Privacy & Information Security Law Blog

On May 24, 2019, the Cyberspace Administration of China (the “CAC”), together with eleven other relevant government authorities, jointly released the draft Cybersecurity Review Measures for public comment. The deadline for public comment is June 24, 2019.

Applicability
In general, the Cybersecurity Review Measures apply only to critical information infrastructure operators (“CII Operators”), provided that the laws and regulations do not provide otherwise. Procurement of network products and services by a CII Operator, which affects or may affect national security, will be subject to cybersecurity review pursuant to the Cybersecurity Review Measures.

Cybersecurity Review Working Mechanism
A cybersecurity review working mechanism shall be established by the CAC, together with other relevant governmental authorities (“Mechanism Members”). The Cybersecurity Review Office (which is affiliated with the CAC) (the “Review Office”) will be in charge of cybersecurity review, such as organizing cybersecurity reviews and developing the relevant rules and procedures.

Security Risk Report and Cybersecurity Review
When a CII Operator procures a network product or service, it should assess the potential security risks arising from the operation of such network product or service and prepare a security risk report. The CII Operator will apply to the Review Office for a cybersecurity review if such operation may cause:

• complete shutdown of the CII or failure to run the main functions of the CII;
• disclosure, loss, corruption or cross-border transfer of a large amount of personal information and important data;
• supply chain security threats that jeopardize the operation and maintenance, technical support or upgrading of the CII; or
• other potential risks that could severely jeopardize the CII.

A cybersecurity review also may be initiated if any of the Mechanism Members believes the procurement of products or services by a CII Operator affects or potentially affects national security. In such case, the Review Office will report to the Central Cybersecurity Affairs Commission for approval.

Procurement Contracts
Where a CII Operator seeks to procure a product or service that will be subject to cybersecurity review, the CII Operator must require the supplier to cooperate with the review by listing this cooperation obligation in the purchase document, contract or other binding means and by making the purchase contingent upon its passing of the cybersecurity review.

Cybersecurity Review Process
The Review Office will complete its preliminary review within 30 working days after receipt of the required documents submitted by the CII Operator. This period may be extended by 15 working days in cases of complicated circumstances.

The cybersecurity review will focus on the assessment of the national security risks arising from the procurement activity. The review will consider:

• the implications of the continuous, secure and stable operation of the CII, including the possibility of the CII being manipulated and/or interfered with or its business continuity being harmed;
• the possibility of the purchase resulting in disclosure, loss, corruption or cross-border transfer of personal information and important data;
• the controllability, transparency and supply chain security of the purchase, including the potential for supply disruptions caused by non-technical conditions such as politics, diplomacy and trade;
• the influence of the purchase on technology and industries related to national defense, military industry and CII;
• whether the supplier of the product or service complies with laws and regulations and what obligation the supplier pledges to undertake;
• whether the supplier of the product or service is funded or controlled by foreign governments; and
• other conditions that may endanger CII security and national security.

After completing the preliminary review, the Review Office will deliver a conclusion and suggestions to the Mechanism Members for comments, which fall under three categories: (1) pass; (2) conditional pass; and (3) fail.

The Mechanism Members will then provide written comments within 15 working days. If the Mechanism Members have unanimous comments, the Review Office will send the CII Operator the corresponding review conclusion. If the Mechanism Members have different comments, a special review will be conducted.

The special review also must be reported to the CAC for approval. In principle, the special review should be completed within 45 working days, however, extensions are permitted for complicated cases.