China Proposes New Guidelines on Foreign Data Transfers; Many More Companies Would Face National Security Reviews
A new set of draft rules proposed by the Cyberspace Administration of China (CAC) would greatly expand national security screening of data being transferred to foreign countries. If the rules are approved at the end of November, a broad range of Chinese companies will be subject to screening of data transfers that involve personal information or pertain to critical infrastructure.
The draft rules call for additional screening of data transfers if companies process the personal data of more than 100,000 people, if the data contains something particularly sensitive (such as fingerprints) and totals more than 10,000 people, or if the company operates critical information infrastructure.
Chinese government keeping a sharper eye on critical IT resources, e-commerce and service platforms
The CAC, which is the lead agency responsible for regulating the internet in China, has the draft proposal open for public comment through November 28. Should it ultimately become law, companies in the regulated categories will be required to submit to assessments of the “purpose, scale and methods” of data transfers.
Analysts believe that one of the primary targets of the new measure is the class of tech companies that are listed overseas, a group that has been subject to unique regulatory focus in the past year. In August, the China Securities Regulatory Commission (CSRC) proposed new rules restricting certain companies that were planning on conducting foreign IPOs from listing abroad should they handle certain types of personal data; any foreign listing now requires formal government review and approval. This followed added rules over the summer that established new security checks for companies processing the data of over one million users.
Much of this prior rulemaking has been aimed at domestic Chinese companies seeking to drum up overseas investment, with the government preferring that this activity be kept to Hong Kong or Shanghai. The new rule about data transfers is one that could impact foreign companies that have set up regional shop in China as well, and they may also be another point of focus. Tesla had a high-profile falling out with the Chinese government in recent months, driven by a rash of safety issues paired with concerns about the company potentially transferring the data of Chinese citizens overseas. The government also raised alarms about the cameras and sensors present in Tesla vehicles after one was brought into a restricted area.
In addition to government review of the purpose and method of each of these data transfers, companies will be subject to a review of the general state of cybersecurity regulation in the partner country. The total review process can last for up to 60 days before a decision is rendered. The government said that passing a security review can validate the data transfers for up to two years, but it reserves the right to re-evaluate the situation at any time if the regulatory environment in the partner country changes.
One interesting aspect of the new proposal is that it may also influence what are technically domestic data transfers. The wording of the proposal says that it applies to any data transfers across “borders”; Chinese law views crossing into Hong Kong or Macau as crossing a “border” for legal purposes, so transfers to those areas could trigger security reviews.
Internet platforms subject to additional rules
The new policy for data transfers was accompanied by a proposed draft guideline laying out the social and legal responsibilities that internet platforms have, which is also open to public comment until November 28. Among other things, this new proposal addresses potential competition issues and labor rights.
Large internet platforms have been another recent target of Chinese regulators, and not just due to listing overseas. The government appears to have concerns about the power and reach of some of its larger e-commerce and service companies, paying special attention to particular entities. One example of this is Didi, the country’s largest ride-sharing app. An investigation into Didi that began several months ago, prompted in part by a troubled attempt at a foreign IPO, continues as the service is indefinitely prevented from signing up new users.
While much of China’s regulatory action has focused on tech that relates to national security and domestic agencies looking for partnerships overseas, there has been a cultural element as well that has primarily been aimed at the type of content that is popular on social media platforms. A September proclamation against “effeminate men” appeared to be aimed primarily at Korean “KPop” bands (and its “idols” that may hold contrary political opinions), but also had worrying leanings toward discrimination against alternative sexualities. The CAC has also targeted the concept of individual fame more generally, banning online list-making that ranks the popularity of actors and musicians.
