I. Human Right

In the EU, a data subject’s right to his or her personal data is characterized as a “right to privacy with respect to the processing of personal data.”^{Footnote 28} Such a right is considered to be a fundamental one and cannot be outweighed by other values.^{Footnote 29} Protection of personal data is founded upon human rights treaties within the EU.^{Footnote 30} Under the heading “Right to respect for private and family life,” Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms states: “Everyone has the right to respect for his private and family life, his home and his correspondence.”^{Footnote 31} The European Charter for Fundamental Human Rights goes a step further, providing in Article 8(1) that “[e]veryone has the right to the protection of personal data concerning him or her.”^{Footnote 32} Article 8(2) of the Charter authorizes the processing of personal data if certain conditions are satisfied—providing that personal data “must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law.”^{Footnote 33} Additionally, a right to data protection is also protected by Article 16 of the Treaty on the Functioning of the European Union.^{Footnote 34}

The US is not a party to the European Convention for the Protection of Human Rights and Fundamental Freedoms or the European Charter for Fundamental Human Rights. In the US, the right to privacy is defined as the “right to be alone.”^{Footnote 35} It is a civil liberty protected by the Constitution of the US.^{Footnote 36} The Fourth Amendment protects personal information from unreasonable searches and seizures of the government.^{Footnote 37} As such, it has limited implications for most scenarios involving transnational personal data, where a data breach was conducted by a data company, media, or an individual, rather than a government.^{Footnote 38} In Roe v. Wade, the Supreme Court of the US held that the right of privacy is “founded in the Fourteenth Amendment’s Concept of personal liberty and restrictions on state action.”^{Footnote 39} Other cases have been less deferential to information privacy as a protectable civil liberty interest,^{Footnote 40} and the right remains uncertain.^{Footnote 41}

In contrast, the Constitution of the US firmly establishes the free flow of information by the First Amendment’s free speech clause,^{Footnote 42} which may be more likely to be considered as a fundamental human right in the US.^{Footnote 43} For example, Sorrell v. IMS Health Care is concerned with a Vermont law that prohibits pharmacies from disclosing or otherwise allowing prescriber-identifying information to be used for marketing.^{Footnote 44} The Supreme Court of the US held that this law should be subject to heightened judicial scrutiny because it was “content- and speaker-based” and “burden[ed] disfavored speech by disfavored speakers.”^{Footnote 45} Vermont contended that its law was necessary to protect medical privacy.^{Footnote 46} The Court rejected this argument because this law allowed pharmacies to share prescriber-identifying information with anyone for any reason except for marketing.^{Footnote 47} The state also contended that this law advanced important public policy goals by lowering the costs of medical services and promoting public health. The Court held that while these policy goals may be proper, the law did not advance them in a permissible way.^{Footnote 48} The Court concluded that “the ‘fear that people would make bad decisions if given truthful information’ cannot justify content-based burdens on speech.”^{Footnote 49} The law was set aside because it violated the First Amendment.^{Footnote 50}

In China, the right to personal data is considered a personality right. There are two reasons. First, unlike the EU, Chinese legislators do not consider the right to personal information a fundamental human right. This is not because they cherish the free flow of information like the US. Instead, an individual’s right to personal information should be limited because it should not interfere with the authority of the Chinese government, as the largest data controller, to collect, process, save, and use personal information.^{Footnote 51} It may be true that in highly decentralized distributed systems established in a democratic society, “there is no central controller of information” and “almost everyone connected to the network is a ‘controller’ of personal data.”^{Footnote 52} However, this statement does not describe the Chinese situation. Although the Internet is decentralized, the Chinese government is still the ultimate controller because it controls the Internet connections between its territory and the outside world.^{Footnote 53} For example, China has built an Internet Great Fire Wall to censor the information flow across its border and prosecuted people who used or provided VPNs.^{Footnote 54} The Chinese government controls and accesses personal data of users of Chinese Internet service providers, such as Wechat.^{Footnote 55} Although the Chinese Constitution limits government access to Chinese citizens’ correspondence to the circumstances of national security and criminal investigations,^{Footnote 56} other Chinese laws have gone beyond this constitutional limit. For example, Article 25 of the Chinese Ecommerce Law allows government departments to require e-commerce operators to provide e-commerce data—which includes personal information, privacy, and business secrets—according to provisions of laws and administrative regulations, and the ecommerce operators shall provide this information as required.^{Footnote 57} E-commerce Law does not provide any grounds or remedy for e-commerce operators to reject the government information request.

