Thisarticle will focus on the impact of PIPL on the HR perspective to provide someinsight of this law in this special field.
1. Collection & Storage
Inlabor relationships, the legal basis for the handling of personal informationcould be covered by consent, fulfillment of contractual or statutoryobligations, or for human resources management. Therefore, employers shallcommunicate with their legal consultant to find the best legal basis for the workers’data handling. It’s worth noting that using employees’ personal information formarketing and/or statistic purpose and similar activities is not covered underthe legal basis of HR management.
2. Transfer & Provision to Third Parties
Ifcompanies need to transfer employee’s personal information to third parties forfurther processing due to HR purposes, companies shall conclude an entrustmentagreement; conduct personal information protection impact assessment inadvance; disclosure to individuals of the name, contact method of therecipient, handling purpose, handling methods and obtain consent; obtainseparate consent by the employee in case of any change of handling purpose.
3. Internal Personal Information Management System
Companiesshall establish and maintain an internal personal information managementsystem, which includes:
-Internal management structures;
-Categorized management of personal information;
-Regular internal training;
-Personal information security incident response plan;
5. Deletion of Personal Information
Ina labor relationship, considering that the employer might need employees’personal information for potential lawsuits of a labor dispute, and thestatutory limitation for labor dispute is 1 year upon termination of laborrelations, It would be reasonable for employers to retain employee’s personalinformation for at least 1 year after termination or expiration of laborcontract. Specific agreements to this end shall be reached between employer andemployees accordingly.
6. Legal Liabilities for Violation of PIPL
Forthe employer unlawfully handling employees’ personal information, warningorder, corrective order, direct fines might be imposed on the company ordirectly personnel in charge may be the most possible liabilities.
Thelaw sets out fines up to RMB 50,000,000 or 5% of the company’s turnover in thepreceding year, and other measures (Art. 66).
Noticeably,the directly responsible person in charge and other directly responsiblepersonnel are to be fined between RMB 10,000 and RMB 100,000 (Art 66).
