When separate consent is required
The provisions listed below call for when consent is required. It is different from a general acceptance of a privacy notice and must relate to the specified activity. Article 13 says consent is not required when one of its listed non-consent circumstances applies, so document the exact Article 13 conclusion before designing the consent flow. The processor must still satisfy the applicable notice, necessity, security, and impact-assessment duties.
Where processing relies on consent, Article 14 requires a voluntary and explicit choice made with sufficient knowledge. If the purpose, processing method, or categories of personal information change, obtain consent again. Article 15 also requires a convenient way to withdraw consent. A contract necessity or other Article 13 circumstance should be assessed on its own conditions; it is not created by a separate-consent screen.
- Providing personal information to another personal information processor: identify the recipient, contact details, purpose, method, and information categories before obtaining .
- Public disclosure: obtain unless a specific legal rule permits the disclosure.
- Public-place image or identity-recognition information: use it only to protect public security unless supports another purpose and the other legal conditions are met.
- Sensitive personal information: establish a specific purpose and sufficient necessity, use strict protective measures, give the additional necessity-and-impact notice, and obtain . A law or administrative regulation may also require written consent.
- Providing personal information outside China: identify the overseas recipient, its contact details, purpose, method, information categories, and the procedure for exercising PIPL rights before obtaining .
Citations (2)
- PRC Personal Information Protection Law
Articles 14-17 govern informed consent, renewed consent, withdrawal, and general notice. Articles 23, 25, 26, 29, and 39 identify the activities that require separate consent and the additional information that must be given.
- Network Data Security Management Regulations
Article 62 defines separate consent as a specific and explicit consent made specifically for a particular processing of personal information.