context: Pundits have been calling for an Individual Data Protection Law for years, with MIIT-affiliated CAICT recently presenting it as a next step for China’s internet laws, as MIIT mentioned it in the digital economy action plan and 2019 work priorities. The law’s inclusion on the National People’s Congress legislative agenda also suggests progress.

Work on an Individual Data Protection Law is in progress, says Hu Gang 胡钢 Internet Society of China Rule by Law Commission vice secretary general. Such a law will help solve disputes like that between Tencent and ByteDance, although laws against monopoly and unfair competition may also be relevant, says Hu. On 22 Jan 2019 ByteDance found out users could no longer subscribe to its popular short video platform TikTok (aka Douyin) with their WeChat accounts, reports 21st Century Business Herald. Two days later, Tencent, which owns WeChat, said it had severed the link out of privacy concerns, noting TikTok aggressively imports WeChat contact lists. WeChat also issued a warning on 26 January that Bytedance apps are engaging in illegal promotion on its platform.

The dispute erupted as Cyberspace Administration of China announced a year-long campaign against apps illegally collecting and using personal information. The campaign will increase awareness and help Chinese firms avoid fines in Europe for violating GDPR, says Hu. The campaign should lead to compensation for victims of data theft, administrative punishments like suspension of business licenses for non-compliant companies and criminal cases against perpetrators, according to an Economic Information Daily report sampling online reactions to the campaign. The report concludes with a call for the industry to set up supervision mechanisms across the data chain to stop employees from stealing and reselling data.