Meaning
Article in the Personal Information Protection Law of the People’s Republic of China governing the rights and obligations of joint personal information handlers. Personal information protection law article 20 requires parties who determine the purpose and method of processing together to establish their respective responsibilities. This provision is essential for partnerships and integrated supply chains where data flows between multiple entities.
It defines the point where individual responsibility ends and collective accountability begins.
Joint Liability
Individuals have the right to seek damages from any entity involved in their data processing if a violation occurs. Under personal information protection law article 20, handlers are held jointly and severally liable for damages caused by their activities. This ensures that a data subject can seek a remedy without having to identify which specific party committed the error within a complex network.
This legal standard prevents companies from using third-party agreements to shield themselves from their primary duty to the person whose data is being used.
Processing Agreement
Contracts between parties must detail the specific scope and purpose of the work to be performed. The creation of a formal agreement is the standard way to satisfy personal information protection law article 20. While the internal agreement can allocate different tasks to different parties, it cannot override the statutory joint liability toward the public.
Transparency Duty
Transparency requires handlers to inform the public about their data sharing arrangements clearly. Disclosure of these details helps satisfy personal information protection law article 20. Handlers must inform individuals about the existence and content of their joint processing arrangement, typically through a privacy policy that names all the entities involved.
Providing this clarity ensures that data subjects are aware of where their information resides and who is accountable for its safety.
