in this regard. They enable both sides to discuss the same basic documents and principles without language barriers. This will become a valuable starting point for developing China's future personal data protection system.
Clearly, drafting and passing a law is only one element of establishing a credible and reliable data protection system. Industry efforts, such as behavioral codes, privacy education for users on how to use their data cautiously, and the development of privacy-enhancing technologies in hardware and software, will play equally important roles. The EU-China Information Society Project hopes to contribute to these aspects and support China in establishing a comprehensive personal data protection system.