Second, the Chinese Constitution provides very limited protection for an individual’s right to personal information. The Constitution provides that the residence of Chinese citizens is inviolable, and that freedom and privacy of correspondence of Chinese citizens are protected by law.^{Footnote 58} These provisions have limited implications on personal data protection in China. Literally speaking, these constitutional provisions are for residence and correspondence. Personal data protection concerns far more information than an individual’s address and other contact information. It is unclear whether these constitutional provisions can cover all other personal data. More importantly, these constitutional provisions are about protecting privacy; however, in China, protecting personal data is not the same as protecting privacy. The General Rules of the Civil Law, a fundamental law for civil rights and obligations in China, was enacted in 2017.^{Footnote 59} It prescribes privacy and personal data protection in different articles. Article 110 provides that “natural persons have the right to life, body, health, name, portrait, reputation, honour, privacy, marriage autonomy and others.”^{Footnote 60} Article 111 indicates that:

There are two opinions regarding the relationship between Article 110 and Article 111. The first is that Article 110 is lex generalis and Article 111 is lex specialis: Protecting personal information—Article 111—is to enhance the protection of privacy—Article 110—in the digital economy. The second opinion is that Article 111 is not lex specialis, as opposed to Article 110, because personal information is different from privacy. This second opinion is endorsed by the recently enacted Chinese Civil Code.^{Footnote 62} Enacted on May 28, 2020, this unprecedented Civil Code is considered a significant milestone of the rule of law and a profound symbol of the prosperity of China.Footnote ⁶³ Article 1032 of the Chinese Civil Code defines privacy as “the tranquility of the private life of a natural person, and the private space, private activities, and private information that he is unwilling to be known to others”; and Article 1033 provides that the right to privacy should be protected as erga omnes.^{Footnote 64} Articles 111 and 1034–37 address personal data, but, focus on collection and processing of personal data according to principles of legality, proportionality, and necessity.^{Footnote 65} Namely, the provisions for privacy focus on non-instruction of privacy, while those for personal data highlight how to legally use personal data. Therefore, the right to privacy and the right to personal data are distinguishable.

The second opinion has also gained wide support from Chinese scholars.^{Footnote 66} Their arguments can be summarized as follows.^{Footnote 67} First, privacy focuses on protection of an individual’s personal information.^{Footnote 68} In contrast, personal data protection in the digital economy emphasizes protection of personal data of a collective of individuals.^{Footnote 69} This is because the digital economy relies on big data, which requires a collective of individuals’ information rather than on an individual’s information.^{Footnote 70} Second, being a protector is the main role for a state regarding an individual’s privacy. In contrast, big data of personal information is a valuable resource for a state to develop its digital economy, maintain social stability, and safeguard national security.^{Footnote 71} Therefore, a state not only protects personal data but also has an interest in accessing, collecting, and analyzing personal information.^{Footnote 72} Third, data collectors—for example, data companies—contribute to the value of personal information, because if personal data is not collected and processed, it has no value.^{Footnote 73} In contrast, the right to privacy is against collecting and processing, and its value lies in “being left alone.”^{Footnote 74} As a conclusion, personal data protection is not an absolute right like privacy or property ownership, and its protection is comparatively weaker.^{Footnote 75}

Distinguishing personal data from privacy can also find support in other Chinese legislation and judicial practice. For example, the Provisions of the Supreme People’s Court on Several Issues about Applicable Law in Civil Cases of Using Information Network to Infringe Personal Rights and Interests (SPC Provisions on Applicable Law for Personal Rights Infringement) also suggest that not all personal data can be considered as privacy.^{Footnote 76} Article 12.1 provides that Internet users or network service providers shall not use the Internet to disclose personal privacy and other personal information. ^{Footnote 77} Article 87 of the E-commerce Law also provides that “if a State functionary … sells or illegally provides others with the personal information, privacy and trade secrets that come to his knowledge in the performance of his duties, he shall be subject to legal liability according to law.” If personal data were to be equal to privacy, the italicized part of this provision would be redundant.

