China: Legal framework for e-commerce

The regulation of e-commerce in China is an area of growing complexity that may prove to be a minefield for multinational companies in particular. It is worth discussing this issue with reference to obligations in both the privacy and competition spheres.

Although the world economy was hit hard by COVID-19, China has recovered quickly, thanks in large part to its booming e-commerce business. There are also many emerging issues in the industry, which has aroused much attention across society. The E-commerce Law of the People's Republic of China ('the E-commerce Law'), effective as of 1 January 2019, already provides for a general legal framework to better regulate the industry. However, many new business models that are based on social media such as Wanghong economy (i.e. internet celebrity economy) and live commerce (i.e. sales via live broadcasting) are not explicitly addressed by the E-commerce Law.

This leaves the potential for misconduct which infringes upon consumers' rights and interests, while regulators will not be able to find proper legal basis to address this through enforcement. Against such a background, the State Administration for Market Regulation updated the Measures for Supervision and Administration of Online Transactions which came into effect on 1 May 2021 ('the Online Transaction Measures') to catch up with the changing situation by providing more detailed and practical guidelines for good practice and law enforcement. Below are some highlights worth noting.

Relevance to international companies

The Online Transaction Measures regulate 'online transaction operator', which refers to any natural person, legal person, or unincorporated organisation that organises and carries out online transaction activities, including online transaction platform operators, platform-based operators, self-built website operators, and online transaction operators that carry out online transaction activities through other network services. Such definition generally covers various players in the e-commerce industry and now particularly addresses sales-related activities conducted via social media or those having social media features (such as live streaming).

Among others, online transaction platform operators and network services providers have become the focus of the updated Online Transaction Measures. Various new obligations have been imposed on these two types of platforms, such as obligations to monitor user activities and report irregularities to authorities, as well as to store live streaming videos of online transaction activities for at least three years. Due to investment access restrictions (i.e. foreign companies are not allowed to have a majority stake in online platform businesses, for which a special value added telecom licence is required and difficult to obtain in practice), these obligations generally do not hit foreign multinationals who cannot in any case participate in such business activities. However, foreign multinationals could still find themselves confused by the concepts of 'platform based operator' (e.g. operating a flagship store on business-to-consumer platforms) or 'self-run website operator' (e.g. selling products or services via its own Chinese website), which are not so heavily regulated but still require a careful approach to risk management. Respective obligations associated with these two kinds of roles include e.g. online publication of one's business licence, other permits or certificates, good data and privacy protection practice, and spamming prohibition.

Violation of the obligations under the Online Transaction Measures could lead to administrative penalties including but not limited to being ordered to rectify failings, a fine up to RMB 30,000 (approx. €3,830), etc. More importantly, any violation will go into the corporate social credit system and be published, which could have quite some complicated implications and jeopardise an international company's operation in China, seeing as this credit system is developing in a way more and more being used to linking up with e.g. access to market resources and regulatory treatment.

Tightened privacy protection

Data and privacy protection has become a hot topic in China due to rampant misuse of personal data in the commercial field. In response to the general concern of society on this topic, the Online Transaction Measures reiterate the general principles for the collecting and processing of personal data, as these have already been addressed by many other laws and regulations including the recent draft Personal Information Protection Law (e.g. the principles of legality, legitimacy and necessity, transparency, and prior consent). Particularly, the Online Transaction Measures address the new requirements elaborated below, which relate to data and privacy protection and which international companies should pay special attention to. Firstly, activities forcing consumers or in any other way misleading consumers into agreeing to the collection and use of personal information that is not directly related to the concerned sales/service are prohibited, which may include:

• a one-time 'cover all' consent/authorisation;
• default 'opt-in';
• bundled consent; and
• cessation of the installation of the app or using the service.
  
  

The above are typical examples of misconduct which have long been the target of strong criticism from the public. Many are closely linked to the abuse of strong market positions by companies. Excessive collection of personal data that is widely seen in the e-commerce  field also violates the 'data minimisation' principle. For many years it remained the situation that data subjects, excepting some general legal principles, could not find a reliable legal basis to enforce and secure their rights/interests. The few law enforcement campaigns carried out by governmental authorities also turned out to be largely inefficient in turning this around. Now the Online Transaction Measures reduce such ambiguities by providing a detailed 'code of conduct' that companies should follow. It would be recommendable for international companies to revisit and update where necessary their existing privacy and data protection practice/documentation for the Chinese market, so as to stay in tune with these new requirements.

Moreover, Article 13 of the Online Transaction Measures specifically addresses the issue of how to handle sensitive personal information. It stipulates that the collection and use of sensitive personal information such as biometric features, medical and healthcare records, financial accounts, and location tracking information shall require item-by-item consent from consumers. This goes beyond the requirements of the draft Personal Information Protection Law, which only requires 'separate' consent by data subjects rather than a more cautious 'item-by-item' approach herein. Based on our observation, the item-by-item consent approach is not yet widely adopted in the market, including by international companies. Most companies may have their privacy policy, but do not have a good consent collection process in place. This new requirement under the Online Transaction Measures will be quite challenging for companies, as more consent collection means higher business hurdles. Each international company will need to find a proper way to balance this out in their respective scenarios.

Prohibition of unfair competition

Prohibition of unfair competition is another key focus of the Online Transaction Measures. Deceiving or misleading conducts that are strictly barred include:

• fabricating transactions or consumer review/comments;
• manipulating reviews/comments by placing positive comments at the top while placing negative comments at the end, or not prominently distinguishing customers' reviews/comments of different commodities or services;
• conducting false marketing by means of falsely alleging a commodity status, fictitious reservation, etc.; or
• fabricating statistics such as fake hits, fake followers, fake likes, and fake rewards.

The above tricks are still commonly seen in the China market, although international companies usually refrain from doing this directly themselves. However, this topic is still highly relevant for international companies, since many of them may have engaged a local service provider to operate their online store on blog platforms (i.e. so-called 'TPs'). The TPs may, due to key performance indicators or other pressures, engage in activities that are closely associated with the above illegal practice in the guise of providing e.g. 'smart marketing solutions'. It is advisable for all international companies to run an online business heath check regarding the above, particularly on the service supplier side.

Conclusions

An update of the Online Transaction Measures is a very positive step for China to establish a prosperous and well-ordered online market. With more detailed guidelines, the potential for companies to make money by exploiting any grey areas or even by malpractice is substantially reduced. This is maybe bad news for certain aggressive business models but very good news for those who eschew such tactics. Better protection of the rights and interest of data subjects will also help to build up consumers' confidence in e-commerce business in the long-run. Restrictions imposed on the big platforms could even serve the interest of those foreign brands who wish to further penetrate the Chinese market by expanding their online shops on such platforms.

Although many issues addressed in the Online Transaction Measures do not appear, at first glance, to be relevant to most foreign companies, given the foreign investment access restrictions (i.e. foreign companies who are not allowed to invest in platform businesses like social media), policy liberation in recent years (e.g. the possibility of doing e-commerce business with 100% foreign owned companies) means the new requirements could still hit some of those foreign companies that have successfully entered certain niche markets like the online platform for luxury brands. It goes without saying that keeping a close eye on such legislative developments and taking actions (e.g. in terms of privacy) to always stay compliant is the only way to remain successful in the rapidly changing Chinese market.