The regulatory landscape in China around data protection and flows continues to develop. Since the 2017 Cybersecurity Law, China has been refining the legal and regulatory framework for data protection—it has implemented new laws and regulations that set comprehensive rules for data processing activities across all industries in China and cover the rules regarding cross-border
China Releases Draft Measures on Security Assessment of Cross-Border Data Transfer
On October 29, 2021, the Cyberspace Administration of China (“CAC“) published the “Draft Measures on Security Assessment of Cross-Border Data Transfer” (“Draft Measures“) for public comment, which outlines the requirements for security assessments on cross-border data transfers. The CAC had released previous draft measures specifying the “Security Assessment” requirements and procedures
China’s New Data Security Law
Introduction
On June 10, 2021, China officially passed China’s first Data Security Law, which will take effect on September 1, 2021. Following the introduction of the Data Security Law, together with the Cybersecurity Law, which has been implemented since June 1, 2017, and the Personal Information Protection Law, which is undergoing public comment
China Released Second Draft of Personal Information Protection Law
On April 29, 2021, the national legislator in China released the second draft of the Personal Information Protection Law (“PIPL”) to collect public comments until May 28, 2021. The updated draft substantially follows the framework of the first draft, which marks China’s comprehensive system for the protection of personal information, sets forth general rules for the processing and transferring of personal information across China’s borders, and echoes certain mechanisms under the EU’s General Data Protection Regulation (“GDPR”), including application of extraterritorial jurisdiction, with which China would use long-arm jurisdiction to regulate the concerned entities across borders. This approach reflects China’s position that privacy law is an important component of China’s long term strategy on the international stage. In fact, the PIPL expressly contemplates China’s engagement with other jurisdictions (at both the country and regional levels) to try to create “interoperability” with these other privacy systems. Below we summarize key terms of the updated draft PIPL.
Continue Reading China Released Second Draft of Personal Information Protection Law
China Finalizes New Cyber Security Law
Cross Posted from Carpe Datum Law.
China has finalized a broad new Cyber Security Law, its first comprehensive data privacy and security regulation. It addresses specific privacy rights previously adopted in the European Union and elsewhere such as access, data retention, breach notification, mobile privacy, online fraud and protection of minors.
There is plenty in the new law to irritate international businesses operating in China. It requires in general that Chinese citizens’ data be stored only in China, for starters, possibly requiring global corporations to maintain separate IT systems for Chinese data. Most of the privacy enhancements benefiting citizens align with those required in the European Union, but it is unclear how the Chinese will expect compliance, particularly since, as with many Chinese laws, its language is vague as to its scope, application and details. This vagueness leaves interpretation to the State Council, the chief administrative authority in China, headed by Premier Li Keqiang.
The law expands Chinese authorities’ power to investigate even within a corporation’s Chinese data systems, and provides for draconian penalties for non-compliance by business entities or responsible individuals include warnings, rectification orders, fines, confiscation of illegal gains, suspension of business operations or the revocation of the entity’s business license.
Continue Reading China Finalizes New Cyber Security Law
US & China Sign Financial Intelligence Cooperation Memorandum
The U.S. Financial Crimes Enforcement Network (FinCEN) and the China Anti-Money Laundering Monitoring and Analysis Center (CAMLMAC) recently signed a Memorandum of Understanding (MOU) to create a “framework to facilitate expanded U.S.-China collaboration, communication, and cooperation” between each agency’s financial intelligence units (FIUs). News Release (December 11, 2015).
In announcing the MOU, FinCEN Director Jennifer
EU and Asian Privacy Models – Work Toward Interoperability
In recognition of the need for the world’s two largest economic blocks to coordinate data protection efforts, The Article 29 Working Party of the EU released a “Referential” to map the EU requirements for Binding Corporate Rules (“BCRs”) and the APEC Cross Border Privacy Rules System (“CBPRs”). This Referential is a tool for the two systems to determine common ground. Ultimately, it will be used by the EU in the process of determining what level of cross-recognition may exist between BCRs and CBPRs, in terms of the “adequacy” necessary to move data between the EU and Asia.
Continue Reading EU and Asian Privacy Models – Work Toward Interoperability