Journal:Cross-border data transfer regulation in China

From LIMSWiki
Revision as of 21:38, 19 July 2021 by Shawndouglas (talk | contribs) (Saving and adding more.)
Jump to navigationJump to search
Full article title Cross-border data transfer regulation in China
Journal Rivista Italiana di Informatica e Diritto
Author(s) Li, Yuan
Author affiliation(s) University of Macerata
Primary contact Email: Unknown
Year published 2021
Volume and issue 3(1)
Page(s) 69–80
DOI 10.32091/RIID0028
ISSN 2704-7318
Distribution license Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International
Website http://nir.ittig.cnr.it/www.rivistaitalianadiinformaticaediritto.it/index.php/RIID/article/view/73
Download http://nir.ittig.cnr.it/www.rivistaitalianadiinformaticaediritto.it/index.php/RIID/article/view/73/55 (PDF)
Emblem-important-yellow.svg This article should be considered a work in progress and incomplete. Consider this article incomplete until this notice is removed.

Abstract

With the growing participation of emerging countries in global data governance, the traditional legislative paradigm dominated by the European Union and the United States is constantly being analyzed and reshaped. It is of particular importance for China to establish the regulatory framework of cross-border data transfer, for not only does it involve the rights of Chinese citizens and entities, but also the concepts of cyber-sovereignty and national security, as well as the framing of global cyberspace rules. China continues to leverage data sovereignty to persuade lawmakers to support the development of critical technology in digital domains and infrastructure construction. This paper aims to systematically and chronologically describe Chinese regulations for cross-border data exchange. Enacted and draft provisions—as well as binding and non-binding regulatory rules—are studied, and various positive dynamic developments in the framing of China’s cross-border data regulation are shown. Despite certain limitations, China's Cybersecurity Law, together with its Civil Code and Personal Information Protection Law, demonstrates China's great willingness towards a stronger data protection regime and more flexible regulatory mechanism.

Keywords: China, cross-border data flow, cybersecurity

Introduction

The regulation of cross-border data transfers represents one of the greatest challenges that information security experts and legislators are facing around the world.[a] The breadth and effectiveness of global data protection law is fragmented by the divergence among various data protection standards. As such, the potential negative effects are difficult to ignore. From the perspective of countries, the adoption of the “adequate level of protection” approach de facto restricts the efforts of less developed regions—especially those that have not enacted data protection laws—from entering the world of global dataflow. It further leads to the elimination of such countries from participating in global digital trade and exacerbates the polarization of the world economy. From the perspectives of entities, particularly those in the information and communications technology (ICT) sector, the legal requirements set out in different jurisdictions are likely to impose additional administrative and technical burdens when conducting business internationally. The overlapping jurisdictions over various countries, cumbersome transfer assessment rules, and excessive discretionary powers of supervisory authorities have led to increased compliance costs while reducing the transaction efficiency of multinational businesses. Additionally, from the perspective of data subjects, individuals’ rights and responsibilities vary from nationality, residence, or information collection region. It is, however, contrary to the original purpose of protecting personal data while promoting data sharing.

Global data transfer

The benefits that can be derived from cross-border data flows are growing, while the ability of countries to reap such benefits may vary.[1] Although it is widely recognized that countries should have a common interest in facilitating cross-border dataflows and reconciling different policy objectives in this field, the implementation of the free flow of cross-border data remains vague. Due to differences in digital economic development, legal systems, and data sovereignty objectives, it is difficult for countries to impose effective regulations on cross-border data transfer through one’s own. In contemporary legislations, a trend of preference for establishing one data flow model inside a region within a given group of countries is emerging.

A multilateral international agreement

The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) adopted by the Council of Europe in 1981 is the first and only updated binding multilateral international agreement to set standards for transborder data flows. The early version of Convention 108 provided general principles that require signatory countries not to restrict or impose any special authorizations to prevent the flow of personal data among the member states and aims to achieve greater unity between its members.[2] Convention 108 was further developed in the Additional Protocol in 2001 to introduce the concept of an “adequate level of protection” for the intended data recipient countries that are not the signatories to Convention 108.[3] Such exporting party is also subject to exceptions where the transfer is in the need of individual’s legitimate interests and public interest, or is based on authority-approved contractual clauses.

