You can request access, copies, correction and deletion of your personal information
Chinese law gives you rights to access and copy your personal information, correct it and, in specified circumstances, have it deleted. A business should proactively delete information when the service ends, the retention period expires or you withdraw consent, subject to the applicable rules. If it refuses a rights request, it must explain why; you may bring a court action. Closing an account and deleting its data are separate steps.
What it takes
Making the request is free. Complaints or litigation become relevant when the organization refuses or delays. A lawsuit can take months, and you may have to pay legal fees, so a complaint is often the less costly first step. Following up persistently can be the hardest part.
What you may gain
Circumstances requiring proactive deletion include completion of the original purpose, the end of a service, expiry of the agreed retention period and withdrawal of consent. If the business has not deleted the information, you may request deletion. A refusal to let you exercise your rights must be explained, and you may seek relief in court.
Context & considerations
Account closure does not necessarily constitute a deletion request; ask for deletion separately. Before replacing or selling a phone, sign out of all accounts, unlink the device and then perform a factory reset. A legal right to deletion cannot retrieve copies of information that have already leaked.
Research & references
Standing Committee of China’s National People’s Congress (2021). Personal Information Protection Law. http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html. Article 45 covers access and copies and requires timely provision in response to a request. Article 46 covers correction and supplementation. Article 47 lists five grounds for proactive deletion, including a purpose that has been achieved, cannot be achieved or no longer requires the data; termination of a service or expiry of retention; and withdrawal of consent. It also provides a right to request deletion if the processor has not acted. Article 50 requires a convenient request-handling process, reasons for refusal and access to the people’s courts.