Changes

==History==

==History==

The PIPL went into effect on November 17, 2021.

The PIPL went into effect on November 1, 2021.<ref>[https://www.icann.org/en/blogs/details/chinas-personal-information-protection-law-a-gentle-reminder-21-10-2021-en China's PIPL: A gentle Reminder, ICANN Blogs]</ref>

==ICANN's POV==

==ICANN's POV==

On October 21, 2021, [[ICANN]] alerted the community that PIPL would soon be implemented. Then on June 27, 2022, [[ICANN Organization]] released an advisory on the law.

On October 21, 2021, [[ICANN]] alerted the community that PIPL would soon be implemented. Then on June 27, 2022, [[ICANN Organization]] released an advisory on the law.<ref>[https://www.icann.org/en/blogs/details/chinas-personal-information-protection-law-a-gentle-reminder-21-10-2021-en China's PIPL: A gentle Reminder, ICANN Blogs]</ref>

 

Following PIPL's implementation, ICANN's [[Contractual Compliance]] began receiving complaints in which [[registrar]]s assert that the PIPL is being used as a basis for denying requests from third parties for access to nonpublic gTLD registration data.<ref>[https://www.icann.org/resources/pages/advisory-chinese-privacy-law-impact-registration-data-disclosure-2022-06-27-en Chinese Privacy Law Impacts Registration Data Disclosure, ICANN Resourses]</ref>

Following PIPL's implementation, ICANN's [[Contractual Compliance]] began receiving complaints in which [[registrar]]s assert that the PIPL is being used as a basis for denying requests from third parties for access to nonpublic gTLD registration data.<ref>[https://www.icann.org/resources/pages/advisory-chinese-privacy-law-impact-registration-data-disclosure-2022-06-27-en Chinese Privacy Law Impacts Registration Data Disclosure, ICANN Resourses]</ref>

In the advisory, ICANN explains that  

In the advisory, ICANN explains that  

* Like GDPR, PIPL specifies legal bases for processing personal data, including transfers of personal data to third parties. However, PIPL does not contain the "legitimate interest" purpose that GDPR Article 6(1)f) provides.  

* Like GDPR, PIPL specifies legal bases for processing personal data, including transfers of personal data to third parties. However, PIPL does not contain the "legitimate interest" purpose that GDPR Article 6(1)f) provides.  

* Under the PIPL, the legal basis for processing [[gTLD Registration Data]] is consent, which must be specific and informed and requires notification to the individual of "the recipient's name and contact information, the purposes and means of processing and the categories of personal information to be processed…" (PIPL Article 23).  

* Under the PIPL, the legal basis for processing gTLD registration data is consent, which must be specific and informed and requires notification to the individual of "the recipient's name and contact information, the purposes and means of processing and the categories of personal information to be processed…" (PIPL Article 23).  

* There are few and very narrow legal bases for processing personal data within PIPL beyond consent. Thus, contracted parties are likely to require separate and informed consent from each data subject before it can disclose nonpublic personal data to a third party.<ref>[https://www.icann.org/resources/pages/advisory-chinese-privacy-law-impact-registration-data-disclosure-2022-06-27-en Chinese Privacy Law Impacts Registration Data Disclosure, ICANN Resourses]</ref>  

* There are few and very narrow legal bases for processing personal data within PIPL beyond consent. Thus, contracted parties are likely to require separate and informed consent from each data subject before it can disclose nonpublic personal data to a third party.<ref>[https://www.icann.org/resources/pages/advisory-chinese-privacy-law-impact-registration-data-disclosure-2022-06-27-en Chinese Privacy Law Impacts Registration Data Disclosure, ICANN Resourses]</ref>  

==References==

==References==