Ye Zhu v. Baidu, the first case on privacy protection concerning cookie technology,^{Footnote 78} sheds light on the differences between privacy and personal data.^{Footnote 79} Baidu.com—China’s largest Internet search engine—employs Cookie technology to record and track the search keywords used by a customer, and provide tailor-made advertisements for this customer.^{Footnote 80} Zhu alleged that Baidu.com invaded her privacy; Baidu, without her permission, recorded keywords she searched, such as “breast enhancement,” “weight loss,”and “abortion,” and used these keywords to provide advertisements to her. Baidu argued that Cookie technology was a lawful, basic, and neutral technology, and had been used by Google, Yahoo, Amazon, and other Internet service providers. Further, the Cookies collected by Baidu did not include any identifiable personal information—that is, as a search provider, Baidu would not be able to locate a specific individual who used its service. The advertisement relating to the search keywords that Zhu used appeared only on Zhu’s computer and was not published by Baidu to other parties. Baidu, therefore, contended that it did not infringe on Zhu’s privacy. The Nanjing Intermediate People’s Court, as the appellate court, agreed with Baidu and held that there was no invasion of privacy for three primary reasons. First, the information collected by Baidu was not personal because it could not identify Zhu. Cookie technology identified a particular browser rather than a certain user. Thus, when the same user used a different browser to search the Internet, Baidu identified this user as a different user. Second, Baidu did not publish Zhu’s personal information because Cookie technology conducted machine-to-machine communication rather than machine to human. Third, the Baidu user’s agreement allowed users to freely opt out of using Cookies. However, Zhu did not do so. The court also held that Cookie technology was widely used, and even if the Baidu user’s agreement did not explain what Cookies were, an average person—like Zhu—should be assumed to understand this technology.

Ye Zhu helps us to understand how Chinese courts distinguish privacy from personal information. The court held that the records of keyword searches of an Internet user could reflect the user’s activity history and Internet browsing preferences, so they were considered to be privacy attributes. However, if separated from the data subject, they could not identify the data subject, so they were not personal data. The court seems to suggest that if a piece of privacy information, used individually, cannot identify a data subject, this privacy information is not a piece of personal information. This is so even if the relevant piece of privacy information, combined with other information collected by a website, may be able to identify a data subject. For example, searching “weight loss” is an activity conducted by Zhu. Zhu does not want others to know of this activity, which should be considered as her privacy. However, “weight loss,” as a searched keyword, is not personally related to Zhu and cannot identify Zhu. Therefore, keyword searches are not personal data. Yet, the court does not consider whether Baidu may have collected other information from Zhu, such as her location or her search habits. The court improperly ignores that the accumulated information may be combined to identify Zhu.

There are three different definitions of personal data co-existing in Chinese law. The first is provided in the Provisions on the Protection of Personal information of Telecommunications and Internet Users (Provisions), enacted by the China Ministry of Industry and Information Technology in September 2013. Article 4 defines a “user’s personal data” as “(1) the user name, date of birth, ID number, address, telephone number, account number, and password that can be used alone or in combination with other information to identify an individual user, and; (2) the time, place, and the like of the user’s use of the service.” Article 4 does not require “the time, place, and the like of the user’s use of the service” to identify an individual user. Nevertheless, the Ye Zhu court dismissed the application of Article 4 without a clear reason.

The second definition of personal data can be found in Article 67(5) of the Chinese Cybersecurity Law. It provides that personal data refers to various information—recorded by electronic or other means—that can be used alone or in combination with other information to identify an individual natural person, including but not limited to the person’s name, birthday, personal identification number, biometric information, address, and phone number. The Chinese Cybersecurity Law was enacted by the Standing Committee of National People’s Congress and came into effect in June 2017. This was after Ye Zhu was decided. The definition of personal data in Ye Zhu is inconsistent with the Chinese Cybersecurity Law, as personal data is the information, alone or jointly with other information, that can be used to identify a data subject.

The third definition can be found in the Information Security Technology—Personal Information Security Specification (Personal Information Security Specification), made jointly by the State Administration of Quality Supervision, Inspection and Quarantine, and the China National Standardization Administration.^{Footnote 81} It came into effect in May 2018. Article 3.1 defines “personal data as various information recorded electronically or otherwise that can identify a particular natural person or reflect the activity of a particular natural person, either alone or in combination with other information.” This definition does not limit personal data to those pieces of information able to identity a particular natural person.

Among the three definitions, the one provided by the Chinese Cybersecurity Law is the most authoritative. The Chinese Cybersecurity Law was enacted by the Standing Committee of National People’s Congress, which retains more stature and influence compared with the bodies that enacted the other two regulations. The Chinese Cybersecurity Law is also a more recent piece of legislation compared with the Provisions. The Personal Information Security Specification was made later in time compared with the Chinese Cybersecurity Law. But the Personal Information Security Specification is not a law. It serves as guidance of best practices for the industry. Its foreword provides that, if these Specifications contradict with law, the latter should prevail. Therefore, the definition under the Cybersecurity Law—which requires that personal information, alone and in combination with other information, should be able to identify a particular natural person—represents the prevailing view in China.

