China’s PIPL and Automated Decision-Making

The PIPL applies to processing of personal information within China and, in specified circumstances, to processing outside China involving people in China. Article 24 addresses automated decision-making using personal information. It requires decision-making transparency and fair, impartial results, and prohibits unreasonable differential treatment in transaction prices or other transaction conditions. The same article requires personalized information-push or commercial marketing to include options not based on personal characteristics or a convenient way to refuse. When an automated decision may significantly affect a person’s rights or interests, that person may request an explanation and may refuse a decision made solely through automated means. This does not ban all automated decisions. The explanation right concerns significant automated decisions; the refusal right addresses making the decision solely through automation. General principles and other statutory protections also apply. Systems should therefore identify which decisions are fully automated, which have human involvement, and what explanation and refusal paths are available. Other PIPL provisions matter. Processing personal information requires a lawful basis under Article 13; consent is one basis, not the only one. Sensitive personal information receives additional protections, and Article 55 requires a personal-information protection impact assessment for automated decision-making, among other specified processing. The processor must keep records of the assessment. Cross-border transfers can trigger separate conditions. The exact requirements depend on the role, purpose, data, and activity. Organizations should map personal-information flows, identify whether the decision uses personal information, assess impact, and test for unreasonable differential treatment. Provide accessible options for personalized marketing, a process for explanation requests, and a way to refuse significant solely automated decisions. Keep evidence of human review, assessment, notices, and system changes. Avoid importing GDPR terms as if they were identical to PIPL rights.