中国の個人情報保護法 (PIPL) - IGによるFAQs

注意喚起：PIPLはデータのプライバシーとその保護に関する詳細な規則を定めた中国の包括的な法律で、中国国内の特定可能な個人情報にかかわるすべてのデータ取扱行為に適用されます。 PIPLは 2021年11月1日より施行されています。

IMPORTANT NOTE: PIPL is China’s comprehensive law that sets detailed rules with respect to data privacy and the protection and applies to the processing of personal information and sensitive personal information within the People’s Republic of China (PRC). PIPL came into effect on 1 November 2021.

The PIPL defines ‘personal information’ as “all information related to identified or identifiable natural persons” but excludes information which is anonymised (information that cannot be used to identify a specific natural person and cannot be restored after being so anonymised).

Please see below the implications that this law may have on shipowners, managers, and their correspondents in the PRC. The FAQs are intended to provide guidance and should not be regarded as providing definitive legal advice.

1. What are shipowners’ and managers’ obligations under PIPL?

Shipowners and managers must ensure that they have adequate consent from seafarers so they can contact next of kin, process their data and transfer it to their correspondents and P&I clubs in the event of crew illness or injury claims arising in the PRC (regardless of the seafarer’s nationality).

Crew contracts may need to be amended to include the adequate level of consent required.

2. What are correspondents’ obligations under PIPL?

Correspondents need to obtain seafarers’ consent when dealing with illness or injury claims arising in the PRC. This consent is required to contact next of kin, process their data and transfer it to their correspondents and P&I clubs. Key points to note are:

• In an emergency, PIPL states that that consent must be obtained ‘as soon as practicable’, meaning as soon as both practical and possible in the circumstances.
• If the seafarer is deceased or cannot provide their consent, consent will need to be obtained from the seafarer’s next of kin.
• Correspondents located in the PRC may need to enter into the relevant data transfer agreement with overseas organisations that they transfer personal information to, for example P&I clubs.

3. What are the requirements of the term ‘consent’ under PIPL?

Adequate consent must confirm the relevant shipowner, manager, or correspondent’s authorisation to:

1. Process the relevant sensitive personal information, especially medical information, and bank details.
2. Process the relevant types of personal information, including identification and next of kin’s contact details.
3. Transfer this information to third parties, including P&I clubs and law firms.
4. Transfer this information overseas.

Consent must be attained from the seafarer’s next of kin if the seafarer is deceased or unable to provide it.

4. Where can I get assistance to ensure that I am compliant with PIPL?

Chinese law firms can help you draft template consent wording, crew contract wording and assessing whether PIPL imposes further obligations on your business.

Please do contact your usual Club contact for recommended law firms in the PRC.