Personal Information Protection Law of the People’s Republic of China (PIPL)

About This Policy

Policy Owner: University Counsel
Responsible Office: University Counsel

Policy Contact: China-PIPL@montclair.edu

Print or view a PDF of this policy

Personal Information Protection Law of the People’s Republic of China (PIPL)

中华人民共和国个人信息保护法（个人信息保护法）

About This Policy

关于本政策

Responsible Office: University Counsel and Enrollment Management

主管办公室: 大学法律顾问与招生管理

Montclair State University is committed to respecting and protecting the privacy rights of all persons consistent with the Personal Information Protection Law (“PIPL”) of the People’s Republic of China (PRC) that was adopted in August 2021 and became effective on November 1, 2021. This policy describes Montclair State University’s commitment to the privacy of persons in Mainland China. Additional information about the PIPL can be found at PIPL. For the purposes of this Policy, the term “Personal Information” shall include any personal information and sensitive personal information as defined in the PIPL and the term “Mainland China” shall refer to the continental landmass under the direct control of the People’s Republic of China (PRC), including the islands of Hainan Province and five major autonomous regions (i.e., Tibet, Inner Mongolia, Xinjiang, Ningxia and Guangxi), but excluding the Hong Kong Special Autonomous Region (SAR), Macao SAR and Taiwan.

蒙特克莱尔州立大学致力于按照2021年8月通过并于2021 11月1日生效的《中华人民共和国个人信息保护法》（“个人信息保护法”）尊重和保护所有人的隐私权。本政策描述了蒙特克莱尔州立大学对中国大陆个人隐私的承诺。有关个人信息保护法的更多信息，请访问个人信息保护法。就本政策而言，“个人信息”应包括个人信息保护法中定义的任何个人信息和敏感个人信息，“中国大陆”应指中华人民共和国（中国）直接管辖的大陆地区，包括海南岛和五个自治区（如西藏、内蒙古、新疆、宁夏和广西），但不包括香港特别行政区、澳门特别行政区和台湾省。

The PIPL applies to all natural persons located in Mainland China and has both a domestic and extraterritorial scope of application. The PIPL applies to the handling of Personal Information related to activities carried out inside Mainland China and also applies to the handling of Personal Information outside Mainland China under any of the following conditions: 1) The purpose is to provide products or services to domestic natural persons; 2) The purpose is to analyze and evaluate the activities of domestic natural persons; or 3) Other circumstances provided by laws and regulations.

个人信息保护法适用于位于中国大陆的所有自然人，具有域内和域外效力。个人信息保护法适用于在中国大陆境内处理自然人个人信息的活动，也适用于在以下情形之一在中国大陆境外处理个人信息：1）以向境内自然人提供产品或者服务为目的；2）分析、评估境内自然人的行为；（三）法律、行政法规规定的其他情形。

The PIPL is designed to protect the privacy of data, imposing a very broad set of data privacy regulations and requirements on the handling of Personal Information concerning a natural person that is collected or processed in, or transferred out of, Mainland China, and to regulate entities that offer goods or services in the Mainland China.

个人信息保护法旨在保护数据隐私，对在中国大陆收集、处理或转移出中国大陆的自然人个人信息的处理实施一系列非常广泛的数据隐私法规和要求，并对在中国大陆提供商品或服务的实体进行监管。

The PIPL defines personal information as “various kinds of information related to identified or identifiable natural persons recorded by electronic or other means, excluding the information handled anonymously.” Personal information would include but is not limited to a name, reference number, identification number, online identifier, email address, IP address, etc. The PIPL also includes a special category of personal information, Sensitive Personal Information (“SPI”), that has additional security and handling requirements. Sensitive Personal Information is defined as ‘information that can easily lead to the infringement of the personal dignity of natural persons or the harm of personal or property safety once leaked or illegally used, including such information as biometrics, religious belief, specific identities, medical health, financial accounts, and whereabouts (e.g., location data), and the personal information of minors under the age of 14. Therefore, the PIPL, has broader protections than U.S., N.J. and other foreign laws.

个人信息保护法将个人信息定义为“以电子或者其他方式记录的与已识别或者可识别的自然人有关的各种信息，不包括匿名化处理后的信息。”个人信息包括但不限于姓名、参考号、识别号、在线标识符、电子邮件地址、IP地址等。个人信息保护法还包括一类特殊的个人信息，即敏感个人信息，具有额外的安全和处理要求。敏感个人信息被定义为“一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等信息，以及不满十四周岁未成年人的个人信息。”因此，个人信息保护法比美国、新泽西州和其他外国法律提供了更广泛的保护。

The PIPL requires Personal Information to be processed lawfully, fairly, and for a definite and reasonable purpose. Personal Information should be processed in a manner that has the least impact on the individuals’ rights and interests and limited to only information that is necessary and directly related to the purpose of processing. Personal Information should be maintained for integrity and accuracy, stored only for the length of time required or needed to achieve the purpose, and safeguarded from unauthorized disclosure.

