Journal:Cross-border data transfer regulation in China
| Full article title | Cross-border data transfer regulation in China |
|---|---|
| Journal | Rivista Italiana di Informatica e Diritto |
| Author(s) | Li, Yuan |
| Author affiliation(s) | University of Macerata |
| Primary contact | Email: Unknown |
| Year published | 2021 |
| Volume and issue | 3(1) |
| Page(s) | 69–80 |
| DOI | 10.32091/RIID0028 |
| ISSN | 2704-7318 |
| Distribution license | Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International |
| Website | http://nir.ittig.cnr.it/www.rivistaitalianadiinformaticaediritto.it/index.php/RIID/article/view/73 |
| Download | http://nir.ittig.cnr.it/www.rivistaitalianadiinformaticaediritto.it/index.php/RIID/article/view/73/55 (PDF) |
Abstract
With the growing participation of emerging countries in global data governance, the traditional legislative paradigm dominated by the European Union and the United States is constantly being analyzed and reshaped. It is of particular importance for China to establish the regulatory framework of cross-border data transfer, for not only does it involve the rights of Chinese citizens and entities, but also the concepts of cyber-sovereignty and national security, as well as the framing of global cyberspace rules. China continues to leverage data sovereignty to persuade lawmakers to support the development of critical technology in digital domains and infrastructure construction. This paper aims to systematically and chronologically describe Chinese regulations for cross-border data exchange. Enacted and draft provisions—as well as binding and non-binding regulatory rules—are studied, and various positive dynamic developments in the framing of China’s cross-border data regulation are shown. Despite certain limitations, China's Cybersecurity Law, together with its Civil Code and Personal Information Protection Law, demonstrates China's great willingness towards a stronger data protection regime and more flexible regulatory mechanism.
Keywords: China, cross-border data flow, cybersecurity
Introduction
The regulation of cross-border data transfers represents one of the greatest challenges that information security experts and legislators are facing around the world.[a] The breadth and effectiveness of global data protection law is fragmented by the divergence among various data protection standards. As such, the potential negative effects are difficult to ignore. From the perspective of countries, the adoption of the “adequate level of protection” approach de facto restricts the efforts of less developed regions—especially those that have not enacted data protection laws—from entering the world of global dataflow. It further leads to the elimination of such countries from participating in global digital trade and exacerbates the polarization of the world economy. From the perspectives of entities, particularly those in the information and communications technology (ICT) sector, the legal requirements set out in different jurisdictions are likely to impose additional administrative and technical burdens when conducting business internationally. The overlapping jurisdictions over various countries, cumbersome transfer assessment rules, and excessive discretionary powers of supervisory authorities have led to increased compliance costs while reducing the transaction efficiency of multinational businesses. Additionally, from the perspective of data subjects, individuals’ rights and responsibilities vary from nationality, residence, or information collection region. It is, however, contrary to the original purpose of protecting personal data while promoting data sharing.
Footnotes
- ↑ There is a lack of clarity as to the meaning of the term “cross-border data transfer” even inside one jurisdiction, and often regulatory instruments use different definitions to apply the measures. The E.U. General Data Protection Regulation (GDPR) refers to “transfer to a third country of personal data” (recital 153) without defining “data transfer”; the APEC Privacy Framework variously uses the terms “international transfer,” “information flows across borders,” “cross-border in-formation flow,” and “cross-border data transfer” interchangeably to refer to the movement of personal data across national borders. The OECD Privacy Guidelines refer to “transborder data flows,” defining the term as “movements of personal data across national borders” (Section 1(c)). Convention 108 refers to “transborder flows of personal data,” defined as “the transfer across national borders, by whatever medium, of personal data undergoing automatic processing or collected with a view to their being automatically processed” (Article 12(1)). It is also unclear whether merely making personal data accessible should be considered to result in such a transfer, or whether this requires some active or automatic transmission of the data (see Case C-101/01 Bodil Lindqvist v Åklagarkammaren i Jönköping [2003] ECR I-12971). In this article, “cross-border data flow” and “transborder data flow” are interchangeable, based on the context as well as the specific document it is referred to.
References
Notes
This presentation is faithful to the original, with only a few minor changes to presentation, though grammar and word usage was substantially updated for improved readability. In some cases important information was missing from the references, and that information was added. The original lists citations and footnotes all together under "Notes"; this version split the two out and and lists them in order of appearance, by design.