Convention 108 is the result of the implementation of the European Convention on Human Rights with regard to privacy protection. It attempts to build consistent data protection principles to safeguard individual’s rights while keeping active exchanges of such personal information across the borders. As great as it may appear, the significance of Convention 108 is limited.[b] Although international agreement as an instrument for dealing with modern societal and legal topics is advantageous in terms of the applicable scope of the rules, enforcement, and guidance, its complex and lengthy establishment procedures have slowed down the reaction time to the emerging issues in the international community, especially in areas where international consensus has not yet been reached.

A bilateral international agreement

In view of the latency of the international community’s cooperation in the field of cross-border personal data transfer, multiple emerging countries engaging in the digital economy have actively launched bilateral negotiations based on their own development needs. By reaching a bilateral agreement, a legal basis for the personal data exchanges between signatory countries is developed. The E.U.-U.S. Privacy Shield Framework is such an example. In 2014, as a direct response to the Snowden revelations, the Schrems I case led to the Court of Justice of the European Union (CJEU) revoking the Safe Harbor Framework as a valid mechanism for transfers between the E.U. and the U.S.[c] The E.U. and the U.S. then successfully developed the alternative Privacy Shield Framework, putting forward more stringent and descriptive data transfer requirements for data controllers.[5] The framework received wide criticism, the the E.U. Commission’s adequacy determination for the Privacy Shield has been upheld.[d] American companies may be permitted to acquire personal data from a total of 28 European countries after registering under the Privacy Shield program and demonstrating that they fulfill the “adequacy protection” requirement by self-certification procedures. The Privacy Shield Framework additionally includes verification, assessment, and supervision mechanisms, as well as special rules related to arbitration procedures.[e] The bilateral agreement allows two countries to make more detailed arrangements for cross-border data transfer issues. It is advantageous in terms of negotiation efficiency and enforcement, as well as the flexibility of contents. However, its scope of application is limited to the jurisdictions of the two countries. For the establishment of a regional framework of personal data cross-border transfer, such a bilateral agreement has very limited effect on bridging different legal standards.

Soft laws

Soft laws often play important roles in encouraging reluctant states to consider and eventually agree upon policies and strategies in areas where serious differences exist. Many international organizations have issued soft laws to regulate cross-border transfer of personal data, which has given certain guidance to the national legislation and implementation. The OECD Privacy Guidelines released in 1980 serve as the first internationally agreed upon set of personal information protection principles and focus on balancing between the needs for digital economy and the protection of an individual’s rights. It addressed the needs for greater efforts to tackle the global dimension of privacy through improved interoperability and provided the member states a basic framework for the free flow of personal data for further negotiations.

The APEC framework, published by the Asia-Pacific Economic Cooperation in 2004, is a framework to protect privacy while enabling regional personal information transfers to promote consumer trust and business confidence, to lighten compliance burdens, and boost digital economies. The data controllers’ obligations are particularly emphasized as a data subject’s consent is mandatory prior to the transfer of their personal information, and the adequate level of data protection must be guaranteed. This framework is used as a basis for the APEC Cross-Border Privacy Rules (“CBPR”). The U.S.-led CBPR system comprises a Privacy Enforcement Authority, privacy certification institutions, and recognized entities operating upon nine general privacy principles and a bundle of practical requirements. A joint APEC-EU working team has attempted to discover more opportunities for “double compliance” via E.U. BCR and APEC CBPR referential.[f]

Additionally, the Southern African Development Community (SADC) developed the Model Law on Data Protection in 2010, containing general data protection principles for cross-border data transfer. Notwithstanding the efforts, many African countries continue to struggle with enacting laws to regulate the collection and processing of personal information. The organization’s practices stopped at proposing a broad framework of guidance. While further discussions over effective solutions to the conflicts of applicable laws of personal data transborder regulation are needed, these and other international negotiations and cooperative efforts remain worthy of recognition.