个人信息保护法要求合法、公正地处理个人信息，并有明确合理的目的。应以对个人权益影响最小的方式处理个人信息，并仅限于与处理目的直接相关的必要信息。应维护个人信息的完整性和准确性，仅在达到目的所需的时间内存储个人信息，并防止未经授权披露个人信息。

The PIPL defines seven (7) legal bases under which Montclair State University can collect and handle PRC Personal Information: 1) the individual has given consent to the processing for a specific purpose; 2) the processing is necessary for the university’s performance of a contract to which the individual is a party; 3) where necessary for the performance of statutory duties or obligations; 4) where necessary for public health emergencies or the protection of the life, health and property safety; 5) where handling is within a reasonable scope necessary to carry out activities as news reporting and supervision by public opinions for the public interest; 6) where the Personal Information is disclosed by the individual themselves or it is otherwise legally disclosed; or 7) other circumstances provided by laws and administrative regulations.

个人信息保护法定义了蒙特克莱尔州立大学收集和处理中国个人信息的七（7）个法律依据：1）个人同意出于特定目的进行处理；2）该处理对于大学履行个人作为一方当事人的合同所必需；3）为履行法定职责或者法定义务所必需；4）为应对突发公共卫生事件，或者紧急情况下为保护自然人的生命健康和财产安全所必需；5）为公共利益实施新闻报道、舆论监督等行为，在合理的范围内处理个人信息；6）处理个人自行公开或者其他已经合法公开的个人信息；7）法律、行政法规规定的其他情形。

Penalties for non-compliance can be significant, with administrative fines and penalties on institutions, as well as monetary fines and criminal liability on responsible personnel who fail to comply with the law.

对违反规定的处罚可能很重，包括对机构的行政罚款和处罚，以及对不遵守规定的机构负责人的罚款和刑事责任。

Under PIPL, individuals have the right to know and make decisions relating to their Personal Information including the right to consult, copy, transfer, correct, amend, supplement, restrict access, withdraw consent for use, and/or request deletion of their Personal Information. In addition, under PIPL there is an additional post-mortem right to exercise rights over Personal Information for a deceased’s next of kin. These rights must be communicated to individuals and a convenient method provided for request to be made. If Montclair State University refuses an individual’s request to exercise their rights, the University will explain the basis for the refusal. If an individual believes that Montclair State University has violated their rights, they may file a lawsuit in a court of competent jurisdiction according to the law.

根据个人信息保护法，个人有权了解其个人信息并作出决定，包括查阅、复制、转移、更正、修改、补充、限制访问、撤回使用同意和/或要求删除其个人信息。此外，根据个人信息保护法，还有一项额外的死后权利，即死者的近亲行使个人信息的权利。这些权利必须传达给个人，并提供一种方便的方法来提出请求。如果蒙特克莱尔州立大学拒绝个人行使其权利的请求，该大学将解释拒绝的依据。如果个人认为蒙特克莱尔州立大学侵犯了他们的权利，他们可以依法向有管辖权的法院提起诉讼。

The University is subject to PIPL when it recruits students or employees in Mainland China, conducts marketing or outreach in Mainland China, participates in student or faculty exchanges or other academic programs within Mainland China, conducts fundraising targeted to Mainland China, collects information from alumnae in China, conducts research with human subjects in Mainland China, or engages in other activities within Mainland China. Therefore, Privacy Notices have been adopted by the University and University Foundation to describe the Personal Information and Sensitive Information collected, the applicable legal basis, the purposes for which Personal Information is used, safeguards imposed, the retention period, and a point of contact for an individual to exercise his/her rights under the PIPL. University PIPL Privacy Notice (PDF)

大学在中国大陆招收学生或招聘员工，在中国大陆开展营销或外联活动，在中国大陆参与学生或教师交流或其他学术项目，针对中国大陆开展募捐活动，从中国校友处收集信息，在中国大陆开展人体科学研究，或在中国大陆从事其他活动。因此，大学和大学基金会已通过隐私通知，描述收集的个人信息和敏感个人信息、适用的法律依据、个人信息的使用目的、实施的保障措施、保留期以及个人行使个人信息保护法项下权利的联络点。学校的个人信息保护法隐私通知可在详见【填入链接】：

Individuals who wish to exercise their rights under PIPL should contact the email identified in the Privacy Notice.

