The PBOC is promoting DC/EP to the Chinese public as a more privacy-preserving way to pay than China’s currently dominant payment tools run by private firms, though government access to data will be unprecedented under the new system. In September 2020, Vice Governor Fan said that the current retail payment system based largely on Alipay and WeChat (though they are not named) “still has great room for improvement in … user privacy protection and anonymous payment” (Fan 2020). He says that DC/EP will provide what the market has not, because of firms’ incentives to sell or otherwise employ user data.
The PBOC’s slogan for privacy in DC/EP is “controllable anonymity,” which seems like a juxtaposition of two mutually exclusive concepts. In fact, it offers consumers something of a choice between relative privacy from private-sector tech companies (by using DC/EP) or government (with Alipay/WeChat), though of course no option in China provides full privacy from authorities. Vice Governor Fan has described controlled anonymity as limiting access to the vast majority of data to the PBOC, which, however, will “grasp the entirety of information so it can employ big data, AI, and other technology to analyze transaction data and money flows, prevent and eliminate money laundering, financing of terrorism, tax evasion, and other illegal criminal behaviors” (Fan 2020) This striking statement suggests that the PBOC will have a “god’s eye” view of a ledger that shows every balance and transaction in real time. CBDCs bundle money and a payment system, a fact explicitly recognized by China’s decision to include currency and payments together in the system’s name. How to maintain privacy under a CBDC is a difficult issue in any jurisdiction, because it is hard to imagine including features of a payment system without a strong AML/CFT regime.
A choice to make the system a “no privacy” scenario, in which the PBOC has stores and unlimited ability to access the real name of every individual or entity associated with the wallet addresses transacting with DC/EP, would encounter fierce political resistance from other parts of the bureaucracy because of what that would mean for the PBOC’s relative power. Such data could be the ultimate weapon for political battles of different patronage networks, too powerful to put in any individual’s hands, especially because of what it would reveal about powerful officials involved in corruption. Too often, “the government” or “the Party” in China is assumed to be a unitary entity, while in fact it is composed of bureaucracies and individuals within them that have diverging interests and often acrimonious disagreements. Therefore, what results is likely to have at least some privacy controls built in, if only to protect the data of important people from rivals within government.
Imagine a system like bitcoin’s design in which every transaction is tracked but only associated with a wallet address. Unlike bitcoin, only the PBOC could view the whole ledger. With the caveat that China lacks independent courts and other mechanisms that could restrain government data access, it could set procedural requirements with oversight outside the PBOC for it to request the wallet provider or bank involved to “unmask” and identify the entity associated with the address in the event of a criminal investigation. Though Yao Qian, when acting as director of the PBOC’s Digital Currency Research Institute in 2018, outlined a plan for controllable anonymity in which the PBOC would have full access to individual identity data, that does not necessarily mean the PBOC will want, or be able, to go this route (Yao 2018).
Another possible scenario is also best understood within the context of bitcoin. One can buy and sell bitcoin on Coinbase with only an update to Coinbase’s private ledger, but transfers of bitcoin in and out of Coinbase require submission to the blockchain. DC/EP could permit a similar structure, in which the PBOC would have a record of a wallet/payment provider’s purchase, sale, or transfer of DC/EP to and from other wallet/payment systems. That would ensure control over the money supply and authority over the new digital equivalent of the interbank payment system. Transactions between individuals using the same wallet, however, could occur without any record being sent directly to the PBOC. Such a design would preserve many elements of the division of labor in the current financial system. It would also fulfill the “two-tier” concept the PBOC has insisted on from the beginning of the DC/EP project that maintains intermediaries between regular consumer transactions and the central bank, in addition to preserving more privacy from the government than if every transaction needed to be reported. This scenario, however, is less likely than the first because it would result in the PBOC losing the advantage in control and surveillance that DC/EP would otherwise offer it.
Officials have also discussed options to maintain a deeper level of anonymity, similar to cash today, by allowing individuals to transact and hold amounts below a threshold determined by the PBOC in DC/EP wallets without providing identification or linking to a bank account, which it calls a system “loosely coupled” to bank accounts. Officials familiar with the current plans confirmed that this kind of system will involve registering wallets only with phone numbers that can only be linked to them with a special data request from the PBOC to the telecom companies. This idea, part of an initiative to expand financial inclusion to an unbanked population about as large as the entire population of the United States, also includes support for offline transactions so that people in rural areas without reliable internet access can still transact peer-to-peer digitally. This feature, however, is not yet part of the public pilot program, as it is technically more complex than online transactions that the PBOC can verify.
Despite claims of a focus on anonymity, all signs point to DC/EP enabling much greater surveillance of financial transactions than the current system. Sensible design choices could create a useful compromise, but the desire to surveil could well overcome political constraints and inter-department turf battles, meaning DC/EP would end all privacy from the government for financial transactions that use the system.