II. Consumer Right

The US law considers that the data subject’s personal information may be used to exchange for Internet service—as opposed to the EU, where personal data is a fundamental right which cannot be traded.^{Footnote 82} At the state level, for example, the California Consumer Privacy Act of 2018 explicitly provides that “it is the intent of the Legislature to further Californian’s right to privacy by giving consumers an effective way to control their personal information.”^{Footnote 83} Satisfying requirements under the law, a business can offer financial incentives to consumers for the collection and sale of their personal data.^{Footnote 84} At the federal level, the primary privacy enforcement agency is the Federal Trade Commission, whose jurisdiction is limited to regulate privacy violations by organizations who conduct “deceptive” or “unfair” information practices.^{Footnote 85} Therefore, commentators conclude that the US Privacy Act is a system of broad consumer protection laws that have “been used to prohibit unfair or deceptive practices involving the disclosure of, and security procedures for protecting, personal information.”^{Footnote 86}

Like the US, in China, consumer law also allows personal information to be traded.^{Footnote 87} Chinese consumer law requires data companies to clearly indicate the purpose, manner, and scope of the collection and use of information, and seek the consent of the consumers.^{Footnote 88} The personal information collected by the data companies must be kept strictly confidential and not be disclosed, sold, or illegally provided to others.^{Footnote 89} Chinese consumer law also offers explicit remedies for personal data breaches. For example, Article 50 provides that if a business operator infringes upon the consumer’s personal data, the operator shall stop the infringement, restore the reputation, eliminate the influence, apologize, and compensate the loss. Article 56 also indicates that in cases where business operators infringe upon consumers’ personal information, the Administrative Department for Industry and Commerce or other relevant administrative departments shall order corrections, and may—according to the circumstances of the case—impose warnings, confiscate illegal income, and levy fines.^{Footnote 90} If the circumstances are serious, the operator shall be ordered to suspend business for rectification and revoke the business license.^{Footnote 91}

However, the difference between Chinese consumer law and its US counterpart is that the former is much more ambiguous than the latter regarding the competence, necessity, and proportionality to collect personal data. For example, in November 2019, a Chinese professor brought a case against Hangzhou Safari Park in the Hangzhou Huyang District People’s Court.^{Footnote 92} The professor alleges that the Safari Park would like to mandatorily collect his facial features without his consent.^{Footnote 93} The professor bought an annual pass for the Safari Park for the period of April 2019 to April 2020.^{Footnote 94} In October 2019, without asking the professor’s consent, the Park informed him that the annual pass system was updated and the old system was abolished; now, visitors must record their facial features at the Park, and the Park will use a facial recognition system to verify visitors’ identities.^{Footnote 95} If a visitor refuses to record his or her facial features, the annual pass cannot be used, and a refund will not be issued.^{Footnote 96} The Park explains that using the facial recognition system will speed up the Park admission process and save consumers’ waiting time.^{Footnote 97} What is stunning in this case is that the only way for the safari park to provide admission is to collect and use facial features of customers. Facial features are personal biometric information. They are with the natural person for his or her lifetime and cannot be changed. Facial features are more sensitive than fingerprints and other personal data because they are mostly exposed. For public safety and national security, government law enforcement departments, such as the border control and traffic regulation department, can collect this information. Hangzhou Safari Park is not a government department and collects facial features for commercial purposes. Even if it can ensure the collected information will be well protected, saving consumers’ waiting time cannot justify the necessity and proportionality to collect such information. This case shows that while Chinese facial recognition technology is widely used, the law to regulate the competence, necessity, and proportionality to collect personal data is insufficient.

III. Property Right

Characterizing personal data as “property” derives from scientific research on the physical reality of information.^{Footnote 98} It reflects the need to delimit the ownership of data within the booming digital trade where personal data is treated as a product.^{Footnote 99} It is also appealing for data controllers to claim independent or shared property rights with the data subjects, especially when the controllers process information that is generated by machines based on anonymized personal data.^{Footnote 100}

In 1905, the Supreme Court of the US held that data can be considered as property.^{Footnote 101} Moreover, the modern digital trade in transferring, licensing, and selling personal data has further fostered the view that personal data should be characterized as property.^{Footnote 102} Property scholars argue that “[p]roperty rights in information focus on identifying the right of a company or individual to control disclosure, use, alternation and copying of designated information.”^{Footnote 103} In China, the People’s Court Daily positively reported a judgment issued by the Hangzhou Internet Court in November 2019.^{Footnote 104} In this case, the plaintiffs operated an online database called Lvzhuang Wang, or “female clothing net.” The defendant manages a competing online database called Zhongfu Wang, or “China clothing net.” Many users who registered with the plaintiffs also registered with the defendant. Twenty-four users of the defendant’s database authorized the defendant’s staff to use their IDs and passwords to access their accounts on the defendant’s website. Because many users may use the same IDs and passwords on different websites, the defendant’s staff used the “crashing the library” technology to log into the twenty-four users’ accounts on the plaintiff’s website.^{Footnote 105} Consequently, the defendant downloaded information valuable to clothing dealers from the plaintiffs’ website. The plaintiffs brought an unfair competition claim against the defendant. The defendant argued that the plaintiffs’ user agreement did not specify who was the owner of the users’ IDs and passwords; even if the defendant misused the users’ IDs and passwords, it should be the users, not the plaintiffs, to claim the right to the users’ IDs and passwords. The court rejected this argument, holding that the users’ IDs and passwords were property and should be protected. Furthermore, the court held that the IDs and passwords were highly correlated with the users’ identity authentication, and the property right generated by this information was like that of computer information system data, so the rights of the users’ IDs and passwords should belong to the website—in this case, the plaintiffs.

