China Personal Information Protection Law (PIPL) 25-27: Art. 25-27 No disclosure without separate consent; public-place image and identification equipment; limits on using publicly available information

What does 25-27 require?

A processor may not disclose the personal information it processes except with the individuals' separate consent; image collection and personal identification equipment in public places may be installed only as necessary to maintain public security, in compliance with state provisions and with conspicuous signage, and the images and identification information collected may be used only for public security unless the individual separately consents; and information the individual disclosed or that was otherwise lawfully disclosed may be processed within a reasonable scope unless the individual expressly refuses, with consent required where such processing has a major impact on the individual's rights and interests.