China’s personal information protection in a data-driven economy: A privacy policy study of Alibaba,Baidu and Tencent

Abstract

By examining the privacy policies of leading Chinese Internet and information service providers (IISPs), this study found their privacy policies to be generally compliant with China’s personal information protection provisions. These IISPs use proper mechanisms showing their commitment, measures and enforcement to data security, but their Fair Information Practices need improvement. Personal information protection in China is severe. Privacy policies offer more ‘notice’ than they do ‘choice’. Chinese IISPs collect and use information extensively in the guise of providing value to users, but have given insufficient consideration to transborder data flows and change of ownership. Societal and technological mechanisms have not been widely sought.

Keywords

Alibaba Baidu personal information privacy privacy policy Tencent

Get full access to this article

View all access options for this article.

References

Altman

(1975) The Environment and Social Behavior: Privacy, Personal Space, Territory, Crowding. New York: Irving.

Altman

(1977) Privacy regulation: Culturally universal or culturally specific? Journal of Social Issues 33(3): 66–84.

Ang

(2013) Media self-regulation can work if it is done right. Media Asia 40(4): 315–317.

Anton

Earp

(2001) A taxonomy for Web site privacy requirements. Technical Report TR-2001-14. Raleigh, NC: Department of Computer Science, North Carolina State University. Available at: https://www.cc.gatech.edu/~aianton/assets/ataxonomyforwebsiteprivacy.pdf (accessed 10 May 2014).

Arcand

Arle-Dufour

Nantel

, et al. (2007) The impact of reading a Web site’s privacy statement on perceived control over privacy and perceived trust. Online Information Review 31(5): 661–681.

Balebako

Bravo-Lillo

Cranor

(2015) Is notice enough: Mitigating the risks of smartphone data sharing? I/S: A Journal of Law and Policy for the Information Society 11(2): 279–323.

Bok

(1982) Secrets: On the Ethics of Concealment and Revelation. New York: Pantheon Books.

Chan

Hao

, et al. (2012) Microblogging, online expression, and political efficacy among young Chinese citizens: The moderating role of information and entertainment needs in the use of Weibo. Cyberpsychology, Behavior & Social Networking 15(7): 345–349.

China Internet Network Information Centre (CNNIC) (2014a) 2013 nian zhongguo hulianwang fazhan dashiji jieguo gongbu (Results released: China Internet events of the year 2013). Available at: http://www.cnnic.cn/gywm/xwzx/rdxw/2014/201405/t20140521_47076.htm (accessed 21 May 2014).

10.

Cooley

(1888) A Treatise on the Law of Torts. Chicago, IL: Callaghan.

11.

Cranor

(2012) Necessary but not sufficient: Standardized mechanisms for privacy notice and choice. Journal of Telecommunications and High Technology Law 10: 273–307.

12.

Cranor

Leon

(2016) A large-scale evaluation of U.S. financial institutions’ standardized privacy notices. ACM Transactions on the Web 10(3): Article 17.

13.

Culnan

Armstrong

(1999) Information privacy concerns, procedural fairness, and impersonal trust: An empirical investigation. Organization Science 10(1): 104–115.

14.

DeCew

(1997) In Pursuit of Privacy: Law, Ethics, and the Rise of Technology. Ithaca, NY: Cornell University Press.

15.

EMC (2014) EMC privacy index. Available at: http://www.emc.com/campaign/privacy-index/index.htm (accessed 20 February 2015).

16.

European Data Protection Supervisor (2014) Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the digital economy. Available at: https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2014/14-03-26_competitition_law_big_data_EN.pdf (accessed 26 March 2014).

17.

Federal Trade Commission (FTC) (2000) Privacy online: Fair information practices in the electronic marketplace: A report to congress. Available at: http://www.ftc.gov/sites/default/files/documents/reports/privacy-online-fair-information-practices-electronic-marketplace-federal-trade-commission-report/privacy2000text.pdf (accessed 25 May 2000).

18.

Farrall

(2008) Global privacy in flux: Illuminating privacy across cultures in China and the U.S. International Journal of Communication 2: 993–1030.

19.

