CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
of data processing (comparable to data processors under the GDPR). In addition, the Opinions establish protections for data originators from the perspective of data ownership. The frameworks encompass both personal and non- personal data. The DSL adopts a broad definition of data, which includes any information recorded in electronic or non-electronic form. Consequently, non- personal data, such as industrial data, also falls within the scope of protection under the DSL. The protection of PI is primarily governed by the PIPL. Currently, China has not enacted a single, standalone law equivalent to the Data Act. Instead, it has adopt - ed a model that combines comprehensive legislation with supporting policies. Foundational laws estab - lish the framework for safeguarding data sovereignty and security, while policies like the Opinions are pro - gressively advancing the marketisation of data. This approach aims to strike a prudent balance between promoting data sharing and innovation on one hand, and addressing security concerns on the other. 3.2 Interaction of Data Regulation and Data Protection The interaction between the above data regulation frameworks and privacy rules, as well as the IP pro - tection of non-personal data, is not realised through a single statutory provision, but accomplished through a layered, multi-dimensional and dynamically evolving comprehensive legal system. The core logic resides in the foundational legal framework constituted by the Three Fundamental Laws, which establish red lines and principled obligations for all data processing activities. Specifically concerning PI processing, data generated by IoT or cloud computing services, once constituting PI, must fully comply with PI processing obligations stipulated under the PIPL. This includes ensuring a legal basis as defined by the PIPL, such as obtaining user consent. Concurrently, regulations pertaining to IoT or cloud computing require service providers to implement technical measures – such as encryption and access control. These requirements constitute the operational implementation of the overarching legal principles of “confidentiality” and “security”.
Non-personal data generated by the IoT or processed via cloud computing – such as industrial data – is reg - ulated by the DSL and CSL in terms of its storage, transmission and cross-border security. While raw IoT data, such as sensor readings, generally does not constitute intellectual property (IP) in itself, once such data undergoes original compilation or in-depth analysis, it may give rise to a data product eligible for copyright protection or protectable as a trade secret, thus falling within the scope of IP law. 3.3 Rights and Obligations Under Applicable Data Regulation The processing of PI within contexts such as the IoT and cloud computing is likewise subject to the Three Fundamental Laws, encompassing the stipulated rights and obligations as well as the necessary action items for organisations. For details, refer to 1.2 Rights and Obligations . For non-personal data, the DSL seeks to safeguard the rights of data owners by imposing obligations on data processing. Organisations are required to establish a data management system and implement technical measures to ensure data security. In terms of data circulation, China encourages the compliant and efficient use of data, while establishing security boundaries for data sharing and trading. For instance, data intermediary service providers are obligated to verify the legality of data sources and the identities of Pursuant to the DSL, China has established a co- ordinated working mechanism for data security, applicable to data including non-personal data. Local authorities and various government departments are responsible for the data collected and generated with - in their respective regions and sectors, as well as for the security of such data. The CAC takes the lead in co-ordinating network data security efforts and related regulatory work. The MPS and other relevant authori - ties undertake data security regulatory responsibilities within their respective statutory remits. Sector-spe - cific authorities, such as the MIIT and those oversee - ing transportation, and finance, assume data security regulatory duties for their respective industries. the parties involved in data transactions. 3.4 Regulators and Enforcement
57 CHAMBERS.COM
Powered by FlippingBook