Draft regulation boosts personal data protection

China's top cyberspace regulator has released a draft regulation that requires major online platforms to establish independent committees to enhance the supervision of personal information protection.

The draft, published by the Cyberspace Administration of China on Friday, is open for public comment until Oct 12.

According to the draft, these committees will be responsible for monitoring a wide range of data protection issues, including the handling of sensitive personal information, compliance with cross-border data transfer rules, responses to data security incidents, and the implementation of regulatory rectification requirements.

"The committees are also expected to establish regular communication channels with users of major online platforms to address concerns regarding personal data protection," it said.

The draft applies to all major online service providers that have a large user base and complex business types. The administration, along with public security departments and other authorities, will formulate and release a list of eligible platforms later.

It added that the committees are required to hold regular meetings at least once every three months to deliberate on matters related to personal information protection oversight and to issue supervisory opinions.

Online platforms must process supervisory opinions issued by the committees within 10 working days. If a platform's reasons for not handling the opinions are deemed invalid by the committee, the matter may be reported to the provincial-level cyberspace regulator.

Each supervision committee shall consist of no fewer than seven members, with at least two-thirds being external experts who are not employed by the platform in any other capacity and possess professional knowledge in personal information protection.

External members must meet strict independence criteria, including having no financial or familial ties to the platform. They are required to be familiar with rules, regulations and national standards on personal information protection and data security, and must have at least three years of relevant working experience.

Online platforms may provide external members with remuneration based on their working hours and workload. Payment standards must be disclosed to the public annually, and external members are prohibited from receiving any other benefits from the platform.

All committee members are to be appointed for three-year terms and may serve a maximum of two consecutive terms.

Wang Zhicheng, deputy director of the administration's data and technology support center, said that the regulation aims to introduce independent external powers to ensure impartiality, effectiveness and transparency of oversight.

He added that the independent committees are expected to bring together external experts specializing in law, technology and public administration who will examine the technical foundations and business processes of platforms, act as whistleblowers and quality inspectors to assess and issue warnings on high-risk data processing activities.