Whose data is it anyway? An empirical analysis of online contracting for personal information in China

Abstract

ABSTRACT China’s data governance has garnered global attention. An important part of data governance is the protection of personal data. Many believe that the newly issued Personal Information Protection Law (PIPL) can improve the protection of personal information in China. However, the merits of this specialized law rest in part on empirical exams. This paper explores whether the PIPL can solve the issues existing in online contracting for personal information in China. It firstly introduces provisions related to contracting for personal information before the promulgation of the PIPL. It then identifies three critical issues regarding online contracting for personal information in China after reviewing 202 online peer-to-peer lending platforms’ terms of service and privacy policies. These issues include privacy policies that are not readily accessible, the substantial variation between terms of service and privacy policies pertaining to personal information collection, processing, sharing, and protection, and the bias of contractual terms. The paper further discusses whether the PIPL can help address three issues considered in the survey results. It argues that, even though the new law looks promising and may help address some of the issues in online contracting for personal information, its effectiveness ultimately depends on its enforcement and consumers’ reaction to changes in the way firms contract for personal information. Therefore, this paper also calls for more empirical studies on China’s personal information protection.