希望行使个人信息保护法项下权利的个人应联系隐私通知中指定的电子邮件。

Consent may be recorded by using the consent form created in connection with this Policy. If a third-party software as a service (“SaaS”) provider, or any other third-party provider is used to collect, store or process Personal Information gathered in Mainland China, the Consent Form must be revised to identify the name of the SaaS or other third-party provider.

可以使用与本政策相关的同意书记录同意。如果使用第三方软件即服务（SaaS）供应商或任何其他第三方供应商收集、存储或处理在中国大陆收集的个人信息，则必须修改同意书，以识别SaaS或其他第三方供应商的名称。

Consent to the collection and processing of Personal Information must be explicit, and individuals must be provided the ability to revoke consent in as easy a manner as consent was given. Individuals can withdraw their consent at any time. When Montclair State University receives a request to withdraw consent, we will stop processing the Personal Information, unless there is some other legal grounds requiring the continued processing for the establishment, exercise, or defense of legal claims or is otherwise permitted by applicable law. Withdrawal of consent does not affect the lawfulness of the University’s processing that occurred before consent was withdrawn. Refusal to consent or withdrawal of consent will not impact an individual’s ability to access university goods and/or services that are applicable to them unless consent is a requirement for provision of those goods or services.

对收集和处理个人信息的同意必须明确，并且必须赋予个人撤回同意的权利，撤回同意的方式与撤销同意的方式一样简单。个人可以随时撤回其同意。当蒙特克莱尔州立大学收到撤回同意的请求时，我们将停止处理个人信息，除非有其他法律依据要求继续处理以建立、行使或辩护法律主张，或适用法律允许。撤回同意并不影响在撤回同意之前发生的大学处理的合法性。拒绝同意或撤回同意不会影响个人获取适用于他们的大学商品和/或服务的能力，除非该同意是提供这些商品或服务的要求。

Personal Information that an individual provides to Montclair State University will generally be hosted on Montclair State University servers located on its campus in NJ, U.S.A. To the extent that Montclair State University needs to transfer Personal Information either from Mainland China to the U.S. or to another country, or from the U.S. to another country other than Mainland China, Montclair State University will do so consistent with applicable laws regarding such transfers and only with the individual’s consent. To support such transfers, Montclair State University requires Institutions in Mainland China who share Personal Information with Montclair State University to enter into Montclair State University’s China Data Joint Handling Addendum that contains standard terms and conditions to clearly establish the rights and responsibilities of the parties involved in the transfer. Completed and executed Joint Handling Addendum’s should be returned to the Office of Global Engagement for retention.

个人向蒙特克莱尔州立大学提供的个人信息通常会托管在蒙特克莱尔州立大学位于美国新泽西州校区的服务器上。蒙特克莱尔州立大学需要将个人信息从中国大陆传输到美国或其他国家，或从美国传输到中国大陆以外的其他国家，蒙特克莱尔州立大学将仅在个人同意的情况下，按照有关此类转移的适用法律进行转移。为支持此类转移，蒙特克莱尔州立大学要求与蒙特克莱尔州立大学共享个人信息的中国大陆机构签署蒙特克莱尔州立大学的中国数据联合处理附录（填入链接），该附录包含标准条款和条件，以明确规定转移各方的权利和责任。完成并执行的联合处理附录应交回全球审计业务办公室保存。

The University often uses third-party systems to store and process Personal Information. Third-party vendors must complete and execute Montclair State University’s China Data Handling Addendum – Montclair as Personal Information Handler and Vendor as Entrusted Party. Montclair State University’s China Data Handling Addendum includes clauses approved for use under the PIPL. Completed and executed Data Handling Addendums should be returned to Procurement Services for counter-signature and retention. The China Data Handling Addendum for use with University vendors can be found on the Procurement Services webpage at: https://www.montclair.edu/procurement/forms/.

大学经常使用第三方系统来存储和处理个人信息。第三方供应商必须填写并执行蒙特克莱尔州立大学的中国数据处理附录——蒙特克莱尔州立大学作为个人信息处理者，供应商作为受托方。蒙克莱州立大学的中国数据处理附录包括根据个人信息保护法批准使用的条款。完成并执行的数据处理附录应交回采购服务部，以便进行会签和保留。供大学供应商使用的中国数据处理附录详见采购服务部网页（https://www.montclair.edu/procurement/forms/）。

The Data Handling Addendum or Joint Handling Addendum must be signed before Personal Information is transferred out of Mainland China to Montclair State University, or to a University vendor. Please contact the Office of University Counsel for the appropriate Data Handling Addendum for your situation.