FTC (2010) Protecting consumer privacy in an era of rapid change: A proposed framework for businesses and policymakers. Available at: http://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-bureau-consumer-protection-preliminary-ftc-staff-report-protecting-consumer/101201privacyreport.pdf (accessed 10 May 2015).

20.

FTC (2012) Protecting consumer privacy in an era of rapid change: Recommendations for businesses and policymakers. FTC Report, 26 March. Available at: http://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-report-protecting-consumer-privacy-era-rapid-change-recommendations/120326privacyreport.pdf (accessed 10 May 2015).

21.

Gellman

(2016) Fair information practices: A basic history. Available at: https://bobgellman.com/rg-docs/rg-FIPshistory.pdf (accessed 8 March 2017).

22.

Graber

D’Alessandro

Johnson-West

(2002) Reading level of privacy policies on internet health web sites. Journal of Family Practice 51(7): 642–645.

23.

Guo

Guilford

Sonnad

(2014) All the Western companies you’d have to combine to get something like Alibaba. Quartz, 6 May. Available at: http://qz.com/206283/all-the-western-companies-youd-have-to-combine-to-get-something-like-alibaba/ (accessed 11 December 2014).

24.

Hoffman

Novak

Peralta

(1999) Building consumer trust online. Communications of the ACM 42(4): 80–85.

25.

Jensen

Potts

(2004) Privacy policies as decision-making tools: An evaluation of online privacy notices. In: Proceedings of the SIGCHI conference on human factors in computing systems (CHI), Vienna, 24–29 April, pp.471–478. New York: ACM.

26.

Jourard

(1966) Some psychological aspects of privacy. Law and Contemporary Problems 31(2): 307–318.

27.

Kabanda

Brown

Nyamakura

, et al. (2010) South African banks and their online privacy policy statements: A content analysis. SA Journal of Information Management 12(1): 1–7.

28.

Kelley

Bresee

Cranor

, et al. (2009) A ‘Nutrition label’ for privacy. In: Proceedings of the 5th symposium on usable privacy and security (SOUPS), Mountain View, CA, 15–17 July. New York: ACM.

29.

Kugler

(2015) Online privacy: Regional differences. Communications of the ACM 58(2): 18–20.

30.

Lichtenstein

Swatman

Babu

(2002) Effective online privacy policies. In: Proceedings of the ACIS 2002. Available at: https://pdfs.semanticscholar.org/996c/23703dbc1e0de265469c0b59f6c93aef47ab.pdf (accessed 8 March 2015).

31.

McDonald

Cranor

(2008) The cost of reading privacy policies. I/S: A Journal of Law and Policy for the Information Society 4: 540–565.

32.

Mathews

(Ed.) (2014) Proskauer on Privacy: A Guide to Privacy and Data Security Law in the Information Age. New York: Practicing Law Institute.

33.

Maxwell

(1996) Qualitative Research Design: An Interactive Approach. Newbury Park, CA: Sage.

34.

Mendel

Puddephatt

Wagner

, et al. (2012) Global Survey on Internet Privacy and Freedom of Expression. Paris: The United Nations Educational, Scientific and Cultural Organization.

35.

National People’s Congress (NPC) (2007) Electronic signature law of the people’s Republic of China. Available at: http://www.npc.gov.cn/englishnpc/Law/2007-12/05/content_1381960.htm (accessed 2 February 2015).

36.

National Research Council (NRC) (2007) Engaging Privacy and Information Technology in a Digital Age. Washington, DC: The National Academies Press.

37.

Online Privacy Alliance (n.d.) Rules and tools. http://www.privacyalliance.org/resources/rulesntools/ (accessed 11 November 2016).

38.

Organization for Economic Co-operation and Development (OECD) (1980) OECD guidelines on the protection of privacy and transborder flows of personal data. Available at: https://www.oecd.org/internet/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm (accessed 2 November 2016).

39.

Organization for Economic Co-operation Development (OECD) (2013) The OECD privacy framework. Available at: http://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf (accessed 2 November 2016).

40.

PCAST (2014) Report to the president: Big data and privacy – A technological perspective. Available at: https://www.hsdl.org/?abstract&did=755569 (accessed 5 November 2015).

