;
Image: Unsplash

Although the world economy was hit hard by COVID-19, China has recovered quickly, thanks in large part to its booming e-commerce sector. There are many emerging issues in the segment of the market, which has aroused much attention across society, and while the E-commerce Law of the People’s Republic of China, which went into effect in January 2019, provides for a general legal framework to for regulating the space, many new business models that are based on social media such as Wanghong economy (i.e., the internet celebrity economy) and live commerce (i.e., sales via livestream) are not explicitly addressed by the E-commerce Law. This created the potential for the infringement of consumers’ rights and interests that regulators might not be able to find a proper legal basis to address. 

Against that background and in an attempt to catch up with the swiftly-emerging developments in the Chinese e-commerce space by providing more detailed and practical guidelines for enforcement, and clarifying the responsibilities of e-commerce platforms, including when it comes to the protection of consumer data, the State Administration for Market Regulation updated the Measures for Supervision and Administration of Online Transactions (“Online Transaction Measures”), which took effect on May 1, 2021.

Below are some of the highlights worth paying attention to … 

Relevance to international companies

The newly-enacted Online Transaction Measures regulate “online transaction operators,” a large pool that encompasses any natural person, legal person, or unincorporated entity that organizes and carries out online transactions. This includes online transaction platform operators, platform-based operators, self-built website operators, and online transaction operators that execute online transaction activities through other network services. This definition generally extends to various players in the e-commerce industry and now, in particular, applies to sales-related activities conducted via social media platforms or other platforms that have social media-like features, such as live streaming capabilities. 

Online transaction platform operators and network services providers (i.e., companies that own, operate and sell access to Internet backbone infrastructure and services) have become the primary focus of the updated Online Transaction Measures. As such, various new obligations have been imposed on these two types of platforms and providers, such as obligations to monitor user activities and report irregularities to authorities, as well as to store live streaming videos of online transaction activities for at least three years. 

Because of China’s foreign investment access restrictions, which bar foreign companies from having a majority stake in online platform businesses for which a special value-added telecom license is required (such as social media platforms), these obligations generally do not impact foreign multinationals that cannot in any case participate in such business activities. However, foreign multinationals may still find themselves confused by the concepts of “platform based operator” (e.g. operating a flagship store on business-to-consumer platforms) or “self-run website operator” (e.g. selling products or services via a company’s own Chinese website), which are not so heavily regulated but that, nonetheless, require a careful approach to risk management. 

There are, after all, respective obligations associated with these two kinds of roles that require companies to publish their business license online, obtain various other permits or certificates, maintain good data and privacy protection practice, and observes a ban on spamming. Violations of these obligations under the Online Transaction Measures could lead to administrative penalties, including – but not limited to – fines of up to RMB 30,000 (approx. $4,561), etc. More importantly, any violation will go into the corporate social credit system and be published, which could have quite some complicated implications and jeopardize an international company’s operations in China, seeing as this credit system is developing in a way that links it to things, such as access to market resources and regulatory treatment.

Tightened privacy protection

Data and privacy protection have become a hot topic in China due to rampant misuse of personal data in the commercial field. In response to the general concern of society on this topic, the Online Transaction Measures reiterate the general principles for the collection and processing of personal data, as these topics have already been addressed by many other laws and regulations, including the recent draft Personal Information Protection Law, namely, the principles of legality, legitimacy and necessity, transparency, and prior consent. Particularly, the Online Transaction Measures address the new requirements elaborated below, which relate to data and privacy protection and which international companies should pay special attention to. For instance, activities forcing consumers – or in any other way misleading consumers – into agreeing to the collection and use of personal information that is not directly related to the concerned sales/service is prohibited. This may include: (1) a one-time “cover all” consent/authorization; (2) a default “opt-in;” (4) bundled consent; and cessation of the installation of the app or using the service.

The excessive collection of personal data that is widely seen in the e-commerce field also violates the “data minimization’ principle.” For many years, data holders could not find a reliable legal basis to enforce and secure their rights/interests, with the exception of some general legal principles. The few law enforcement campaigns carried out by governmental authorities also turned out to be largely inefficient in turning this around. Now, the Online Transaction Measures reduce such ambiguities by providing a detailed “code of conduct” that companies should follow. With that in mind, international companies are encouraged to revisit and update their existing privacy and data protection practice/documentation for the Chinese market where necessary in order to stay in tune with these new requirements.

Moreover, Article 13 of the Online Transaction Measures specifically addresses how companies should handle sensitive personal information. It stipulates that the collection and use of information – such as biometric features, medical and healthcare records, financial accounts, and location tracking information – shall require item-by-item consent from consumers. This goes beyond the requirements of the draft Personal Information Protection Law, which only requires “separate” consent by data subjects rather than a more cautious “item-by-item” approach. Based on our observation, the item-by-item consent approach has not yet been widely adopted in the market, including by international companies. 

Most companies maintain a well-established privacy policy, but do not have a sufficient consent collection process in place. This new requirement under the Online Transaction Measures will be quite challenging for companies, as more consent collection means higher business hurdles. Each international company will need to find a proper way to balance this out in each of the respective scenarios.

Prohibition of unfair competition

Prohibition of unfair competition is another key focus of the Online Transaction Measures. Deceiving or misleading conduct that is strictly barred includes: (1) fabricating transactions or consumer review/comments; (2) manipulating reviews/comments by placing positive comments at the top while placing negative comments at the end, or not prominently distinguishing customers’ reviews/comments of different products or services; (3) conducting false marketing by means of falsely alleging a commodity status, fictitious reservation, etc.; and (4) fabricating statistics, such as fake hits, fake followers, fake likes, and fake rewards.

The above tactics are commonly seen in the Chinese market, and even though international companies tend to refrain from directly engaging in them, the topic is still highly relevant for international companies, since many of them may have engaged a local service provider to operate their online stores on third-party platforms – or what are referred to as “TPs.” In light of key performance indicators or other pressures, TPs may engage in activities that are closely associated with the above illegal practice under the guise of providing services, such as “smart marketing solutions,” As such, it is advisable for all international companies to run an online business heath check regarding the above, particularly on the service supplier side.

Going forward

An update of the Online Transaction Measures is a step forward in China’s quest to establish a prosperous and well-ordered online market. With more detailed guidelines, the potential for companies to make money by exploiting grey areas or by engaging in malpractice is substantially reduced. This is likely to be an unwelcome development for certain aggressive business models, but it is very good news for those who eschew such tactics. Better protection of the rights and interest of data subjects will also help to build up consumers’ confidence in e-commerce business in the long run, while the restrictions imposed on big platforms could even serve the interest of foreign brands that wish to further penetrate the Chinese market by expanding their online shops on such platforms.

Although many issues addressed in the Online Transaction Measures do not appear – at first glance – to be relevant to most foreign companies, given the foreign investment access restrictions, policy liberation in recent years (e.g., the possibility of doing e-commerce business with 100 percent foreign-owned companies) means the new requirements could still hit some of those foreign companies that have successfully entered certain niche markets like Alibaba’s online platform for luxury brands. 

It goes without saying that keeping a close eye on such legislative developments and taking actions, including on the privacy front, in order to stay compliant is the only way to remain successful in the rapidly changing Chinese market.

Michael Tan heads Taylor Wessing’s TMC practice for China, specializing in IT regulatory and data/privacy protection areas, as well as general corporate and commercial matters. 

Julian Sun is an associate in Taylor Wessing Shanghai Office, specializing in foreign direct investment, general corporate law, restructuring and China-related M&A.