CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
4.4 Data Protection in M&A All forms of data processing activities occurring in M&A and asset deals shall be governed by the DSL and the PIPL. The requirements and obligations set forth under the DSL and the PIPL shall be complied with accordingly. Due Diligence Phase Acquiring parties must adhere to the principle of data minimisation and necessity. Access to and review of the target company’s PI should be limited to what is strictly essential for the due diligence. Robust confi - dentiality agreements must govern all parties to pre - vent unauthorised use or disclosure of PI. Notification Upon Change of Control With regard to any transfer of PI due to change of control, Article 22 of the PIPL specifies additional dis - closure requirements that relevant individuals shall be informed of the name and contact information of the PI recipient. Individual’s consent is not required. Post-Closing Integration The PI recipient (the acquirer) must ensure its sub - sequent processing complies with the original pur - pose and method as understood by the individuals. In the event of any changes to the original purpose and method of data processing, consent shall be re- obtained. According to China’s regulatory framework, the CBDT of data encompasses both PI and non-personal data, the latter primarily referring to “important data” – the data that, once tampered with, destroyed, leaked, ille - gally obtained or illegally used, may endanger national security, economic operation, social stability, public health and security, etc. A “transfer” or “outbound transfer” is broadly con - strued as a data handler transferring data, collected and generated during its operations within China, to locations outside China. It also includes situations where the data collected and generated is stored 5. International Considerations 5.1 Restrictions on International Data Transfers
within China, but can be queried, accessed, down - loaded or exported remotely from overseas. It should be noted that if activities involving the PI processing of individuals within China are conducted outside China, with the purpose of providing products or services to such individuals or analysing or evaluating their behaviour, this also constitutes CBDT. To lawfully conduct CBDT, data handlers must select and fulfil a specific compliance pathway based on the nature and the volume of data transferred. There are three main CBDT compliance routes: • obtaining the CAC security assessment approval, a mandatory prior approval required from the CAC, applying to – (a) CIIOs transferring PI or important data abroad; and (b) non-CIIO data handlers transferring important data, or transferring, since January 1 of the current year, PI of more than 1 million individu - als or sensitive PI of more than 10,000 individu - als; • being certified by the recognised agencies (“Certi - fication”); or • concluding the CAC’s prescribed standard con - tractual clauses with the overseas recipient and filing it with the provincial CAC within 10 working days of its effectiveness (SCCs). For non-CIIO data handlers whose cumulative trans - fers since January 1 fall within the range of 100,000 to 1 million individuals’ PI, or less than 10,000 indi - viduals’ sensitive PI, and do not involve important data, the Certification and SCCs routes are alterna - tive options – the data handler may choose either one. Crucially, onward transfers by the overseas recipient are subject to strict regulation and must meet several conditions. These include, but are not limited to: • providing comprehensive notice to the individual; • obtaining separate consent; and • executing a binding agreement with the onward recipient.
60 CHAMBERS.COM
Powered by FlippingBook