With the rapid development of the information society, the collection and use of personal information have become more extensive. But along with the collection of personal information for many legitimate purposes, personal data is also collected and obtained without the consent of the user and it may even be illegally bought and sold, endangering lives and property. Thus the importance of personal information protection can never be overestimated.

Responding to people's concerns, a draft law on personal information protection is being reviewed at the 22nd session of the Standing Committee of the 13th National People's Congress, China's top legislature, convened from Tuesday to Saturday in Beijing.

It seems all too common for personal information to be leaked nowadays. Almost everyone has had the experience of receiving phone calls for goods promotion or text messages promoting certain services. Some leaking of personal information has resulted in economic losses for individuals when the information is used to swindle the targeted individual of his or her money.

With increasingly advanced technology, the collection of personal information has been extended to biological information such as an individual's face or even genes, which could result in serious consequences if such information is misused.

Effective protection of personal information is therefore of ever greater importance. Some existing laws and regulations, including the Civil Code, the Cybersecurity Law, E-Commerce Law and the Law on the Protection of Consumer Rights and Interests, include content relating to personal information protection. But this has not been enough to effectively safeguard it.

The necessity and urgency of protecting personal information warrants the release of a particular law for this purpose, which explains why the draft law on personal information protection, if it is adopted and takes effect, is anticipated by experts to be a milestone for the protection of personal information.

The draft law specifies the right of an individual to know and decide whether his or her own personal information may be used by any entities. It also specifies the rules that those who use personal information must abide by. For example, they must have the consent of the person whose information they intend to use and they must tell the person for what purpose his or her personal information will be used.

There are also detailed specifications about how government departments can use personal information in accordance with the law, and how security appraisals must be conducted before personal information is delivered to a third party or to overseas clients.

This law, if it is passed and enforced to the letter, will be a welcome means of better regulating the use of personal information.