It's a very good question. I can only speak in the commercial context, as I'm not sufficiently aware of how it's being handled in China.
Generally, I think there should be strong requirements that delimit how information can be used, inclusive of no secondary uses can be used, or no more applications of primary uses can be used, without the affirmative and meaningful consent of the individual.