The property right argument is deeply problematic. In the above case, it is doubtable that a data controller can obtain absolute property rights over data collected from data subjects. This is because the data controller has to use personal data strictly according to the agreements with the data subjects. Moreover, the data controller does not exclusively possess personal data. Data subjects can provide the same piece of personal data to other data controllers. Nevertheless, the data controllers invest time, money, and energy in compiling, organizing, or processing personal data. Alternatively, personal data may be generated while data subjects use the Internet service provided by the data controllers. Therefore, the data controllers have legitimate interests in the personal data they collect. However, this legitimate interest is not a property interest in personal data. Rather, it is a property interest that lies with the data controller, who invested in the process of gathering personal data under the guise that they would not be taken advantage of by other competing data controllers.

Further, in the American context, the property right theory is criticized because there are strong policy reasons, such as First Amendment civil liberty, against marking all personal information as property.^{Footnote 106} However, in China, the property right argument is doomed to fail for a reason not existing in the American context. The property right argument can enhance every data subject’s right of self-determination and control of his or her data. Yet, such self-determination and control are inconsistent with the Chinese government’s digital surveillance measures that rely on gathering a huge amount of personal data.^{Footnote 107} These data are collected under an over-comprehensive concept of national security without proper judicial review and public transparency supervision. Although the Chinese Civil Code provides that the collection and processing of personal information is subject to the principles of legality, proportionality, and necessity,^{Footnote 108} there are not many genuine opportunities for Chinese consumers to say no and find convenient alternatives for many basic services in China. For example, Chinese consumers are required to use facial recognition as a precondition to receive mobile phone and banking services in China.^{Footnote 109} There is no alternative for them except providing their facial features. If there is no genuine consent, how can the legality of collecting facial biometric information be decided? If consumers do not know what facial information is collected, how to process it, and where to store it, it is hard to determine proportionality. Moreover, the most common justification for granting property rights is to enable efficient and effective allocations of scarce resources. This does not seem to apply to facial biometric information or personal data, because in digital society, “[w]hat is scarce is information privacy, not personal data.”^{Footnote 110} Therefore, the rhetoric of property law is also inconsistent with the right to personal data as a personality right in China.

The limitation of applying property law to personal data raises the question whether personal data can be considered as a copyright in the context of intellectual property protection? Personal data may not satisfy the threshold in becoming an original work, trademark, or patent.^{Footnote 111} For example, “female” as a gender is an important piece of personal information for an individual but cannot be regarded as an original and creative work under the copyright law.^{Footnote 112} In Shanghai Hantao Information Consultation Co. v. Aibang Juxin (Beijing) Technology Co., the No. 1 Intermediate People’s Court in Beijing held that if a comment provided by an individual customer expresses his or her original thoughts, character, emotions, and experiences, this comment would be considered as a work under the Chinese Copyright law. However, the plaintiff in this case failed to prove that every comment on its platform satisfied the originality and creativity requirement under the Chinese Copyright Law.^{Footnote 113}Shanghai Hantao Information Consultation Co. is like Feist Publ’ns, Inc. v. Rural Telephone Serv. Co., where the Supreme Court of the US also concluded that it is difficult to justify copyright protection unless sufficient creativity exists in the development of databases of factual information.^{Footnote 114}

I. Lex Fori Based on Connecting Factors and Mandatory Law of the Forum

2019 has witnessed numerous seminars on topics such as “GDPR 18 Months On: Insights on Enforcement and Compliance for Non-EU Agencies” and the like.^{Footnote 115} The connecting factors adopted by the EU GDPR go beyond the traditional ones for natural persons, such as habitual residence or active citizenship. Article 3.2 of the GDPR provides that it applies to the offering of free or paid goods or services to the data subject who is in the EU.^{Footnote 116} This condition is fulfilled if the controller or processor envisages offering goods or services to data subjects in the EU, such as using a language or currency generally used in one or more EU member states, or targeting EU customers.^{Footnote 117} The GDPR also applies if the data subject’s behavior is monitored, so far as their behavior takes place in the EU.^{Footnote 118} This broad territorial scope enables the GDPR to be applied as a mandatory law to a large number of data subjects who are non-EU residents or citizens.^{Footnote 119}

