Foreign brands operating in China have long enjoyed the freedom of accessing consumer data — without the need of informing internet users — to run personalised marketing campaigns ranging from customised emails to targeted product recommendations.

But as the tech-savvy nation joined the growing list of jurisdictions last November to introduce data privacy legislation, namely the Personal Information Protection Law (PIPL), to safeguard the interests of China’s 989 million internet users, companies are now required to give Chinese consumers informed consent on why their data is collected and how it is used. Consumers, in turn, are entitled to rescind their consent at any stage.

Fashion industry and legal experts say the move translates to higher compliance costs and reduces the ability of international brands to leverage data analysis to deliver personalised messages and product offerings to both existing and prospective customers. This poses challenges to brands seeking out data points to inform which products are brought to market at a time when data has become increasingly important with the acceleration of e-commerce driven by the Covid-19 pandemic.

“For years, brands in China have had access to customer data that enabled them to create hyper-personalised buyer journeys as well as products,” says Adrian Peh, general manager of fashion and beauty at Gusto Luxe, a Shanghai-based consulting firm for luxury brands.

“PIPL makes that more complicated with the need for explicit consent of the individual required when collecting personal information, solid confidentiality measures in place, and the data would also need to be obtained through legitimate sources.”

Among the challenges facing global luxury brands in the post-PIPL era is location tracking, a system fashion brands in China rely heavily on to realise omnichannel retail strategies.

“Many consumers will visit an offline location, interact with a brand’s WeChat mini programme or connect to a sales associate, and could later be re-targeted through WeChat, to make the purchase,” explains Peh.

Since the PIPL privacy law came into force, however, such actions are considered to be sensitive data collection, requiring the explicit consent of the consumer.

In some ways, China’s PIPL mirrors the European Union’s General Data Protection Regulation (GDPR). Individuals can access information that is held about them, ask for it to be corrected and deleted, and withdraw their consent for their information to be handled by a company; in turn, companies are required to protect people’s personal information.

Similar regulations are also in place in the US state of California where the Consumer Privacy Act gives consumers the right to know what personal data a company has access to and who it is shared with. Brazil’s Lei Geral de Proteção de Dados (LGPD) came into force last year, penalising companies that fail to protect consumers.

There are some notable differences between China’s privacy law and those elsewhere. Unlike GDPR in Europe, PIPL does not provide “legitimate interest” as a legal basis, which would have allowed companies in certain cases to process personal data without consent as long as it is collected legally and with justifiable reasons.

Another major difference between PIPL and GDPR is that, while both laws emphasise consumer privacy, the former was motivated by the Chinese government’s national security interests and built upon China’s cybersecurity and data security laws.

“One big difference [with GDPR] is that China’s laws are not terribly concerned about access of information by the [Chinese] government,” says Lester Ross, the partner-in-charge in the Beijing office of the WilmerHale law firm. “They are really concerned about access by the private sector, which may in turn be accessed by a foreign government.”

In terms of penalties, companies’ failure to comply with PIPL could see them face fines of up to 50 million yuan (about $7.8 million) or five percent of the preceding year’s revenue. Other possible consequences include confiscation of illegal gains, cessation of operation for rectification and revocation of operating permits or business licenses.

According to some working in the fashion industry, another way PIPL will likely differ from GDPR is in its enforcement regime.

“GDPR has been loosely enforced over the last few years [in Europe],” says Milton Pedraza, chief executive of the Luxury Institute, a research and consulting firm for luxury brands. “In China, you can bet that the law has teeth.”

Legal and Reputational Risks

For brands, the risks of strict enforcement and severe penalties since the introduction of PIPL mean there is even more at stake in the world’s largest fashion market, even if Chinese consumers in general are more willing to share their data than some of their international counterparts.

A 2020 survey conducted by management consulting firm McKinsey shows that consumers in the US and Europe are more concerned about corporate accumulation of personal data, while those in Brazil and China are more comfortable trading data privacy for personalised services.

