A MoFo Privacy Minute Q&A: China PIPL Edition (Issue 5)

This is issue #5 of A MoFo Privacy Minute Q&A: China PIPL Edition, where we answer questions about China’s Personal Information Protection Law (PIPL) in sixty seconds or less.

Question: What is the difference between “sensitive personal information” and “important data”?

Answer: “Sensitive personal information (PI)” and “important data” are two separate categories of regulated data in China, although their scopes may overlap.

“Sensitive PI” is a term used in PIPL that describes PI the disclosure or illegal use of which may easily lead to the infringement of a natural person’s personal dignity or harm to personal or property safety. It includes information concerning matters such as biometrics, religious beliefs, “specific identity” (a term that is understood to cover personal attributes such as gender identity and sexual preferences), medical health, financial accounts, and whereabouts, as well as PI of minors under 14.

“Important data” is a term used in China’s Cybersecurity Law and Data Security Law, not in PIPL. It refers to data (not only PI) that once falsified, destroyed, leaked, or illegally obtained or illegally used, may endanger national security, economic activity, social stability, or public health and safety. What concretely counts as “important data” is likely to vary with the particular industry sector concerned. Rules governing the automobile sector stipulate in some detail what sector data is regarded as important data. No similar designation has yet been made in other industry sectors.

In some cases, important data will include PI (and sensitive PI). For example, important data in the automobile sector includes PI of more than 100,000 individuals (who are vehicle owners, drivers, occupants, passengers, and persons outside the vehicle).

Visit our newly launched China Privacy and Data Security Resource Center to stay up to date on legal and business analysis related to the latest China privacy and data topics. Explore our Privacy + Data Security page for additional information from our Privacy Library and Resource Centers for Cybersecurity, U.S. State Privacy Laws, and the GDPR + European Privacy.