The Cybersecurity Law and protecting employee privacy

Amilestone in network information security and personal privacy protection, the Cybersecurity Law will officially be implemented from 1 June 2017. On 11 April, the State Internet Information Office issued the Measures for Security Assessments of Personal Information and Important Data Sent Abroad (Draft for Comment), launching a one-month process of seeking comment from the public. The draft provides finely detailed requirements in respect of, and guidelines on, the storage, cross-border transmission, security assessment and acceptance of personal information.

The previously published General Provisions of the Civil Code, to be implemented from 1 October 2017, further specify and clearly define that, “the personal information of natural persons is protected by law. Any organization or individual that wishes to obtain the personal information of other persons shall do so in accordance with the law, ensure the security thereof, may not unlawfully collect, use, process or transmit the same, and may not unlawfully buy or sell, provide or disclose the same.”

In such a stringent legislative environment, an employer must attach great importance to the issue of the collection, use and transmission of the personal information of its employees, and establish a compliance mechanism and precautionary measures to increase the protection of the privacy of its employees to avoid potential legal risks.

Patrick Gu is a partner at DaHui Lawyers