Problem statement

China is imminently in need of a strong and more coherent data transborder flow regulatory framework, backed by transparent enforcement and legal certainty. As the world’s second largest economy, China’s demand for data exchange across borders has grown significantly. On one hand, cross-border e-commerce transactions reached 134.7 billion RMB (approximately 17.7 billion euro) in 2018[6], with expectations in 2015 of it reaching more than one trillion euro by the year 2020, accounting for 37.6% of China’s total imports and exports.[7] On the other hand, technical innovations have brought unprecedented threats to privacy and data security. Furthermore, global trade and political tensions are rising. Against this background, China needs to carefully assess domestic and international economic and legal situations to create a quality strategy for cross-border data flow regulation.

China’s cross-border data transfer regulation is an evolving project still under development, with various administrative regulations and department rules continuing to expand. The Personal Information Protection Law has been incorporated into the law-making plan of the 13th Standing Committee of National People’s Congress, released with the draft for public comment on October 21, 2020. The legislators especially emphasized the protection of public interest and state security, taking into account the needs of the protection of data subjects' rights, and took a sheepish position on the regulation of cross-border data transfer. The Cybersecurity Law (enacted in 2017) for the first time addressed data localization and security assessment of data export requirements for Critical Information Infrastructure providers.[8] The Civil Code of China (adopted May 28, 2020) newly introduced greater protection of privacy rights and personal information.[g] It clarified that (i) the rights and interests of natural persons over their personal information are civil rights and private rights; (ii) natural persons’ rights to their personal information belong to personality rights; and (iii) the distinction is made between privacy and personal information. These three pieces of legislations constitute the foundation of China’s personal information protection laws.

The Measures on Personal Information and Important Data Export Security Assessment (draft for comments) was released in 2017 by the Cyberspace Administration of China (CAC). It was planned to contain elements in the scope of the security assessment, such as the consent of the data subject, the security protection status of the data recipient, and risk of data leaving China. Upon receiving constructive criticism, the CAC updated its draft a second time in 2019. One essential element–the important data–was removed, while one important element–the standard contractual clauses–was introduced.

About this paper

This paper aims to provide a comprehensive analysis of China’s cross-border data transfer regulation. The rest of the paper is organized as follows. The next section demonstrates how the personal data protections laws have evolved owing to transitions in the Chinese economy, with a focus on the objectives and characteristics of cybersecurity law, followed by how the Cybersecurity Law (CSL) is enforced and how authorities are responsible for the enforcement. The subsequent section highlights the Data Export Regulations in China, broadly classified into critical information infrastructure data export and personal data export, as well as how the approaches vary in terms of the measures and assessments. The paper ends with the conclusions derived from this study, as well as mentions of important drafts of laws and regulations to demonstrate possible future developments in China.

The evolution of China's personal data protection laws

Chinese concepts of privacy and personal data protection vary through different historical periods. Most of them are rooted in traditional Chinese ethics or moral standards, and partially integrated with the ideology of socialism.[9] With the economic transition from a central planned market to a free market in the 1990s, Chinese communities began to experience greater variety of roles in participating economic, societal, and political activities. Although traditional predominant values still hold a deep influence on people’s behaviors, individualism and subjectivity have dramatically been promoted in their social life. Scrutiny and concerns over the importance of an individual’s privacy and protection of emerging personal data processing are ever growing. Baidu, the largest Chinese search engine provider, was sued by a consumer rights protection association for illegally collecting user data without consent.[10] Alibaba, another internet giant, was challenged by Chinese users for the misuse of their digital transaction records and social media profiles on Zhima Credit (an online credit service that offers loans based on users’ digital activities).[11] The concept of privacy in contemporary China has been gradually expanded, and individuals have raised their expectations for the right to be left alone.

Prior to the CSL, China’s personal data protection policy was integrated in a number of laws and administrative rules through the protection of personal dignity and reputation. For example, Article 28 of the Chinese Constitution provides citizens an inviolable personal dignity from “insult, defamation or false charge.” Article 252 of Criminal Law (1997) prohibits any violation to the freedom of a citizen’s communication rights by hiding, destroying, or illegally opening other’s letters. And Article 101 of General Principles of Civil Law (1986) confers natural persons and legal persons the right of reputation. The Supreme People’s Court in 2001 for the first time confirmed the legal ground for claiming remedies for the damages caused by the violation of one’s privacy or other personal rights granted by these laws and rules.