China’s high levels of surveillance, from the social credit system to internet censorship, has contributed to its people’s willingness to share their personal data. “The government’s ability to monitor citizens’ lives and communications has increased dramatically in recent years, inhibiting online and offline conversations,” according to last year’s report by Freedom House, a Washington-based human rights organisation, which scored China 10 out of 100 points in its global ranking of internet freedom.

Pedraza believes that Chinese attitudes can also be explained by the ubiquity of platforms like WeChat.

“I think Chinese consumers understand probably better than the Americans and Europeans that in order to get the digital benefits, they need to share data. Because there are super-apps, people understand that when you do a payment, for example, you are sharing data and probably your location, et cetera.”

But just because consumers are used to their data being monitored or shared doesn’t mean companies can be spared criticism.

In its annual investigative report marking World Consumer Rights Day, Chinese state television CCTV named and shamed multiple brands last year, including fashion retailer MaxMara and others, for their alleged use of facial recognition on visitors. CCTV accused businesses of failing to obtain individuals’ consent in possible violation of China’s Civil Code, which came into effect last January. In response, MaxMara said it used the system to measure customer flow and did not capture personal data.

In terms of companies in the fashion industry, the risk is not just legal, it’s also reputational.

Beyond such media supervision of government regulation, consumer complaints will also play a role in PIPL as shoppers are empowered by law take companies to court, explains Ross, the lawyer from WilmerHale, who represents foreign companies in their strategic expansion in China.

“If we think about the consumer protection law which already exists in China, we know that there’s an industry that has emerged which people bring fairly trivial lawsuits against sales practices that [don’t conform with their expectations] as a violation,” he says. “It tends to be a nuisance lawsuit, but people can recover three times their loss, so there will be an increase in litigation [for companies].”

“In terms of companies in the fashion industry, the risk is not just legal, it’s also reputational,” Ross says. “We have seen companies be banned in China for doing something that is considered to be anti-China. [PIPL] is an area which it wouldn’t be anti-China but it could be anti-consumer and could arouse the same kind of reactions.”

Limitations on Cross-Border Data Transfer

For international brands which have in the past analysed data collected in China back in their headquarters in the US or Europe, restrictions brought by PIPL on cross-border data transfer could be a major pain.

This is because while the law allows data collected in China to be transferred to other countries, it assigns different levels of required diligence depending on the sensitivity and volume of data. In addition to obtaining separate consent on the transfer of data from each relevant individual, companies (or as the law defines them “personal information processors”), must conduct an ex-ante impact assessment for personal data protection and record processing circumstances. In other words, companies are required to assess the potential impact on individuals before collecting consumer data.

Data transfer is also subject to security assessment and certification by the Cyberspace Administration of China (CAC), a state internet regulator in charge of PIPL. This is in sharp contrast to GDPR which is overseen by independent regulators in European Union member countries.

Because of these and other potential legal risks, Luxury Institute’s Pedraza advises brands to never take data collected from Chinese consumers outside of China.

“That’s a huge no-no,” he warns. “The fact that the Chinese law is also created for national security — which means the Chinese government can have access to the data — that’s something that a brand needs to decide: am I in agreement with that, even though that’s not what happens in the US or in Europe?”

To remain compliant with fewer risks, brands can build a local data management platform and work out how to analyse the data within China. This could encourage brands which have relied on selling products in China without a physical presence to establish operations there, instead of relying on e-commerce platforms such as Tmall, suggests Pablo Mauro, managing director of the China division of Digital Luxury Group, a digital partner of luxury and premium brands.

“Now that [brands] have the responsibility of storing data locally, it might force [them] to directly take that step of physically entering the [Chinese] market rather than starting from a cross border model,” he says.

Uncertain Future Business Implications

In what critics say is a move motivated in part by the state’s desire to rein in the rising power of tech giants, China’s congress passed the PIPL on Aug. 20 and adopted the regulations on Nov. 1. With a short window to introduce measures to ensure compliance, some companies were left unprepared. For others, it appeared to be the nail in the coffin for businesses operating in an already challenging business environment.

