This article provides a comparative analysis of the European Union’s (EU’s) General Data Protection Regulation (GDPR), the Personal Information Protection Law of the People’s Republic of China (PIPL), and the California Consumer Privacy Act (CCPA) (which, in the absence of a federal data protection law in the United States, constitutes the country’s most developed state-level regime), covering three of the world’s largest economies, within thematic domains such as the definition of personal data, sensitive data, scope of application, the notion of a data controller, the right to object or opt out, children’s data protection, and cross-border data transfers.
The research question addressed in this article is the extent to which the PIPL and the CCPA converge with the GDPR, and the similarities and differences across the specific domains analysed herein. This question is non-trivial because, to cite only one example per statute, under the PIPL the legitimate interests ground familiar from Article 6(1)(f) GDPR does not appear as a general legal basis for processing; conversely, unlike the GDPR and the PIPL, the CCPA does not establish a general regime for international transfers of personal information.
A comparative assessment of the GDPR, PIPL and CCPA across the domains examined in this article demonstrates that the Chinese PIPL exhibits a higher degree of substantive alignment with the GDPR than the California CCPA does. The comparatively greater alignment of the PIPL arises from the normative convergence between the GDPR and the PIPL, as well as from the structural differences between the GDPR and the CCPA in the areas under examination. This does not imply that GDPR–PIPL divergences are insignificant; they are not. However, where a statute contains cross-border transfer mechanisms designed to ensure the protection of personal data after transfer, one can meaningfully speak of a degree of convergence and, where possible, assess its extent. Conversely, the absence of any international transfer provisions, and therefore of legal guarantees for post-transfer protection, must be evaluated differently.
On the other hand, it is also necessary to consider the existence and effective functioning of at least one independent supervisory authority. The Cyberspace Administration of China (CAC) is the lead authority under Article 60 PIPL, but it is not independent within the meaning of Articles 51–52 GDPR. By contrast, mirroring the GDPR’s requirements in Article 52 and the definition in Article 4(21), the California Privacy Protection Agency (CPPA) is characterized by statutory independence (California Civil Code, section 1798.199.15).
Global Privacy Law Review