Dior Shanghai branch faces penalty for data leak

French luxury brand Dior's Shanghai branch will face an administrative penalty for transferring customers' personal data to its headquarters in France illegally, leading to a data leak in May, China's public security authority said on Tuesday.

According to investigations, Dior Shanghai was found to have committed three violations, the national cybersecurity notification center said.

It illegally transferred customers' personal information to its headquarters in France without passing a data export security assessment, signing a standard contract for cross-border personal information transfer, or obtaining personal information protection certification.

Before providing the information, it failed to adequately inform customers about how their personal data would be handled by the overseas recipient and did not obtain “separate consent.”

The branch also did not adopt security measures such as encryption or de-identification for the collected personal information.