China’s ‘wild era’ of internet may be ending as new personal data protection law seeks to curb Big Tech’s control over user data

China’s new data privacy laws could see the beginning of the end of the country’s “wild era” of internet development where platforms have been free to collect and use citizens’ personal information.

Legal experts welcomed the draft of the Personal Information Protection Law (PIPL), despite its shortcomings, saying the move is timely and will help push back against big tech’s control over personal data.

Wang Zhicheng, associate professor of finance at the Guanghua School of Management at Peking University, said the past two decades have been a “wild era” for China’s internet, with the big tech platforms operating with few rules to regulate their collection and usage of personal data.

The draft version of the PIPL, which closed for public comments last week, significantly increases penalties for companies responsible for data breaches, proposing fines of up to 50 million yuan (US$7.6 million) or 5 per cent of annual revenue. However, it is short on details of what companies must do to be compliant, putting the onus on them to be extra cautious when handling user data.

“It is imperative that companies formulate or update their data compliance and risk management strategies for the China market,” said Barbara Li, the head of corporate technology, media and telecommunications (TMT) and data practice at professional services firm PwC.

As the world’s most populous country, many of China’s 1.4 billion population are already online but the country has a reputation for lax controls over the collection, storage and use of individual digital data. Existing laws covering cybersecurity and data security do not specifically address personal data protection but authorities, driven by consumer demands for better protection, have regularly launched crackdowns on smartphone apps that collect user data illegally.