The Standing Committee of Shenzhen Municipal People's Congress announced, on 7 July 2021, that the Shenzhen Special Economic Zone Data Regulation had passed. In particular, the municipality highlighted that the regulation establishes personal data processing rules based on informed consent, which requires personal information processors to obtain consent on the premise of full notification in advance, and provide a way to withdraw consent. In addition, the municipality noted that, as a result of users being forced to accept 'package agreements' on apps, the regulation stipulates that personal information processors must not refuse to provide relevant core functions or services to natural persons on the grounds that they do not agree to the processing of their personal data.

Moreover, the municipality confirmed that the regulation imposes stricter requirements on the processing of biometric data except where the data is necessary for the purpose of processing personal data and cannot be replaced. Finally, the municipality stated that the regulation clearly establishes, among other things, that personal information processors must not illegally collect data from other market entities to provide alternative products or services, noting that those who refuse to make corrections in violation of the regulations shall be fined not less than RMB 50,000 (approx. €6,500) but not more than RMB 500,000 (approx. €65,000). Where circumstances are serious, the municipality clarified that a fine of less than 5% of the previous year's turnover shall be imposed, up to a maximum of RMB 50 million (approx. €6.5 million).

The regulation will enter into effect 1 January 2022.  

You can read the press release here and the regulation here, both only available in Chinese.