China’s data privacy crackdown: What luxury marketers needs to know

To receive the Vogue Business China Edit, sign up here. Personal data and privacy protection are next in line in China’s regulators’ efforts to rein in big tech’s power and regulate the country’s growing digital ecosystem. China’s Personal Information Protection Law (PIPL) is currently under a second review but is expected to be law by the end of the year. It addresses how organisations and individuals collect, store and transfer data. It also stipulates that Chinese consumers should give informed consent before personal information is collected, should be informed of why it is collected and how it is used, and be entitled to rescind consent at any stage. For luxury brands, consumer consent will now become essential in order to collect Chinese data, inside and outside the borders of the People’s Republic. That marks a significant shift from the powerful and largely unregulated tech ecosystem that currently exists, experts say. “In China, we have much more availability to track a singular person across dozens and dozens of touchpoints than what we do out West,” says Toto Haba, SVP of marketing and communications at ‎Benefit Cosmetics. Alibaba and Tencent have created large ecosystems that span e-commerce, messaging, gaming, maps applications and more, enabling brands to very precisely target their marketing communications, says Haba. “If [data collection] becomes more restricted, the impact is that we can rely less on that sort of very hyper-targeted marketing.” So what does it mean in practice? “If you don’t have consent, you can’t really process data,” says Yan Luo, a regulatory and public policy lawyer at Covington. The PIPL shares many affinities with the EU general data protection regulation (GDPR), but unlike its European counterpart, companies cannot cite legitimate interest as a legal basis for collecting and processing data. The PIPL has a much greater emphasis on individual consent. Potential fines for breaching the law are heavy: up to RMB 50 million ($7.77 million), or 5 per cent of annual revenue. “The key message emphasises that the collection of personal information should be legal, necessary and to the minimum extent,” says Leonard Li, partner at consulting firm Oliver Wyman. Other provisions limit transfer of data outside of China, use of individual localisation tracking, reliance on third-party data for marketing purposes and the creation of algorithmically curated content. What changes for brands A particular pain point for brands will be a restriction on data transfer outside the country. Humphrey Ho, US managing director of Hylink Digital, a marketing agency focusing on China, says Western brands have generally analysed data collected in China in their US and EU headquarters. The PIPL makes data transfers subject to security assessments and certification by Chinese cyberspace authorities, an interaction that luxury brands will want to avoid, says Omer Tene, chief knowledge officer at the International Association of Privacy Professional (IAPP). One solution is to build a local data management platform and work out how to keep and analyse data in the country. Brands are lagging behind in preparation, says Ho of Hylink. “There has been a long observation period for luxury brands, with a lot of focus on GDPR and on the California Consumer Privacy Act, but there has been absolutely no focus on China,” he says. “The time to react is now.” Location tracking is a particular problem. Individual location tracking will now be defined as sensitive personal information and will be strictly limited, reducing the extent to which brands can, for example, track offline store visits for remarketing and retagging purposes. “Brands have to very carefully consider the collection of location from individuals because it can be interpreted as unnecessary information,” says Oliver Wyman’s Li. Individual consent will also become a prerequisite to push sales or marketing content that uses personal information to analyse behaviours and habits. This provision affects the creation of personalised content and ads, which users will have the right to refuse. “That’s very much relevant for brands that use automatic or programmatic decisions to conduct marketing,” says Li. Brands will also have to reassess the use of third-party data. Platforms and providers will face stricter supervision as to how they obtain and process personal information. Currently, brands and marketers draw on big tech platforms like Alibaba and Tencent with access to a wealth of customer data, which in turn allows them to develop more specific content and products. “Brands need to think about whether those activities are legal under the new law or whether it will be associated with unnecessary items in the future,” says Li. Consumers care, brands should too The PIPL will be China’s first comprehensive law targeting personal data protection. “The handling of personal data in China has been sort of the Wild West, but there is also a misconception around how happy Chinese people are to hand over their personal data in exchange for services,” says Adam Knight, co-founder of China-focused creative agency Tong. He notes how data leaks and over-collection of user data have drawn criticism from both domestic media and Chinese consumers. In a recent case, brands including Max Mara and BMW were criticised for their use of facial recognition tech. BMW said Chinese dealers using the technology are not controlled by the company, while Max Mara said the cameras were used to monitor customer flow in stores and did not collect personal information, the AP News reported. According to a 2019 survey, a large majority of Chinese consumers are worried about facial recognition data being leaked and say they prefer traditional ID methods. They also consider consumer information confidentiality and data protection as important facets of brands’ corporate social responsibility — even more so than Indian and Australian peers. If Chinese consumers’ trust is won, then brands can still benefit. It’s likely to be a process of establishing a new balance. “Consumers will only share data with brands they trust and if they stop trusting the brands, the data will come back out and the access will stop,” says Milton Pedraza, CEO of Luxury Institute, a research and personal data technology solution partner for luxury brands. “That’s going to be the way that consumers are going to create equality with brands.” However, in a survey published by Luxury Institute in June 2020, affluent Chinese consumers showed a greater propensity than Americans to share data, especially in exchange for more personalised services. Pedraza believes that is how a new data relationship between brand and consumer will emerge: millennials and Gen Zs are ready and willing to share their info but they are fully aware of the value of their personal data to companies. Governments worldwide are increasingly wary of big tech companies’ ownership of personal data — a concern reflected in Europe’s GDPR and the California Consumer Privacy Act, both introduced in 2018. Gartner estimates that by 2023, the personal data of 65 per cent of the world’s population will be protected by regulations, up from 10 per cent in 2020. The PIPL is also widely considered a tool for the Chinese government to curtail the power of big tech companies like Alibaba and Tencent. “The Chinese government is cautious about some of these platforms blossoming into a size that is too big to control,” says IAPP’s Omer Tene. “The fact that this draft legislation limits the power of companies… shows that the Chinese government is starting to rebalance the power between the state, businesses and individuals.” To receive the Vogue Business newsletter, sign up here. Comments, questions or feedback? Email us at feedback@voguebusiness.com. More from this author: Turning around Burberry: The ups and downs Why clean beauty brands are heading for China How brands should approach sustainability in China

Make better business decisions

Make better business decisions