On 6 September 2023 the Cyberspace Administration of China announced a cybersecurity review-related administrative penalty against CNKI, ordering it to stop unlawful personal information processing and imposing a fine of RMB 50 million. The notice cited collection contrary to the necessity principle, processing without consent and failure to delete personal information promptly.
The significance lies not in the amount but in turning the often-overlooked necessity principle of the Personal Information Protection Law into a verifiable enforcement example.
Necessity is not a slogan
The PIPL requires a clear and reasonable purpose, limited to the minimum scope needed to achieve it, and prohibits excessive collection. Necessity has two layers: necessity of purpose and minimality of scope.
For an academic literature platform, collecting account, library and search history data is reasonable. Collecting information unrelated to core functions, or expanding collection in the name of “service improvement”, is harder to justify. Companies should map every field to a specific function rather than writing broadly in a privacy policy.
Consent is not a master key
The notice referred to processing without consent. In practice, many companies assume a general consent in the privacy policy covers all processing. But consent must be specific, informed, voluntary and withdrawable. Bundling consent into registration, or forcing it by making refusal equivalent to no service, may undermine validity.
Where the purpose changes, consent must be renewed or another legal basis found. Prior consent does not authorise new uses.
Deletion and retention
The notice also cited failure to delete promptly. Deletion is often neglected because it lacks a clear business action. Yet it applies to account cancellation, service termination, achievement of purpose and user requests, and requires executable processes and records.
Companies should specify which data is deleted under what conditions, by whom, how verified and how copies in backups are handled. A promise to “delete promptly” without operational mechanics is hard to evidence on inspection.
The knock-on effect of cybersecurity review
The penalty was connected to cybersecurity review. Personal information issues are not only PIPL issues; they may trigger cybersecurity and data security review. For platforms holding large volumes of user, academic or industry data, scrutiny extends to cross-border transfer, critical information infrastructure and supply chain security.
Compliance should not be sliced into unrelated modules. Personal information, data security, network security and outbound transfer are usually one evidence chain in an inspection.
Five self-checks for platforms
First, whether collection fields map one-to-one to functions, and whether “collect first, justify later” fields exist. Second, whether the privacy policy is specific and readable, stating purpose, method, scope and retention. Third, whether consent is withdrawable and not bundled. Fourth, whether deletion and cancellation processes are executable and verifiable. Fifth, whether a personal information protection officer, impact assessment and compliance audit mechanism exist.
For personal information and data compliance, see our data compliance service; for cybersecurity review and incident handling, see cybersecurity compliance; for ongoing support, see annual legal counsel.
This article is based on the notice of the Cyberspace Administration of China of 6 September 2023. It is for reference only and does not constitute legal advice.