The New Cosmetic Regulations in China (promulgated January 1, 2021) includes a provision requiring certain parties to provide “personal certificates” to support the registration of products for sale in the Chinese marketplace.
The “personal certificates” expected to be filed include the passport numbers and/or driver’s license numbers for the person(s) in charge of operations (legal representative) and the person(s) in charge of quality and safety. These provisions apply to personnel in BOTH domestic enterprises (i.e., in China) and “overseas production enterprises” (for products manufactured outside of China).
These new requirements are set out in Article 10, with specific requirements outlined under the Registration Forms included under Annexes 4 and 6 of the New Cosmetic Regulations in China (excerpt from unofficial English translation; highlighted emphasis added). This information will be entered into and stored in the electronic Chinese Registration Portal when products are registered with the Chinese authorities.
Background Negotiations:
During the development of these new regulations in China, when it became clear that these “personal certificates” referenced under Article 10 related to personal identification documents such as passports and/or driver’s license, negotiating parties objected to the inclusion of such personal information, as it was unclear as to the intent and/or underlying need for such information to substantiate product registration.
Nowhere in the world is such information required to be filed for this type of regulatory application. In response to these objections, the Chinese authority is apparently insisting on this information as a means to ensure that the individuals identified in registrations are in fact real and alive people with proof of identification. Many attempts were undertaken to reverse the imposition of this requirement, including objections filed with the World Trade Organization (WTO). Unfortunately, these negotiations were unsuccessful in eliminating the requirement.
Recommendations For Providing Information When Asked:
As this is a new regulatory requirement, your customers, vendors, and partners may be asking you to submit one or more “personal certificates” as proof of identification, for input into the Chinese Electronic Registration Portal. In responding to any such request, we would suggest that it is prudent to contemplate any or all of the following:
- Ask for the underlying rationale (in writing) as to why this information is being sought, and how this information is to be used and how it will be protected (including by the Chinese authority).
- Insist on seeing a privacy policy regarding how this information will be used, stored, deleted and/or released. You may wish to insist on establishing some limits for data retention (i.e., how long is it reasonable for this information to be held).
- Clarify expectations on what you may need to do to facilitate the withdrawal and/or destruction of such information should you so choose to pursue such action.
- Recognize that it is reasonable for you to clarify such policies for anyone whom you are sharing this information with (i.e., customers, vendors, partners, etc.) as well as the Chinese regulator. We understand that the Chinese regulator has provided standard operating protocols to their staff as to how to handle this information (however, to our understanding, this information is not readily distributed). We would strongly recommend that you get something in writing that acknowledges any such protections that may be in place.
- As we understand it, only one document is needed to identify an individual. It must be a valid, government issued, identification document. However, to our knowledge, there is nothing in the regulatory provision to insist that this document needs to be a passport. Therefore, proceeding with a driver’s license number instead of a passport number, may be the most innocuous option to consider.
Based on discussions with our colleagues from Cosmetics Europe (whom have been directly involved in these negotiations), the Chinese authority MAY be willing to accept “hiding up to 5 digits (i.e., ##### or XXXXX) of the certificate reference.
Note: At this juncture, this course of action has not yet been officially confirmed in policy by the Chinese authority, however, we understand that in practice, it is being pursued by stakeholders. Furthermore, this option has only apparently been successfully pursued for passport numbers (although the underlying rationale should apply, irrespective of the document in question). It is also not clear which 5 digits can be protected; or which would be the most appropriate to ‘hide’ to maximize security.
What CA Canada is Doing in the Interim:
CA is in the process of reaching out to Global Affairs Canada to explore options for raising concerns with the Chinese authorities. At a minimum, we will be looking to help identify any corresponding policy documents that could address the concerns of providing personal information to China. Please do not hesitate to touch base with our CA Team to discuss these developments. We would also advise that you consult with legal counsel as necessary.
CA’s Export Certificate program is also exploring options which could manage or limit this requirement for our clients. More information will follow in the next newsletter.
