Set out below are the specific provisions under the China Personal Information Protection Law ("PIPL") that apply to our processing of personal data in China.
Sensitive personal information: Under the PIPL, "Special Category Data" is referred to as "sensitive personal information" and refers to personal information that, once leaked or illegally used, will easily lead to infringement of human dignity or harm to the personal or property safety of a natural person. This includes biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts and personal information relating to minors under 14.
Legal bases for processing personal information: We will only process personal information of individuals in China based on the following legal bases as prescribed under the PIPL: the consent of the data subject; where the processing is necessary for performance of a contract with a data subject, internal employment rules/policies, or a collective contract in accordance with the laws and regulations; where the processing is necessary for performance of legal duties or compliance with legal obligations; where the processing is necessary to respond to public health incidents, or to protect the life, health, and property safety of natural persons in an urgent situation; where the processing is necessary for the public interest to carry out news report and public opinion supervision within a reasonable scope; when processing personal information which is publicly disclosed by the individual himself or herself, or by other persons legally, within a reasonable scope; and other provisions required by the laws and regulations.
Separate consent: In cases of personal information sharing, sensitive personal information processing, public disclosure of personal information, and cross-border data transfers, we will obtain separate consent, in addition to general consent, from the data subject in accordance with the requirement under the PIPL.
Cross-border transfer of personal information: Where we provide personal data to Clifford Chance entities outside China, we will rely on the CAC-approved standard contract which we have entered into with the overseas Clifford Chance entities.
Sharing of information with foreign law enforcement and regulatory authorities: Where it is necessary to share personal information with foreign law enforcement or regulatory authorities, we will obtain prior approval from the Chinese government as required under the PIPL and the China Data Security Law.