[caption id="attachment_7869" align="alignnone" width="620"]
Xiaoyan Zhang, Reed Smith counsel[/caption] As multinational companies wrap up compliance preps for the EU’s General Data Protection Regulation (GDPR), China’s Cybersecurity Law (CSL) takes center stage presenting new challenges. Although CSL took effect on June 1, 2017, the compliance deadline for the most controversial cross-border data transfer requirement is deferred until Dec. 31, 2018. Companies deemed “network operators” are required to conduct a security assessment if they transfer personal information or important data collected or generated in China to a foreign party. While CSL’s security assessment regime remains under development and the draft bears superficial resemblance to GDPR, the Chinese legislative and enforcement styles create confusion, and sometimes false hopes, for western companies. This article sheds light for in-house counsel with GDPR exposure on how to prepare for CSL’s data transfer requirement. The Data Transfer Requirements under CSL and GDPR Article 37 of CSL initially requires that operators of critical information infrastructure (CII) store personal information and important data collected or generated in China within the territory of China, and conduct a security assessment if such data needs to be provided to a foreign party. Article 2 of the draft Measures later issued by the Cyberspace Administration of China (CAC) expanded the assessment requirement from CII operators to “network operators.” CII operators refer to companies in critical sectors such as radio, television, energy, transportation, water conservancy, finance, and others that “will result in serious damage to state security, the national economy and the people’s livelihood and public interest if it is destroyed, loses function or encounters data leakage.” The much broader category, “network operators,” refers to “owners, operators, and service providers of computer networks.” In parallel, China’s National Information Security Standardization Technical Committee (NISSTC), a standard-setting committee jointly supervised by the Standardization Administration of China (SAC) and the CAC, is preparing the security assessment Standard, which, though not legally binding, will provide practical guidance on how to conduct security assessment. Neither the Measures nor Standard have been finalized as of today. Article 44 of GDPR generally prohibits transfer of personal data to non-EEA recipients unless: (i) the recipient country is deemed to provide an adequate level of data protection (Article 45); (ii) data exporters adopt “appropriate safeguards” (Article 46); or (iii) a derogation applies (Article 49). CSL and GDPR Appear to Have Different Rationales The CSL concerns data sovereignty, national security, and the big data-driven economy. China has been an open advocate of Internet and data sovereignty and discourages excess reliance on U.S. communication infrastructure. In a 2011 submission to the United Nations, China, along with Russia and several other nations, articulated desires to claim sovereignty over its citizens’ data, and the rights to censor content and protect CII from foreign threats. The 2013 Snowden revelation led China to believe that it was a victim of NSA surveillance, and the first draft of CSL was released shortly after. Today, China accounts for more than 40 percent of the world’s e-commerce transactions according to the McKinsey Global Institute. Maintaining control over its data is believed to be essential to preserving China’s role in the global digital economy, and to support its big data-driven economy backed up by emerging technologies such as AI. As a result, CSL is designed with an over-reaching scope coupled with a heavy regulatory focus that places the ultimate decision-making power at the discretion of the authorities. In contrast, GDPR focuses on protecting individual rights while balancing the need of global trade. GDPR, together with its predecessor Directive, is based on a body of human rights laws including the 1948 Human Rights Declaration. Although neither statute articulates specific rationales behind the data transfer restriction, it is obvious that the main legislative purpose is to protect EU citizens’ personal information from misuse, particularly when such information leaves the EU territory. Mindful of the OECD principles, GDPR is not oblivious, however, to the practical needs of the global economy. It carefully balances the need to protect individual rights with the necessity of cross-border data flows by providing “adequacy” alternatives. Indeed, companies have been relying, and will continue to rely, on “appropriate safeguards” and “derogations” for compliance. The ends determine the means. CSL and GDPR thus have more differences than similarities. Unlike GDPR, CSL Captures Non-personal Information GDPR only concerns personal data. CSL also subjects non-personal information to transfer assessment, namely, “important data,” which is defined as data “closely related to national security, economic development and public interest.” The content of “important data” is sector-specific. The revised draft Standard gives a non-exhaustive list of exemplar information that may be deemed “important” for 28 sectors. For example, information concerning business entities such as name, address, account number, and operational data generated on the e-commerce platform for e-commerce; data concerning product sales, market research, and marketing plans for finance; stats of user behaviors and business trends for telecom. Sector regulators will have the ultimate discretion to determine what constitutes “important data.” Notably, “important data” covers both original data collected or generated in China as well as data derived from the original. CSL Applies Broadly to ‘Network Operators’ GDPR applies to all controllers or processors that need to transfer personal data. At first glance, CSL appears narrower in scope by only concerning “network operators.” However, since “network operators” are understood in practice to capture any companies providing services or operating business through computer networks including company intranets, the term is equivalent to the controllers or processors under GDPR in scope. This is not surprising, as data localization regulation in most jurisdictions does not typically tie to a particular set of business operators. A company, therefore, should not set aside its data transfer obligations by over-relying on the belief that it is probably not a network operator. Companies that are not registered in China but provide product or service to consumers in China may fall under “network operators.” The inquiry focuses on factors such as: (i) whether the Chinese language is used in the product or service offered; (ii) whether RMB is used as the currency for payment; and (iii) whether any logistics services are provided to consumers in China. CSL Adopts a Two-tiered Assessment Framework Tier one is self-assessment. Unlike GDPR, CSL mandates that network operators conduct a security self-assessment annually and under any of the following circumstances: