Into the Eye of the Storm: update on China's long-awaited data export review measures

"The Cyberspace Administration of China ("CAC") released a new draft of the Security Assessment of Cross-Border Transfers of Personal Data Measures ("New Draft Measures") for public comment on 13 June 2019, the consultation period for which concluded on 13 July 2019.

The New Draft Measures have been hotly anticipated, as there had been a hiatus with little official commentary and no further drafts after the CAC issued its first set of draft measures on data localization requirement in April 2017, followed by another two sets of revised versions in May and August 2017, respectively. The 2017 draft measures had the effect of highlighting the importance of Article 37 to multi-national businesses with operations in China, in particular due to the extension of the restrictions on cross-border transfers and de facto data localization requirement to "network operators". The New Draft Measures mark a break in China's silence on data localization, reviving concerns that appear to be closely related to the delicate ongoing US-China trade discussions.

Overall the direction of travel under New Draft Measures is not as hoped, and is likely to re-ignite concerns about China's commitment to allowing international data flows crucial to many foreign-owned businesses in China. If promulgated in their current form, the New Draft Measures would cast an even wider net than previous drafts, sweeping in businesses collecting data from abroad and requiring advance regulatory approval for all international transfers of personal data."

Please click here to read the full article.

Download PDF Back To Listing