个人信息从中国大陆传输至蒙特克莱尔州立大学或大学供应商之前，必须签署数据处理附录或联合处理附录。

The PIPL requires that appropriate data protection measures are put in place to ensure the security and integrity of Personal Information that Montclair State University collects, maintains, and otherwise uses. Montclair State University uses physical, managerial, and technical safeguards to protect Personal Information and that are designed to improve the integrity and security of Personal Information. Montclair State University uses data minimization, pseudonymization and encryption where appropriate, taking into consideration the risks presented by processing, accident or unlawful destruction, loss, alteration, and unauthorized disclosure.

个人信息保护法要求采取适当的数据保护措施，以确保蒙特克莱尔州立大学收集、维护和以其他方式使用的个人信息的安全性和完整性。蒙特克莱尔州立大学使用物理、管理和技术保护措施来保护个人信息，旨在提高个人信息的完整性和安全性。蒙特克莱尔州立大学在适当情况下使用数据最小化、匿名化和加密，同时考虑到处理、意外或非法破坏、丢失、更改和未经授权的披露所带来的风险。

To ensure appropriate measures are put in place to protect the security and integrity of Personal Information. PIPL requires an impact assessment be performed under the following circumstances: 1) when Sensitive Personal Information will be handled; 2) when automated decision making involves Personal Information; 3) when Personal Information will be provided to a Montclair State University vendor or other third-party; 4) when Personal Information will be transferred out of Mainland China; or 5) if handling the Personal Information will have a significant impact on an individual’s rights and interests. Any Montclair State University unit that engages in such activities must use the MSU – PIPL Impact Assessment Template (DOCX) to determine and document that the use of Personal Information is legitimate, justified, and necessary; the impact on the individuals’ rights and interests and security risks; and if security measures in place are legitimate, effective and appropriate to any such risks. Impact Assessments must be retained by the Montclair State University unit for no less than 3 years.

确保采取适当措施保护个人信息的安全性和完整性。个人信息保护法要求在以下情况下进行影响评估：1）处理敏感个人信息；2）自动化决策涉及个人信息；3）将个人信息提供给蒙特克莱尔州立大学供应商或其他第三方；4）个人信息从中国大陆转移到境外；或5）处理个人信息对个人权益产生重大影响。任何从事此类活动的蒙特克莱尔州立大学单位必须使用影响评估表【填入链接】来确定并记录使用个人信息的合法性、合理性和必要性；对个人权益的影响和安全风险；以及所采取的安全措施是否合法、有效和适合任何此类风险。影响评估必须由蒙特克莱尔州立大学单位保存至少3年。

Personal Information is stored and retained in accordance with the Record Retention Schedule adopted by the State of New Jersey, Department of the Treasury, Division of Revenue and Enterprise Services – Record Management Services that is applicable to four year colleges and universities, and other applicable U.S. Laws.

个人信息按照新泽西州、财政部、收入和企业服务部（适用于四年制学院和大学的记录管理服务）采用的记录保留计划以及其他适用的美国法律进行存储和保留。

Under the PIPL, automated decision-making (ADM) is defined as using computer programs to automatically analyze or assess personal behaviors, habits, interests, or hobbies, or financial, health, credit, or other status, and then to make decisions based on the analysis of such information. Montclair State University or the Montclair State University Foundation may use automated decision-making (ADM)from time-to-time for screening for potential donors, data analytics, data mining, and targeted marketing. Montclair State University does not use automated processing to make admission, academic, or employment decisions about individuals or other decisions that could have a major impact on their rights and interests based solely on automated processing.

根据个人信息保护法，自动化决策被定义为通过计算机程序自动分析、评估个人的行为习惯、兴趣爱好或者经济、健康、信用状况等，并进行决策的活动。蒙特克莱尔州立大学或蒙特克莱尔州立大学基金会可不时使用自动化决策筛选潜在捐赠者、数据分析、数据挖掘和目标营销。蒙特克莱尔州立大学不使用自动处理来做出有关个人的入学、学术或就业决策，或仅基于自动处理可能对其权益产生重大影响的其他决策。

University employees who have questions regarding this policy may contact University Counsel. Individuals within Mainland China who have questions about the handling of their Personal Information should contact the individual identified in the PIPL Privacy Notice.

对本政策有疑问的大学员工可联系大学法律顾问。中国大陆境内的个人如对其个人信息的处理有疑问，应联系个人信息保护法隐私通知中指定的个人。

Montclair State University may update this policy from time to time. Any changes to the policy will become effective upon posting of the updated policy.

蒙特克莱尔州立大学可能会不时更新本政策。对政策的任何更改将在发布更新的政策后生效。

Effective Date:

生效日：

Personal Information Protection Law of the People’s Republic of China (PIPL)

About This Policy

Personal Information Protection Law of the People’s Republic of China (PIPL)

中华人民共和国个人信息保护法（个人信息保护法）

Related Documents – 相关文件