China Clarifies Compliance Limits on Public Data and Leak Prevention

The Cyberspace Administration of China (CAC) has published regular regulatory guidance detailing strict boundaries for handling publicly available personal data and identifying frequent technical vulnerabilities behind data leaks. The guidance emphasizes that personal information in the public domain cannot be processed beyond reasonable scope, used for unrelated commercial marketing, or weaponized for online harassment. It also urges organizations to eliminate basic technical flaws such as plaintext data storage, weak passwords, and unauthenticated web interfaces to comply with China's Personal Information Protection Law.

The clarification gives enterprises operating in China specific technical and compliance benchmarks to evaluate their data handling practices. By spelling out prohibited uses of public data and frequent security lapses, regulators are providing clear criteria for ongoing compliance audits and supervisory inspections.

The Cyberspace Administration of China (CAC) has issued a regulatory question-and-answer notice clarifying compliance standards for handling publicly disclosed personal information and identifying common technical vulnerabilities that lead to data breaches. Under China's Personal Information Protection Law (PIPL), personal information handlers may process personal data that individuals have disclosed themselves or that has otherwise been lawfully made public, provided the processing remains within a reasonable scope and the individual has not explicitly refused. If the processing significantly affects the rights and interests of the individual, handlers must obtain explicit consent. The CAC reiterated specific violations outlined in the accompanying compliance audit guidelines for the PIPL. These prohibited activities include sending commercial messages to publicly listed email addresses or phone numbers when such outreach is unrelated to the original purpose of disclosure; leveraging public personal information to engage in cyber violence or spread rumors and false information; processing data after an individual's explicit refusal; processing high-impact data without consent; and collecting, retaining, or using publicly disclosed data in a scope, duration, or manner exceeding reasonable limits. The regulatory notice also outlined four primary technical causes of personal data breaches observed across information systems. First, organizations frequently store and transmit personal information in plaintext without applying proper encryption or de-identification. Second, back-end systems and databases holding personal information often fail to enforce effective security controls, such as relying on weak passwords or omitting multi-step login authentication. Third, internet-facing data application programming interfaces (APIs) often lack adequate identity verification mechanisms. Fourth, web pages sometimes inadvertently expose login credentials and passwords for linked internal databases and systems. The CAC reminded organizations that Article 51 of the PIPL requires data handlers to implement comprehensive internal management systems, data classification, encryption, access controls, periodic personnel training, and incident contingency plans to prevent unauthorized access, leakage, tampering, or loss of personal data.