Until now, China’s data localization and cross-border data transfer requirements were not laid out in one piece of legislation but could be found scattered in the Cybersecurity Law and its draft implementing regulations, as well as in various sectoral regulations, which contain specific requirements applicable to data processed by entities in specific sectors.   

With the June 10 enactment of the Data Security Law that will take effect Sept. 1 and the upcoming Personal Information Protection Law, companies may wonder whether they will find a unified framework to govern their data transfers out of China once all the laws are in place. Unfortunately, the patchwork of requirements related to data localization and cross-border data transfers may be here to stay, even after the enactment of the DSL and the PIPL.

Different obligations could still be imposed on companies depending on their status and the types of data they intend to transfer outside of China. Meanwhile, specific requirements introduced by sectoral regulations may further complicate the framework related to data transfers.  

Concepts of Personal Information and Important Data

In the CSL, DSL and the draft PIPL, two types of data may be subject to data localization and/or cross-border data transfer requirements: “personal information” and “important data.”    

Personal information: According to the second draft of the PIPL, “personal information” refers to various types of electronic or otherwise recorded information related to identified or identifiable natural persons, excluding anonymized information. This definition is largely consistent with the definition under the CSL and other national standards such as the Information Security Technology - Personal Information Security Specification. 

Important data: The concept of “important data” was first introduced in the CSL and was mentioned again in the DSL. But under both laws, it was left undefined. Instead of offering a clear definition of “important data” in the law itself, the DSL requires the central government to publish a national-level catalog of “important data” and calls for regional and sectoral regulators to issue more detailed catalogs to further identify the scope of “important data” in their regions and sectors. Hence, more guidance will likely be provided in these catalogs on what data might be in scope.  

Note that even though the national level catalog of “important data” is still pending, some sectoral regulators have started the experiment on defining the scope of “important data” in specific sectors. For example, the Cyberspace Administration of China released the draft Measures on the Automotive Data Security Management May 12, which provides a list of “important data” in the auto sector: 

• Data on the flow of people and traffic in an important and sensitive area, such as places involving state secrets (for instance, military administrative zones or areas where national defense science and technology institutions are located) and places where government agencies at county level and above are located. 
• Surveying and mapping data with a higher level of accuracy than that provided in publicly available maps. 
• Data on the operation of electric vehicle charging networks. 
• Data such as the type of vehicle and traffic volume on the road. 
• Audio and video data recorded outside of the car, including faces and voices of other pedestrians, license plates of other vehicles, etc. 
• Other data specified by CAC and relevant departments of the State Council that might impact national security and public interests. 

Finally, the DSL introduced the concept of “national core data,” which is presumably a subset of “important data” and defined as “data related to [China’s] national security, lifeline of national economy, people’s livelihood and vital public interests." However, it is still currently unclear whether such data will be subject to specific data localization and/or cross-border transfer requirements.  

Data localization requirements 

In considering whether a company is subject to China’s data localization requirements, the first factor is whether it is viewed as a critical information infrastructure operator. The CSL defines CII broadly as infrastructure that might seriously endanger national or public interests if damaged. Examples of CII include telecommunications, energy, transportation, water conservancy, financial services, public services and electronic government affairs. However, there is no finalized guidance on the detailed criteria for assessing what infrastructure is CII and no published list of CII or CII operators. 

It is important to note that the CSL, DSL and draft PIPL do not clarify how data localization requirements interact with cross-border transfer requirements. Additionally, these laws do not explain whether “localization” only refers to the storage of data locally or if it extends to the localization of other processing activities. Thus, there remains an amount of uncertainty on how these obligations will impact companies in practice.  

The diagram below illustrates a step-by-step process for a company to determine whether any data it processes may be subject to China’s data localization requirements.  

(Click to view larger image)

Requirements for CII operators 

Under the CSL, CII operators must store both personal information and “important data” collected and generated in China locally. Note that although a CII operator is subject to data localization requirements, it can still potentially transfer personal information and “important data” for business needs if it passes the security assessment.  

The DSL echoes the data localization requirements under the CSL, requiring CII operators to store “important data” collected and generated in China locally. 

Requirements for non-CII operators 

Under the draft PIPL, if a personal information processing entity — the Chinese law equivalent of the data controller under the European Union’s General Data Protection Regulation — processes personal information “in a volume that reaches the threshold specified by CAC,” it is required to store personal information collected and generated within China. However, such a threshold remains undefined now.  

Unlike the requirements for CII operators, there is no general data localization requirement on “important data” processed by non-CII operators in China.   

Sectoral requirements for specific types of data 

Sectoral regulations may also require companies within the sectors to store certain data locally in China. It is uncertain if localization requirements under the sectoral regulations overlap with the framework of CII and non-CII operators. For example, the draft Automotive Measures requires operators in the sector, including institutions and corporations that design or manufacture automobiles or provide automotive services, to store “automotive personal data” and “important data” in China. “Automotive personal data” could include personal information of the automobiles’ owners, drivers and passengers, as well as any information that can be used to describe behavior and identify individuals. The draft Automotive Measures did not specify if it applies only to CII operators. So non-CII operators in the sector may also need to store “automotive personal data” and “important data” related to automobiles collected by them within China.  

Cross-border data transfer requirements 

Similarly, the diagram below illustrates the process for a company to determine which requirements are applicable for it to transfer data abroad. 

(Click to view larger image)

Requirements for CII operators 

Under the CSL, although CII operators must comply with the data localization requirement as discussed above, they may be allowed to transfer personal information and “important data” overseas if the transfer is necessary for their business needs, and they must undergo a security assessment according to the process specified by CAC and other relevant government agencies. Note that such a security assessment process has not been released yet. The DSL reaffirms this approach.

Further, for the cross-border transfer of personal information, all personal information processing entities (including both CII and non-CII operators) must obtain a separate consent from individuals before transferring their personal information abroad (if consent is the lawful basis for processing). Also, they need to carry out an internal risk assessment prior to transfer, similar to the data protection impact assessment required under the GDPR, and keep records of the assessment processing activities.

Requirements for non-CII operators 

On top of the generally applicable requirements for separate notice and consent as well as the internal prior risk assessment and record keeping, the draft PIPL also impose different additional requirements for two types of operators distinguished based on the volume of data they plan to transfer: non-CII operators processing a large volume of personal information and non-CII operators that do not meet the threshold.

Non-CII operators processing a “large volume” of personal information will need to undergo a security assessment administered by CAC. Note that the draft PIPL did not provide any details for the security assessment process and the threshold has not yet been published.

Non-CII operators that do not meet the threshold do not need to go through a security assessment, but need to choose one of the following lawful transfer mechanisms: 

• Obtaining personal information protection certification issued by professional institutions in accordance with rules specified by CAC. 
• Entering into agreement based on standard contract stipulated by CAC with the recipient (such a standard contract has not yet been published). 
• Other conditions stipulated by laws and regulations.
  

Important data: For non-CII operators that transfer “important data,” the DSL only states the cross-border transfer rules on “important data” collected and generated by non-CII operators in China is going to be released by CAC and other agencies.  

Sectoral requirements 

Sectoral regulations may also impose restrictions on cross-border data transfers. For example, under Automotive Measures, automotive operators that plan to transfer important data and “automotive personal data” overseas must: Undergo a security assessment administered by CAC; specify and monitor the data processing activities of data recipients; handle complaints from users; and file annual data security reports to CAC and other agencies.  

Conclusion  

We can expect the data localization and cross-border transfer rules in China to remain complicated for years to come. Companies collecting data in China should closely review these rules when considering their data localization and cross-border data transfer strategies.  

Photo by Hanson Lu on Unsplash