Adopted at the 3rd Session of the 13th National People’s Congress on May 28, 2020. Effective January 1, 2021.
The Civil Code is China’s first codified civil law. Articles 1032 through 1039 appear in Book IV (Personality Rights), Chapter VI (Right to Privacy and Protection of Personal Information). These eight articles provide the civil-law underpinning for personal-information protection in China — they sit alongside PIPL rather than being superseded by it.
Chapter 6 Right to Privacy and Protection of Personal Information
Article 1032. A natural person shall enjoy the right of privacy. No organization or individual may infringe upon the privacy of any other person by spying, invading and harassing, disclosing or disclosing the relevant information or by any other means. Privacy is a natural person’s private life peace and do not want to know for others private space, private activities, private information.
Article 1033. Unless otherwise prescribed by the law or specifically agreed by the rights holders, no organization or individual may carry out any of the following acts: 1. disturbing the private peace of others by means of telephone, text message, instant messaging tools, e-mails, leaflets, etc.;
(II) Entering, shooting or peeping into the private spaces of others’ houses or hotel rooms;
(III) Photographing, peeping, eavesdropping, or making public the private activities of others;
(IV) taking photos of or peeping at private parts of others’ bodies;
(V) Dealing with the confidential information of others;
(VI) infringing upon the privacy of others by other means.
Article 1034. The personal information of a natural person shall be protected by the law. Personal information refers to all kinds of information recorded by electronic or otherwise that can be used to independently identify or be combined with other information to identify specific natural persons, including the natural persons’ names, dates of birth, ID numbers, biometric information, addresses, telephone numbers, e-mail addresses, health information, whereabouts, etc. For the confidential information included in personal information, the provisions on privacy rights shall apply; if no provisions are available, the provisions on personal information protection shall apply.
Article 1035. The handling of personal information shall be subject to the principle of legitimacy, rightfulness and necessity, shall not involve excessive handling and shall meet the following conditions: 1. unless otherwise provided by laws or administrative regulations, with the consent of the natural person or the guardian thereof; and
(II) rules on disclosure of processing information;
(III) to expressly state the purpose, method and scope of information treatment;
(IV) The provision of the laws and administrative regulations and the agreement of both parties shall not be violated. Personal information processing includes the collection, storage, use, processing, transmission, provision and disclosure of Personal information, etc.
Article 1036. Where the handling of personal information falls under any of the following circumstances, the actor concerned shall not bear civil liability: 1. Acts performed reasonably within the scope agreed by the natural person or his or her guardian;
(II) Deal reasonably with the information made public by the natural person himself or herself or other information that has been legally made public, unless the natural person explicitly refuses to do so or deals with the circumstance where such information infringes upon his or her major interests; and
(III) Other reasonable acts performed to protect the public interests or the legitimate rights and interests of the natural persons.
Article 1037. A natural person may consult or copy his/her personal information with any information processor in accordance with the law; if any error is found in the information, the natural person has the right to raise an objection and request the information processor to take necessary measures such as corrections in a timely manner. Where a natural person discovers that an information processor has processed his/her personal information in violation of the provisions of laws and administrative regulations or the agreement between both parties, he/she shall have the right to request that the information processor promptly delete the information.
Article 1038. Information processors shall not divulge or tamper with personal information collected or stored by them; without the consent of a natural person, information processors shall not illegally provide personal information of such person to others, except for information that has been processed and cannot be identified with specific persons and cannot be restored. An information processor shall take technical measures and other necessary measures to ensure the security of the personal information it collects and stores and to prevent the information from being divulged, tampered with or lost; where personal information has been or may be divulged, tampered with or lost, it shall take remedial measures in a timely manner, inform the natural person concerned in accordance with the provisions and report the case to the relevant competent department.
Article 1039. State organs, statutory agencies with administrative functions and their staff shall keep confidential the privacy and personal information of natural persons that come into their knowledge during the performance of duties, and shall not divulge the same or illegally provide the same to others.