In the US, data protection law also has a broad territorial scope. A foreign business that collects, holds, transmits, processes, or shares a US resident’s personal information is subject to US federal data protection laws and may also be subject to relevant state-based laws in the state where the data subject resides.^{Footnote 120} The newly-enacted California Consumer Privacy Act applies to companies collecting personal information from California residents who satisfy at least one of three requirements, indicating the requisite nexus with California: (1) Having over $25 million in annual gross revenue; (2) buying, receiving, selling, or sharing for commercial purposes the personal information of 50,000 or more Californian consumers, households, or devices; or (3) deriving 50 percent or more of their revenue from the sale of California consumers’ personal information.^{Footnote 121} Commentators have criticized that the thresholds of the nexuses are so low so as to cover not only big companies but also many small- and medium-sized businesses.^{Footnote 122} Nevertheless, this low threshold ensures that more California resident consumers can benefit from the Consumer Privacy Act.

The Chinese Cyber Security Law provides for personal data protection.^{Footnote 123} Article 2 states that the construction, operation, maintenance, and use of networks, as well as the supervision and management of networks in China, shall be subject to this law.^{Footnote 124} The Provisions on Online Protection of Children’s Personal Information provides that it shall apply to the collection, storage, use, transfer, disclosure, and other activities relating to children’s personal information that are conducted online within the territory of China.^{Footnote 125} The Safety Assessment Guide for Data Transferred Outside of China, Draft for Public Comments in 2017, provides that it applies to a foreign data controller or processor that is not registered in China but provides products or services to people in China.^{Footnote 126} The factors to determine whether a foreign data controller or processor operates in China or provides products or services to people in China include, but are not limited to, advertising in Chinese, using Chinese currency, and providing logistics service to China.^{Footnote 127} The Safety Assessment Guide for Personal Data Transferred Outside of China, Draft for Public Comments in 2019, explicitly indicates that it applies to companies registered outside of China but collecting personal information of people in China via the Internet.^{Footnote 128} Like their US and EU counterparts, these connecting factors enable these Chinese data protection laws to cover a broad territorial scope.

Moreover, data protection laws may be considered as mandatory law and directly apply to foreign-related civil relations without the guidance from the conflict rules. In China, the connecting factor to determine the applicable law for the personality right is a person’s habitual residence.^{Footnote 129} In 2012, the Supreme People’s Court issued a judicial interpretation that defines mandatory law as “provisions of the laws and administrative regulations that involve the social public interest of China, that the parties concerned cannot exclude their application through an agreement, or that are directly applicable to foreign-related civil relations without the guidance from the conflict rules.”^{Footnote 130} The judicial interpretation provides that the following situations are mandatory law: Involving the protection of the interests of labors; involving food or public health safety; involving environmental safety; involving financial safety such as foreign exchange administration; involving anti-monopoly or anti-dumping; or other situations that should be recognized as mandatory provisions.^{Footnote 131} In the context of COVID-19, if a law for public health safety requires the releasing of personal information, this law should be applied because it is a mandatory law and consequently, foreign laws should be excluded. Applying this interpretation to the COVID19 case discussed in the first paragraph of this Article, although that lady’s habitual residence is Australia, Australian law should not be applied because Chinese law for COVID-19 is a mandatory law. On February 4, 2020, the China Central Cyber Security and Informatization Commission issued a Notification on Protecting Personal Information and Using Big Data to Support Joint Prevention and Control of Disease.^{Footnote 132} Therefore, this Notification should be applied to international travelers whose habitual residences are not in China. Yet, if a law for personal information protection has nothing to do with protecting public health, the question arises whether this law is a mandatory law. The answer depends on whether this law involves the social public interest of China.^{Footnote 133} Personal data protection laws, such as the Chinese Cyber Security Law, The Provisions on Online Protection of Children’s Personal Information, and Consumer Law, address the social public interest of China. Therefore, they should be considered as mandatory laws.

II. Curtailing Party Autonomy

The user’s agreement between a data subject and a data controller is a consumer contract; so unsurprisingly, party autonomy regarding the law to protect personal data is usually restricted by the mandatory law discussed in Section I, Lex Fori Based on Connecting Factors and Mandatory Law of the Forum. The contract between a data controller and a processor is not a consumer contract. Yet, party autonomy for the applicable law is also restricted in the contract between the data controller and the processor.

