NATIONAL POLICY BACKGROUND
——
On March 22, 2024, the National Cyberspace Administration of China released the "Regulations on Promoting and Regulating Cross border Data Flow", emphasizing the overall tone of openness and development, clarifying the "negative list system", empowering free trade zones in various regions to develop their own "negative lists" for outbound data based on their actual situations and specific businesses, and clarifying the issue of how to declare "important data" that was previously pending in counties.
Measures for Security
aa
The Cybersecurity Law of 2017, the Data Security Law of 2021, and the Personal Information Protection Law of 2021 stipulate that the National Cyberspace Administration of China takes the lead in supervising network security and data security in various departments and levels of government.
Measures for Security Assessment of Data Export
On July 7, 2022, the Central Cyberspace Administration issued the "Measures for Security Assessment of Data Export", which stipulates that the "Measures for Security Assessment of Data Export" will officially take effect on September 1, 2022. Starting from September 1, 2022, enterprises and institutions involved in data export must complete rectification work within 6 months in accordance with the Measures, and formal law enforcement inspections will begin on March 1, 2023.
Promoting & Regulating Cross-Border Data Flow Regulations
On March 22, 2024, the "Regulations on Promoting and Regulating Cross border Data Flow" were released, exempting certain situations that do not require declaration of data security assessments and other three channels, and proposing a "negative list system for free trade zones".
CURRENT SITUATION AND CHALLENGES
——
Privacy
—
Data export poses challenges to personal privacy and security protection
In 2021, Didi went public in the United States, but its app was subsequently exposed to have serious violations of collecting and using personal information.
Economy
—
Illegal circulation of outbound data seriously affects economic operation and social public interests
In 2019, Google was fined 50 million yuan for unauthorized transfer of personal data of EU users to hundreds of companies for advertising purposes.
Politics
—
Abuse of outbound data seriously affects the political ecological stability of countries and regions
In 2016, Cambridge Analytics abused the personal data of 87 million Facebook users to support Trump's victory.
Security
—
The export of important data seriously affects national digital sovereignty and national security
In 2021, the Central Cyberspace Administration and five other departments jointly held talks on Tesla's illegal collection of domestic data and its illegal export of data.
CASES
——
A Self-Assessment Report on Data Export Security of a Top Credit Reporting Company
——
The security assessment was submitted to the Central Office in February 2023. Conduct risk assessment on the export scenarios of credit analysis reports for domestic enterprises in China and assist clients in completing data security rectification work in accordance with the requirements of the Data Export Security Assessment Measures. We are currently coaching clients to conduct data export security assessments through the Cyberspace Administration.
Preparation of Negative List Standards for a Free Trade Zone
——
According to the regulations of the Central Cyberspace Administration, a "Negative List" of key industry segments in the free trade zone will be formed and organized for publication, along with the measures for managing the export of enterprise data within the zone.
Implementation time: From January to March 2024
A "Negative List" has been formed for the medical, intelligent connected vehicle, and shipping industries, which has been unanimously reviewed and approved by experts. Based on this, a "Data Cross-Border Trade Demonstration Zone Plan" for relevant industries has been planned for the region and has been recognized by the government.
1. Research Report on Key Industry Data Export Demand
2. Research and Development Report on the Negative List Standard for Data Export in Key Industry Segments
3. Design of a Framework for Identifying Negative Lists in Key Industry Segments
4. Management Specification for Outbound Data in Key Industry Segments
5. Local Standard Specifications for Data Classification and Classification (including important data catalogs)
6. Planning and Operation Plan for Cross-Border Data Automation Management Platform
7. Planning Plan for Data Cross-Border Trade Demonstration Zone
