A MoFo Privacy Minute Q&A: China PIPL Edition (Issue 2)

This is issue #2 of our new A MoFo Privacy Minute Q&A: China PIPL Edition, where we answer questions about China’s Personal Information Protection Law (PIPL) in sixty seconds or less.

Question: Under PIPL, can data be pseudonymized or even anonymized to avoid export control or to mitigate associated compliance risks?

Answer: Anonymization and pseudonymization (which is addressed as “de-identification” in PIPL) are two different concepts and lead to different outcomes:

• Personal information (PI) that has been anonymized (defined in PIPL as the processing of the PI so that it cannot be reversibly recovered to identify a specific natural person) is no longer regulated as PI and therefore is not required to comply with data export restrictions and other PIPL requirements. Note that PIPL does not specify how the non-reversibility criterion will be applied. Technical specifications will likely be issued in the future to address this issue.
• De-identification techniques (for example, tokenization and encryption) are measures that can be adopted to keep PI secure but those measures are reversible. De-identified information is still treated as PI and remains subject to data export restrictions and other PIPL requirements.

Visit our newly launched China Privacy and Data Security Resource Center to stay up to date on legal and business analysis related to the latest China privacy and data topics. Explore our Privacy + Data Security page for additional information from our Privacy Library and Resource Centers for  Cybersecurity, U.S. State Privacy Laws, and the GDPR + European Privacy.