The amendment to the PRC Consumer Protection Law optimizes China’s consumer protection system for the first time since it was adopted in 1993.

The Decision includes personal data protection for consumers, following the legislative trend in China to enhance personal data protection.

Businesses now have statutory obligations to protect consumer privacy by:

  • obtaining consumers’ explicit consent before collecting and using their personal data;
  • informing consumers of the purposes, method and scope of personal data use;
  • keeping confidential all consumers’ personal data;
  • not selling, or illegally providing or disclosing consumers’ personal data to third parties;
  • taking technical and other measures necessary to ensure information security and prevent disclosure of consumers’ personal data;
  • taking immediate measures to mitigate damages if personal information is disclosed or lost; and
  • not sending commercial information to consumers without their explicit consent.

Under the Decision, infringing consumers’ privacy rights and violating other obligations under the PRC Consumer Protection Law will result in fines of up to RMB 500,000, which is significantly higher than that under the previous rule.

The Decision intensifies the concept of businesses by covering ecommerce operators, including businesses selling goods via the internet, television, telephone and mail order.

The Decision establishes the ecommerce consumers’ statutory right to freely return goods within seven days of receiving them, but excludes specific goods such as tailor-made products, fresh and perishable goods, digital goods, and newspapers and periodicals.

Date of issue: October 25, 2013. Effective date: March 15, 2014.