Privacy & Information Security Law Blog

The Cybersecurity Law of China, which was passed in November of 2016, introduced a data localization requirement requiring “operators of key information infrastructure” to retain, within China, critical data and personal information which they collect or generate in the course of operating their business in China. If an entity has a genuine need resulting from a business necessity to transmit critical data or personal information to a destination outside of China, it can do so provided it undergoes a “security assessment.”

On April 11, 2017, the Cyberspace Administration of China published a draft of its proposed Measures for the Security Assessment of Outbound Transmission of Personal Information and Critical Data (the “Draft”). The Draft provides further guidance on how the security assessments might be carried out. The general public may comment on the Draft until May 11, 2017. At this point, the Draft has only been published for comment and does not constitute a final regulation. However, it represents a real possibility of what the final regulation could require.

The Draft would extend the data localization requirement from “operators of key information infrastructure” to all “network operators.” The definition of “network operator” under the Draft remains consistent with the definition given under the Cybersecurity Law, which refers to an owner or an administrator of a computerized information network system, or a network service provider. This means that all  “network operators” will also be required to store, within the territory of China, personal information and critical data which they collect or generate in the course of operating their business in China and undergo a security assessment if they have a business need to transmit data outside of China.

The Draft has divided the security assessment into two types, self-assessments and assessments conducted by the competent authority. In general, a “network operator” has to conduct a self-assessment before transmitting critical data or personal information abroad, and will remain responsible for the result of its assessment. However, a security assessment must be submitted to and conducted by the competent authority under the following circumstances: (1) the outbound data transfer involves the personal information of over 500,000 individuals; (2) the data size is over 1,000 GB; (3) the transfer involves data in relation to nuclear facilities, chemistry and biology, national defense and the military, population health, megaprojects, the marine environment or sensitive geographic information; (4) the transfer involves data relating to information about the cybersecurity of key information infrastructure, such as system vulnerabilities and security protection; (5) the outbound transfer of personal information and critical data is conducted by an operator of key information infrastructure; or (6) the outbound data transfer may affect the national security or the public interest.

“Personal information” is already defined in the Cybersecurity Law itself as information that is recorded by electronic or other methods and that can, on its own or in combination with other information, distinguish the identity of a natural person. “Critical data” is defined in the Draft as data which is very closely related to national security, economic development and the social and public interests, but the concrete scope is to be further elaborated upon in relevant national standards and separate guidance documents.

Under the Draft, a security assessment would focus on the following factors: (1) the necessity of the outbound transfer; (2) the quantity, scope, type and sensitivity of the personal information and critical data to be transferred; (3) the security measures and capabilities of the data recipient, as well as the cybersecurity environment of the nation where the data recipient is resident; (4) the risk of leakage, damage or abuse of the data after the outbound transfer; and (5) possible risks to the national security, public interests and individual’s legal rights that are involved in the outbound data transfer and data aggregation.

When transferring personal information, network operators are required to expressly explain to the data subject the purpose, scope, content, recipient and the nation where the recipient is resident, and obtain the consent of the data subject. An outbound data transfer is prohibited without the consent of a data subject, or when the transfer may infringe upon the interests of the individual. Outbound transfers of a minor’s personal information must be consented to by the minor’s guardian.

An outbound data transfer will also be prohibited if the transfer would bring risks to the security of the national political system, economy, science and technology or national defense, or if the transfer could affect national security or jeopardize the public interest.