On the day PIPL was introduced, Yahoo pulled out of China over “increasing challenging businesses and legal environment” in the country. LinkedIn, meanwhile, ended its services in China a month before PIPL came into effect, as a result of “a considerably more difficult operating environment and higher regulatory requirements”.

According to a poll of 288 companies by the British Chamber of Commerce in China (BritCham), navigating cybersecurity and IT regulations is among the top three challenges facing British businesses in China in 2022.

There are a lot of areas such as how [data] thresholds are calculated and what the actual process of an external security assessment may look like, [that] are unclear.

BritCham senior policy analyst Anika Patel says companies are looking for more detail on PIPL, suggesting more clarity be provided on the new rules.

“Some of the areas of the PIPL do mirror GDPR,” says Patel, who focuses on China’s political economy and regulatory environment for foreign businesses: “But there are a lot of areas such as how [data] thresholds are calculated and what the actual process of an external security assessment may look like, [that] are unclear.”

“Whilst I would say the majority of companies, for now, it’s business as usual … they don’t necessarily know what that might look like, in two, three, five years’ time,” she says.

Another layer of uncertainty facing international brands is how the law could impact other areas of business such as the supply chain, which has been put under even more pressure since the arrival of the Omicron variant of Covid-19.

About two weeks after PIPL came into force, ships in Chinese waters disappeared from tracking systems as domestic providers in China stopped giving shipping information to foreign companies as a direct consequence of the law, Reuters reported. The shipping data is used to provide information on cargo volumes and helps optimise logistics by predicting congestion so companies can make key decisions on shipping routes.

Patel says while none of BritCham members raised the issue of shipping data, the report “does speak to a wider point of unintended consequences.”

“What companies don’t know is what else should be on their radar necessarily,” Patel adds. “That’s a challenge and a cause for concern.”

CHINA NEWS FROM THE PAST WEEK

By Casey Hall

时尚与美容

FASHION & BEAUTY

Zara Chooses Susan Fang for First Chinese Designer Collaboration

Spanish fast fashion giant Zara is collaborating with Susan Fang on a Chinese New Year capsule collection, which will be released in selected stores and online Jan. 17. Compared to rivals H&M and Uniqlo, Zara was long famous for its non-collaboration policy, but the retailer had a notable change of heart in 2021, collaborating with Everlast in January, Kassl Additions in September and Charlotte Gainsburg in October. In December, it debuted another collaboration with Korean streetwear label Ader Error, a collection which sold out in a day. This will be the first time Zara collaborates with a Chinese designer. (BoF)

Sequoia Capital China Acquires Majority Stake in We11done

Buzzy South Korean contemporary brand We11done is Sequoia Capital China’s latest fashion bet, following investments in Ami and Ssense last year. The China-based investment firm that counts Vogue China’s former editor-in-chief Angelica Cheung among its partners announced Thursday it would acquire the brand for an undisclosed sum. The deal will allow We11done, co-founded in 2015 by Jessica (Hyejin) Jung and Dami Kwon, to accelerate the growth of its direct-to-consumer business across China, Europe and the US, by leveraging Sequoia Capital China’s local and global networks and its expertise in technology and retail. (BoF)

Bottega Veneta Hosts a Brand Takeover On the Great Wall of China

In honour of Chinese New Year, Bottega Veneta staged a takeover on the Great Wall of China from Jan. 6 to Jan. 12. The display showcased not only Bottega Veneta’s name and logo, but also the message ‘Happy New Year’. The installation was done in Bottega Veneta’s signature green as well as a tangerine shade of orange, which the brand chose because it’s a symbol of luck in China. Along with the takeover, the Kering-owned brand pledged a donation to the Shanhai Pass, one of the major passes on the Great Wall of China and its easternmost stronghold. (BoF)