In the EU, a data controller and a processor can conclude data-processing contracts.^{Footnote 134} However, parties are not allowed to use contractual choice of law clauses to diminish the personal data protection provided by the GDPR. This is for two reasons.

First, for the contractual relationship between a data controller and a data processor, if a controller or a processor is established in the EU, the GDPR applies to the processing of personal data in the context of its activities.^{Footnote 135} It does not matter whether the processing takes place in the EU or not.^{Footnote 136} The leading authority for defining “in the context of the activities of an establishment” is the Weltimmo case.^{Footnote 137} Weltimmo was registered in Slovakia^{Footnote 138} and managed a property dealing website concerning Hungarian properties. It had no registered office or branch in Hungary. However, the owner of Weltimmo lived in Hungary and the website was written exclusively in Hungarian. Weltimmo had also opened a bank account in Hungary for the recovery of its debts and had a letter box for everyday business affairs. It hired a representative in Hungary to negotiate the settlement of its unpaid debts with its advertisers. The Court of Justice of the EU (CJEU) held that “in the context of the activities of an establishment” should be broadly interpreted.^{Footnote 139} More specifically, the concept of “establishment” emphasizes the effective and real exercise of activity through stable arrangements. Within this construction, the legal form of such an establishment—for example, an entity with or without a legal personality—is not determinative.^{Footnote 140} The “establishment” extends to any real and effective activity based on the stable arrangements.^{Footnote 141} Accordingly, the CJEU held that Weltimmo pursued a real and effective activity in Hungary. The Court further held that the operation of loading personal data on an Internet page should be considered to be “processing.”^{Footnote 142} Therefore, Hungarian law should be applied to Weltimmo. Another leading authority is the Google Spain case.^{Footnote 143} In this case, the processing of the relevant personal data took place exclusively in California by Google US. Google Spain possessed a separate legal personality and provided support to the Google group’s advertising activity. The activity of Google Spain was separate from the search engine service in California. The CJEU held that Directive 95/46, the predecessor of the GDPR, should be applied as the processing of data in the US was carried out in the context of the activities of Google Spain. The activity of Google Spain was inextricably linked with the search service provided by Google US because without the advertising space, the search engine would not be economically profitable and may not be able to perform.^{Footnote 144}

Second, there is a question of whether a data controller can disclose personal data to an overseas processor and contract for a law providing a lower standard of privacy protection than the law of the controller’s place of registration. The answer is negative in the EU. The personal information collected in the EU can be disclosed only to overseas processors located in a jurisdiction recognized by the EU as a jurisdiction that offers equivalent data protection laws. In the case of outsourcing to a country without equivalent data protection laws to the EU’s laws, the GDPR requires the controller to apply adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals.^{Footnote 145} Therefore, parties are not allowed to select a law providing a lower standard of protection. This conclusion is also supported by judicial practice. In the German case Facebook v. Independent Data Protection Authority of Schleswig Holstein,^{Footnote 146} the general terms and conditions of Facebook contained a clause according to which, for German users, German law applied. The German court pointed out that, according to the Rome I Regulation, it was in principle possible to make an agreement on applicable law for the contract but not on data protection law. This was on account of the provisions on data protection—falling within the concept of overriding mandatory provisions—within the meaning of Article 9 of the Rome I Regulation, making it impossible for the parties to make an agreement on applicable law in this regard.

Different from the EU, Chinese law does not generally limit party autonomy in the choice of applicable law for contracts between a data controller and a processor. However, Chinese law does not allow a data controller to disclose personal data of a child to an overseas processor and contract for a law providing a lower standard of privacy protection than Chinese law. The Provisions on Online Protection of Children’s Personal Information provides that if a network operator transfers personal information of children to a third party, it shall conduct its own safety assessment, or engage an independent organization to conduct the same.^{Footnote 147} If a network operator entrusts a third party to process personal information of children, it should also conduct a security assessment of the entrusted party.^{Footnote 148} The entrustment contract between the network operator and the entrusted party shall provide that, among others, personal information of children shall be handled according to Chinese law and the entrusted party is not allowed to transfer the commission.^{Footnote 149}

The purpose in restricting party autonomy in the contract between a data controller and a processor is to protect data subjects. There is often no direct contractual relationship between the data subject and the data processor, because the latter may not directly collect personal data from the former and, instead, the latter often obtains the data from a data controller. However, the right of the data subject against the data processor is derived from the contract between the data subject and the data controller. The contract between the data controller and the data processor should not impose any obligations on the data subject, and it should ensure that the data subject’s information is well protected. Namely, the data subject is the third-party beneficiary of the contract between the data controller and the data processor. Restricting party autonomy in the contract between a data controller and a processor is consistent with the mandatory nature of personal information law to protect data subjects.