Personal Information was firstly defined in the Notice of the Supreme People's Court, the Supreme People's Procuratorate and the Ministry of Public Security on Legally Punishing Criminal Activities Infringing upon the Personal Information of Citizens in 2013, stating that the “personal information of citizens include the name, age, valid certificate number, marital status, employer, education background, resume, family address, phone number and other information or data that can identify the identities of citizens or involve the personal privacy of citizens.”[12] In response to the rapid development of technology, Chinese authorities released over 200 laws, administrative regulations, and sector-specific rules regulating the collection and processing of personal information across domains like banking, healthcare, medical records, and disease control.[h] However, a comprehensive framework for personal data protection laws is still urgently in need.


Footnotes

  1. ↑ There is a lack of clarity as to the meaning of the term “cross-border data transfer” even inside one jurisdiction, and often regulatory instruments use different definitions to apply the measures. The E.U. General Data Protection Regulation (GDPR) refers to “transfer to a third country of personal data” (recital 153) without defining “data transfer”; the APEC Privacy Framework variously uses the terms “international transfer,” “information flows across borders,” “cross-border in-formation flow,” and “cross-border data transfer” interchangeably to refer to the movement of personal data across national borders. The OECD Privacy Guidelines refer to “transborder data flows,” defining the term as “movements of personal data across national borders” (Section 1(c)). Convention 108 refers to “transborder flows of personal data,” defined as “the transfer across national borders, by whatever medium, of personal data undergoing automatic processing or collected with a view to their being automatically processed” (Article 12(1)). It is also unclear whether merely making personal data accessible should be considered to result in such a transfer, or whether this requires some active or automatic transmission of the data (see Case C-101/01 Bodil Lindqvist v Åklagarkammaren i Jönköping [2003] ECR I-12971). In this article, “cross-border data flow” and “transborder data flow” are interchangeable, based on the context as well as the specific document it is referred to.
  2. ↑ Limited signatory countries, overbroad content, and free applicable scope eliminate the practical performance of Convention 108. Additionally, the International Law Commission listed “protection of personal data in the transborder flow of information” in its long-term working programs as early as 2006, yet it has proved fruitless so far.[4]
  3. ↑ The CJEU found that the U.S. government permitted generalized access to electronic information and failed to provide redress mechanisms. Therefore, the CJEU determined that the U.S. law did not provide an adequate level of protection that was essentially equivalent to E.U. laws. See Max Schrems v. Data Protection Commissioner.
  4. ↑ Digital Rights Ireland brought the first challenge on 2016, seeking the annulment of the determination on the basis that the Shield failed to provide sufficient substantive changes from the Safe Harbor Framework. This challenge was dismissed for lack of admissibility. French advocacy group La Quadrature du Net also challenged the Commission’s decision, arguing that the Shield not only continues to violate the Charter, but also fails to provide effective redress mechanisms. This case remains pending.
  5. ↑ Similarly, the U.S. also agreed to the Swiss-U.S. Privacy Shield Framework with Switzerland.
  6. ↑ The Referential for Requirements for Binding CorporateRules (BCR) and APEC Cross Border Privacy Rules system serve as an informal checklist for companies to apply certifications under the BCR and CBPR system. The referential outlines common compliance requirements and ad hoc requirements for each of the systems. Although the referential was superseded after the enactment of the GDPR in 2018, E.U. representatives have continued to express a strong interest in developing a work plan for future efforts. See Article 29 Data Protection Working Party, Opinion 02/2014 on a referential for requirements for Binding Corporate Rules submitted to national Data Protection Authorities in the E.U. and Cross Border Privacy Rules submitted to APEC CBPR Accountability Agents.
  7. ↑ "The personal information of a natural person shall be protected by law. Any organization or individual that needs to acquire the personal information of an individual shall obtain such information in accordance with law and guarantee the safety of such information. Any illegal collection, usage, processing, and transfer of the individual’s personal information, or illegal trade, making available or disclosure of other’s personal information is a violation of law." - Article 111 Civil Code of the People’s Republic of China
  8. ↑ China provides direct protection of personal information through The Seventh Amendment of Criminal Law, Tort Law, Telecommunication Law, Junior Protection Law, Consumer Protection Law, etc. Indirect protection of personal information is provided though Constitutional Law and Civil Law. For example, the Ministry of Industry and Information Technology is in charge of regulating the ISPs via Measures on Protecting Personal Information of Telecommunication and Internet Users, Measures on SMS service management, etc.

