Navigating the Data Seas: Legal and Ethical Perspectives on Personal Information Management Presented by: Professor Marina Timoteo (University of Bologna), Erasmus University Rotterdam. Personal Information And Data  Anonymization refers to the "act of personal information handling which results in the impossibility to identify specific natural persons and restore during the processing of personal information (art. 73, paragraph 4). Rights To Personal Information: Informed Consent  The legal circumstances of processing information are stipulated by article 13 of PIPL, among which the "inform consent" (paragraph 1) is undoubtedly the most important rule for personal information processing. Data subjects have the right to know and the right to decide on the processing of their personal information and have the right to restrict or refuse the processing of their information by others Territorial Scope in the GDPR - GDPR applies to entity (controller or processor) which processes personal data as part of the activities of one of its branches established in the EU, regardless of whether the processing takes place in the Union or not - GDPR applies to a company established outside the EU where the processing activities are related to: 1. The offering of goods or services to subjects in the Union, irrespective of whether a payment of the subject is required; (e.g. a company established outside EU which supplies online training courses to students in EU) or 2. The monitoring of the subjects behavior as far as their behavior takes place within the Union Territorial Scope in the PIPL  The PIPL principally applies to organizations and individuals' handling PI of natural persons within the jurisdiction of China. This applies to any organization or person physically within the borders of China.  Article 3 of the law extends the territorial scope of the law to processing activities by handlers established outside of China, similarly to the GDPR, if one of the following circumstances is present.  Where the purpose is to provide products or services to natural persons inside the border; Where conducting analysis or assessment of activities of natural persons inside the borders; Other circumstances provided in laws or administrative regulations.  The law requires handlers outside of China that process personal information of covered persons to establish a dedicated entity or appoint a representative within China to be responsible for matters related to their information processing (Art. 53). Such entities must provide the name and contact method of the representative to the relevant departments responsible for implementing the law. Cross-Border Transfers And Data Localization In The PIPL  Transfers of PI outside the borders of China are regulated in Chapter III, with the stated objective of ensuring that the transfer of data outside of China must be protected to the same extent as under Chinese law.  The PIPL provides that where a country or region adopts discriminatory prohibitions, limitations or other similar measures against China in the area of data protection, China "may adopt retaliatory measures against said country or region" (Art. 43).  Transfers of PI outside the borders of China are regulated in Chapter III, with the stated objective of ensuring that the transfer of data outside of China must be protected to the same extent as under Chinese law.  All transfers must pass a necessity test (they must be "necessary for business or other needs", undefined). In addition, handlers must provide specific further notice to individuals, regardless of what mechanism for transfers is used, and following this notice handlers have to obtain the individual's specific consent (Art. 39). Cross-Border Transfers in the GDPR - GDPR regulates "any transfer of personal data which are undergoing processing or are intended for processing after transfers to a third country or to an international organization" (Art. 44) - According to Art. 44 the transfer of personal data «shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor.>> - Overarching principle of 'the law of transfers' is the continuity of protection of personal data, and in so doing of the protection of fundamental rights and freedoms of the individual. Being a fundamental right, data protection concerns everyone in the Union, and wherever her or his personal data goes, even when data 'travels' to a third country. - Different cases provided in the GDPR: 1. A third country is offering an adequate level of protection through a European Commission decision ('Adequacy Decision') so the data can be transferred without the data exporter being required to provide further authorization (art. 45) 2. In the absence of an Adequacy Decision, a transfer can take place through the provision of appropriate safeguards and on condition that enforceable rights and effective legal remedies are available for individuals (art. 46) 3. In the absence of an adequacy decision or of appropriate safeguards a transfer of personal data to a third country shall take place only in specific cases provided in art. 49 4. E.g. If the subject has explicitly consented to the transfer, after having been informed of the possible risks of such transfers Ethics and Law  2021 DSL requires that "When conducting data processing activities, the entity should comply with laws and regulations, respect social norms and ethics, observe business and professional morality, act in good faith, perform data security protection obligations, and undertake social responsibilities, and shall neither compromise national security and public interest nor harm the lawful rights and interests of any organization or individual" (art. 8)  The Civil Code provides that "medical and scientific research activities concerning human genes and human embryos, among others, shall be carried out according to the laws and administrative regulations, and relevant provisions issued by the state, without endangering human health, violating moral principles, or damaging public interests" (art. 1009)  Beijing Internet Court held that with the advancement of big data applications, artificial intelligence and other technologies, the operator of an e-commerce platform should also improve its supervision and management capabilities; improve the review and screening system; better maintain the good order and competitive ecology of the trading platform; and guide and cultivate honest and trustworthy business ethics.