III. Applying Lex Fori in Equity Cases

Besides torts and contracts, a personal data breach may also be pursued as a breach of confidence claim in the UK and other commonwealth countries. The lex fori approach leads to the application of forum law—the same result as applying mandatory law and curtailing party autonomy discussed in previous sections. For example, in Giller v. Procopets, the Court of Appeal of the Supreme Court of Victoria in Australia awarded equitable compensation for “distress arising from a breach of personal privacy that was framed as a breach of confidence claim.’”^{Footnote 150} Traditionally, both the principle and the balance of AngloAustralian authority favored the general application of lex fori in equity cases.^{Footnote 151} Although the leading Australian case, Murakami v. Wiryadi & Ors, qualifies this approach by providing an unexhaustive list of exceptions, it never replaced the traditional lex fori approach.^{Footnote 152} Similarly, this approach was upheld by the Court of Appeal in the UK in Douglas v. Hello!. This case concerned the unauthorized publication of the Douglas’ wedding photos in the UK. Subsequent to Michael Douglas and Catherine Zeta-Jones’s wedding in New York, a member of the paparazzi took unauthorized photos of this wedding and sold them to Hello! Magazine. The couple brought a claim for breach of confidence in the UK. Though Hello! Magazine argued that the proper law should be the law of New York—where the unjust enrichment occurred^{Footnote 153}—this argument was effectively rejected by the Court of Appeal, who instead applied the English law of confidence to protect individual privacy.^{Footnote 154} Although the place of intrusion was New York, the court held that it was the English law of confidence that provided the remedy. This was consistent with the longstanding tradition of courts of equity using public policy concerns of the forum to exclude the operation of foreign law.^{Footnote 155} Scholars have advocated for other conflict of laws rules in breach of confidence cases.^{Footnote 156} However, it is undeniable that lex fori is the general rule for breach of confidence claims, which is most relevant in data breach cases.

I. Americanization

Professor Jack M. Balkin indicates that “[c]urrently the Internet is mostly governed by the values of the least censorious regime—that of the United States.”^{Footnote 159} From the perspective of conflict of laws, this phenomenon can be explained by the significance of the law of domicile. The main global Internet players are US companies and industry associations registered in the US. Among the top ten Internet companies in the world, six are US companies: Amazon, Google, Facebook, Netflix, Booking, and eBay.^{Footnote 160} The domicile of a data company is significant, sometimes determinative, in identifying the law that would apply to protect personal data collected by the company. The US data regulatory environment features freedom of speech,^{Footnote 161} industry self-regulation,^{Footnote 162} the Federal Trade Commission’s consent decrees,^{Footnote 163} and weak consumer privacy regulations.^{Footnote 164}

The domicile of a company is also important for the purpose of judgment recognition and enforcement.^{Footnote 165} Consequently, it is concerned about whether a domestic law on personal data protection can be respected in other jurisdictions. In LICRA & UEJF v. Yahoo! Inc. & Yahoo France, Yahoo! was ordered by a French court to block French users from accessing the auction site on Yahoo.com offering Nazi memorabilia in contravention of French law.^{Footnote 166} Yahoo! was domiciled in the US. Unsurprisingly, it went to a US district court and successfully obtained a judgment declaring that the French judgment was not recognizable or enforceable because it violated the First Amendment of the US Constitution.^{Footnote 167} Although the district court judgment was reversed at the appellate level on the grounds of a lack of personal jurisdiction on LICRA & UEJF and the “ripeness” of the enforcement claim, it nevertheless demonstrates that the First Amendment to the US Constitution can potentially be used to protect US-domiciled websites from enforcing foreign judgments.^{Footnote 168} Similarly, in Google Inc. v. Equustek Solutions Inc., Google was required by a Canadian court to block websites violating Canadian law.^{Footnote 169} Google, yet another company with a domicile in the US, obtained a judgment at its home court that rendered the Canadian judgment unenforceable.^{Footnote 170} Furthermore, the US Securing the Protection of our Enduring and Established Constitutional Heritage Act (SPEECH Act 2010) expressly prohibits the recognition and enforcement of foreign defamation judgments against online providers, unless the defendant would have been liable under US law.^{Footnote 171}

II. De-Americanization

The substantive law for personal data protection and, broadly, international regulations is moving from Americanization to de-Americanization. The two main drivers are the EU and China.