References

  1. ↑ "Declaration on Transborder Data Flow". OECD.org. 11 April 1985. https://www.oecd.org/sti/ieconomy/declarationontransborderdataflows.htm. 
  2. ↑ Council of Europe (1 October 1985). "Details of Treaty No. 108 - Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data". Council of Europe. https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108?module=treaty-detail&treatynum=108. 
  3. ↑ Council of Europe (1 July 2004). "Details of Treaty No. 181 - Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows". Council of Europe. https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/181?module=treaty-detail&treatynum=181. 
  4. ↑ General Assembly (2006). "Report of the International Law Commission, Fifty-eighth session" (PDF). United Nations. p. 489. https://legal.un.org/ilc/documentation/english/reports/a_61_10.pdf. 
  5. ↑ "COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the Transfer of Personal Data from the EU to the United States of America under Directive 95/46/EC following the Judgment by the Court of Justice in Case C-362/14 (Schrems) - COM/2015/0566 final". EUR-Lex. European Union. 6 November 2015. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52015DC0566. 
  6. ↑ Ministry of Commerce, People's Republic of China (21 February 2019). "Regular Press Conference of the Ministry of Commerce (February 21, 2019)". Ministry of Commerce, People's Republic of China. http://english.mofcom.gov.cn/article/newsrelease/press/201902/20190202837696.shtml. 
  7. ↑ Ouyang, C.; Pan, Y.; Sheng, Z. et al. (April 2017). "Inclusive Growth and E-commerce: China's Experience" (PDF). AliResearch. p. 18. https://unctad.org/system/files/non-official-document/dtl_eWeek2017c11-aliresearch_en.pdf. 
  8. ↑ "中华人民共和国网络安全法". Cyberspace Administration of China. 7 November 2016. http://www.cac.gov.cn/2016-11/07/c_1119867116.htm. 
  9. ↑ McDougall, B.S.; Hansson, A., ed. (2002). Chinese Concepts of Privacy. Brill. p. 8. ISBN 9789004127661. 
  10. ↑ Jing, M. (5 January 2018). "China consumer group accuses Baidu of snooping on users of its smartphone apps". South China Morning Post. https://www.scmp.com/tech/china-tech/article/2127045/baidu-sued-china-consumer-watchdog-snooping-users-its-smartphone. 
  11. ↑ Xueying, W. (4 January 2018). "Zhima Credit apologizes for its annual report’s ‘mistake’". CGTN. https://news.cgtn.com/news/78637a4e35637a6333566d54/share_p.html. 
  12. ↑ Supreme People's Court; Supreme People's Procuratorate; Ministry of Public Security (23 April 2013). "Notice of the Supreme People's Court, the Supreme People's Procuratorate and the Ministry of Public Security on Legally Punishing Criminal Activities Infringing upon the Personal Information of Citizens". Law Info China. http://www.lawinfochina.com/display.aspx?id=14967&lib=law. 

Notes

This presentation is faithful to the original, with only a few minor changes to presentation, though grammar and word usage was substantially updated for improved readability. In some cases important information was missing from the references, and that information was added. The original lists citations and footnotes all together under "Notes"; this version split the two out and and lists them in order of appearance, by design. The original articles Note 11 does not at all verify the quoted statistics; a citation to support at least the 2018 statistic was found and used for this version. Another citation was found and added for this version to support the claim more than one trillion euros e-commerce at 37.6% total of imports and exports. The quote about defining personal information had no citation in the original; for this version, a source was found, with slightly altered English text, and used.

Retrieved from "https://www.limswiki.org/index.php?title=Journal:Cross-border_data_transfer_regulation_in_China&oldid=43462"