41.

Pinnick

(2011) Layered policy design. Available at: http://www.truste.com/blog/2011/05/20/layered-policy-and-short-notice-design/ (accessed 1 March 2017).

42.

Podesta

(2014) Findings of the big data and privacy working group review. The White House Blog, 1 May. Available at: http://www.whitehouse.gov/blog/2014/05/01/findings-big-data-and-privacy-working-group-review (accessed 8 February 2015).

43.

Pollach

(2007) What’s wrong with online privacy policies? Communications of the ACM 50(9): 103–108.

44.

Rains

Bosch

(2009) Privacy and health in the information age: A content analysis of health web site privacy policy statements. Health Communication 24(5): 435–446.

45.

Reidenberg

Breaux

Cranor

, et al. (2015) Disagreeable privacy policies: Mismatches between meaning and users’ Understanding. Berkeley Technology Law Journal 30(1). Available at: http://scholarship.law.berkeley.edu/btlj/vol30/iss1/3 (accessed 2 November 2016).

46.

Reinard

(2007) Introduction to Communication Research. New York, NY: McGraw Hill.

47.

Schoenbachler

Gordon

(2002) Trust and customer willingness to provide information in database-driven relationship marketing. Journal of Interactive Marketing 16(3): 2–16.

48.

Shayon

(2014) Why Western brands love China’s WeChat platform. brandchannel, 7 August. Available at: https://www.brandchannel.com/2014/08/07/why-western-brands-love-chinas-wechat-mobile-platform/ (accessed 22 January 2016).

49.

Tang

Smith

(2007) Gaining trust through online privacy protection: Self-regulation, mandatory standards, or caveat emptor. Journal of Management Information Systems 24(4): 153–173.

50.

Tsai

Egelman

Cranor

, et al. (2011) The effect of online privacy information on purchasing behaviour: An experimental study. Information Systems Research 22(2): 254–268.

51.

Villars

Olofson

Eastwood

(2011) Big data: What it is and why you should care. Available at: https://dataanalytics.report/view-resource.aspx?id=4519 (accessed 14 November 2014).

52.

White House (2012) We can’t wait: Obama administration unveils blueprint for a ‘privacy bill of rights’ to protect consumers online. The White House Blog, 23 February. Available at: http://www.whitehouse.gov/the-press-office/2012/02/23/we-can-t-wait-obama-administration-unveils-blueprint-privacy-bill-rights (accessed 8 February 2015).

53.

Wang

(2011) Protecting Privacy in China: A Research on China’s Privacy Standards and the Possibility of Establishing the Right to Privacy and the Information Privacy Protection Legislation in Modern China. Berlin: Springer.

54.

Warren

Brandeis

(1890) The right to privacy. Harvard Law Review 4: 193–220.

55.

Westin

(1967) Privacy and Freedom. New York: Atheneum.

56.

Westin

(2001) Opinion surveys: What consumers have to say about information privacy, executive summary. Prepared Witness Testimony, the House Committee on Energy and Commerce, U.S. Available at: https://www.gpo.gov/fdsys/pkg/CHRG-107hhrg72825/pdf/CHRG-107hhrg72825.pdf (accessed 8 February 2015).

57.

Westin

(2004) How to craft effective online privacy policies. Privacy and American Business 11(6): 1–2.

58.

Wimmer

Dominick

(2011) Mass media research: An introduction, 9th edn. Boston, MA: Wadswort.

59.

Huang

Yen

, et al. (2012) The effect of online privacy policy on consumer privacy concern and trust. Computers in Human Behavior 28: 889–897.

60.

Zhang

Sakaguchi

Kennedy

(2007) A cross-cultural analysis of privacy notices of the global 2000. Journal of Information Privacy & Security 3(2): 18–36.

61.

Zhao

Zheng

(2016) Zhongguo dianzi zhengwu yinsi baohu wenti tanjiu: Jiyu 70 ge dazhongchengshi zhengfu wangzhan de ‘yinsi shengming’ diaocha [Privacy protection of China’s e-governance: An investigation of privacy statements of government’s websites of 70 large and medium-sized cities]. E-Government 163: 81–93.