Zhao Yun Interviewed on Chinese E-Commerce and Personal Data

"Deep dive: Chinese e-commerce's rush into online finance could put countless users' data at risk"
Hudson Lockett
China Economic Review
17 September 2015

Once Jack Ma was the little guy. Now he wants to give the little guy little loans.

     Earlier this year MYbank, the online bank affiliated with e-commerce colossus Alibaba, launched with the intent to grant small loans to individuals and small businesses. Last week, rival Tencent announced a new small loan service from which users of its WeChat social network and digital payment launchpad can borrow up to RMB200,000 - without any collateral or guarantee - from its own affiliated online bank, Webank.

     On Tuesday Ant Financial, the Alibaba affiliate controlled by Jack Ma that runs MYbank, announced it had purchased a controlling stake in an insurance company with the intent to provide insurance services online to small businesses and consumers. If precedent holds, Tencent can be expected to announce a near-identical investment forthwith.

     This back and forth has become a fixture of China's private enterprise landscape: Both companies use their deep pockets and deep reserves of user data to try and gain an edge in the latest nascent Internet-enabled sector, all with an eye toward unseating China’s financial establishment. But new user authentication requirements favoring brick-and-mortar banks don’t just fail to address existing data security and privacy issues in Chinese e-commerce; they could force users to provide Alibaba, Tencent and other online businesses with biometric data such as fingerprints which, once shared or stolen, could prove a problem for life. 

...

     There is a well-documented and increasingly urgent need to shake up China's risk-averse, inefficient and mostly state-run banking sector. But concerns go well beyond those of existing banks and extend to the protection of Chinese citizens’ private data. Those have been difficult to articulate historically due to a lack of any legislation defining what personal information even means.

     “The relevant legislation is all at the ministerial level,” said Zhao Yun, director of the Centre for Chinese Law at Hong Kong University. While gains had been made in recent years with various lower-level guidelines, Zhao said, there was still no national-level legislation protecting, or even defining, personal data on the mainland. 

     “We need to have a unified law,” he said. “If we really have a personal data law at the national level we can strengthen enforcement.”...  Click here to read the full article.