Your data: GDPR’s Gold Standard, China’s authoritarian rule & America’s wild west

Two questions that should shake every American reader awake are: who controls your data, and who do they serve?

A new scholarly work in the Beijing Law Review, written by Oceanus Ming-Ting Kamorcid, comparing the European Union’s vaunted General Data Protection Regulation with China’s more recent Personal Information Protection Law, lays bare not only two competing visions of privacy but the lack of attention the United States government has given to such vital regulation.

Amid a broad struggle between liberty and authoritarian power in the digital age, both Democrats and Republicans in the United States are sitting on the sidelines without even warning consumers to beware.

The research findings are chilling. Europe, for all its flaws, at least attempted to anchor data protection in the long tradition of human rights law—the same ideals that came out of the ashes of war and gave ordinary people a measure of dignity in the face of corporate and governmental overreach.

The GDPR is more than words on paper. Its principles—lawfulness, fairness, transparency, and accountability—are targeted protections for every stage of the data lifecycle: collection, storage, processing, and transmission.

As scholars Gilman and Layton have observed, a reasonable reader of these provisions reaches two striking conclusions: (1) each principle is tied to a specific objective meant to close off avenues of abuse, and (2) data protection rights are the rule, with exceptions strictly limited and interpreted narrowly. In other words, the GDPR is strongly pro–data subject.

This is not abstract. The regulation recognizes that individuals are inherently vulnerable when dealing with powerful data controllers. Take the example of a credit card applicant. If Consumer X wants a credit card from Bank Y, they must surrender personal details—age, occupation, financial history.

There is no negotiating. The GDPR steps in here: its Article 6 provides an exhaustive list of justifications a controller may rely on to process personal data. That precision is deliberate. It prevents corporations or governments from exploiting the imbalance by inventing new loopholes after the fact.

The principle of accountability strengthens the shield. A small New Jersey retailer processing credit card payments must adopt protective measures, just as a hospital handling sensitive patient data must adopt stricter ones. The obligations vary, but accountability never disappears.

If regulators knock on the door, the business must show its homework. Supervisory Authorities—independent, constitutionally grounded watchdogs in every EU member state—stand ready to investigate complaints, impose fines, and, when necessary, haul violators into court. Data protection in Europe is treated as a human right, enforceable and universal.

Now compare that to China’s PIPL.

On the surface, the communist government’s regulation mirrors the GDPR, even borrowing language about fairness and individual rights. It too requires impact assessments and sets rules for cross-border transfers.

Yet beneath the surface lies the Cyberspace Administration of China (CAC)—an opaque regulator with wide, discretionary powers. Unlike Europe’s Supervisory Authorities, the CAC’s role is not clearly defined, leaving businesses and individuals at the mercy of shifting political winds.

The CAC can block transfers of personal data abroad, citing undefined “national security concerns,” as it did when it levied a $1.2 billion fine against ride-hailing giant Didi.

It can require foreign firms doing business in China—including American ones—to appoint local representatives answerable directly to the state.

Article 41 of the PIPL forbids sharing Chinese citizens’ personal information with foreign courts or regulators unless Beijing grants permission. In plain terms: your data, if linked to China in any way, belongs not to you, but to the Communist Party.

The contrast is stark. The GDPR is designed to mitigate the vulnerability of the individual against corporate and state power. The PIPL, by contrast, codifies the individual’s vulnerability under the authority of the state.

Europe’s rule is accountability; China’s is ambiguity. Europe’s rule is transparency; China’s is opacity. Both outpacde the United States, where data is lawlessly exposed to the Wild West on privacy intrustions and a blinding array of abuses.

The United States remains without a comprehensive federal privacy law at all. Washington dithers while Brussels raises the bar and Beijing tightens its grip.

American businesses already straddle both systems, with New Jersey’s banks, insurers, and pharmaceutical firms caught in the crossfire. Yet American citizens enjoy no equivalent protections at home.

Making matter worse, the tyrannical Trump administration is cleaning house among cyber security, digital data, global network technology protection agencies, leaving Americans unable to discern fact from fiction or even intentional lies promoted by foreign adversaries.

The Beijing Law Review article is a warning shot. The GDPR and the PIPL are not just legal frameworks; they are competing ideologies.

One rests on human dignity, with enforceable rights and strict limits on exceptions. The other rests on obedience, with broad, discretionary state power cloaked in the language of rights.

Unless Americans wake up and demand stronger protections of our own, we may soon find ourselves caught in the worst of both worlds—regulated by none, exploited by all.