科技与创新

TECH & INNOVATION

LVMH Brands Double Down on JD.com Partnerships

Givenchy’s JD.com mini programme officially launched last Tuesday, making the French label the latest in a raft of brands from luxury conglomerate LVMH to join forces with the Chinese e-commerce platform. Even brands notoriously averse to partnering with third-party e-commerce platforms, such as Louis Vuitton, Dior and Bulgari have signed on to JD.com’s mini programmes over the past 12 months in order to better reach China’s young, digitally-native luxury consumer base. (BoF)

China’s Tech Start-Ups Continue to Attract Record Levels of Funding

China’s tech sector attracted record levels of investment in 2021, even as the country continued to crack-down on previously high-flying technology firms. The focus of investment, however, has shifted dramatically away from consumer-facing internet firm and towards so-called “hard technology” sectors, such as semiconductors and biotechnology that experts say better reflect the Chinese government’s current priorities. (The Wall Street Journal)

消费与零售

CONSUMER & RETAIL

Gen-Z is China’s Fastest-Growing Consumer of Imported Goods

The number of shoppers born after 2000 grew more than 70 percent on Alibaba’s cross-border marketplace Tmall Global in the 12 months ended March 2021 and of the 100 million annual active users on the platform, around 30 percent were born after 1995. “Consumers of imported goods are getting much younger, with the fastest growth from Gen-Z consumers, [so] their huge consumption potential is important to brands,” Alvin Liu, president of Alibaba B2C Retail, told a virtual summit held last week for international brands. (Alizila)

Report: China’s Retail Sales to Grow 6% in 2022

A new report from Hong Kong-based Fung Business Intelligence Group (FBIG), a think tank, estimates China’s retail sales will grow around 6 percent in 2022 as the government continues to combat the impact of the Covid-19 pandemic and strengthens its measures and policies to boost consumption. The focus, according to the “Ten Highlights of China’s Commercial Sector 2022″ report, will be on green living and rural consumption. (South China Morning Post)

政治,经济与社会

POLITICS, ECONOMY, SOCIETY

Chinese Lockdowns Could Worsen Supply Chain Disruptions

Companies are expecting further potentially debilitating supply chain disruptions as China, home to about a third of global manufacturing, continues to institute sweeping lockdowns to keep the Omicron variant of Covid-19 under control. These lockdowns currently mean tens of millions of people are confined to their homes in several Chinese cities. The country’s manufacturers, after already spending two years dealing with crippling supply chain woes are worried another round of shutdowns at Chinese factories and ports will add to these troubles at a time when rising prices for raw materials and shipping along with extended delivery times and worker shortages are already wreaking havoc. (The New York Times)

China’s Economy Grows 8.1% in 2021, Retail Sales Slow in December

The country’s industrial production rose steadily offsetting a drop off in retail sales growth, according to official data from China’s National Bureau of Statistics (NBS) released on Monday. China’s fourth quarter GDP rose by 4 percent year-on-year, the NBS said,; analysts polled by Reuters had expected China to report fourth-quarter GDP growth of 3.6 percent. December retail sales missed expectations, growing by 1.7 percent compared to a year ago. Analysts polled by Reuters had predicted a 3.7 percent year-on-year increase. (CNBC)

KFC Promo Comes Under Fire for Encouraging Food Waste

The China Consumers Association has urged consumers to boycott a wildly popular collaboration from KFC and toy maker Pop Mart International, saying it contravenes social values by encouraging food waste. A statement from the association released last week claimed one person bought 106 meals, spending nearly 10,500 yuan ($1,650) to get the entire limited edition collection of toys. Others are said to have paid people to eat extra meals they purchased in the week since the promotion started or just bought the 99 yuan ($15.58) set for the toy and threw the food away. (Bloomberg)

China Decoded wants to hear from you. Send tips, suggestions, complaints and compliments to our Shanghai-based Asia Correspondent casey.hall@businessoffashion.com.