CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
5.3 Data Localisation Requirements In China, the first and foremost data localisation requirement is that national secrets are not allowed to be transferred overseas. Secondly, PI and important data collected by CIIOs in the course of their opera - tions in China are required to be stored domestically, and a security assessment is required for CBDT. There are also localisation requirements for specially regulated business data, including relating to the fol - lowing: • credit information; • personal financial information; • map data; • essential tech equipment required for online publi - cation services; • data and information related to car hailing services; • health information of the population; and • insurance data and fiscal data. In principle, such data must be stored within China (excluding the Hong Kong, Macau and Taiwan regions) and may not be freely transferred overseas. Regarding remote access, accessing data stored in China from overseas typically constitutes a data trans - fer. Consequently, any such data transfer or remote access will be subject to the specific CBDT require - ments applicable to the respective data type. 5.4 Blocking Statutes The Rules on Counteracting Unjustified Extra-Territori - al Application of Foreign Legislation and Other Meas - ures of the People’s Republic of China (“the Rules”; 阻 断外国法律与措施不当域外适用办法 ) released by the Ministry of Commerce are considered to be China’s blocking statute and have set up a relatively comprehensive anti-economic sanctions system to deal with the long- arm jurisdictions of certain countries and regions. The Rules and the privacy laws work together – often complementarily – to create a comprehensive frame - work that limits foreign-driven data access or discov - ery from within China. The Rules addresses foreign regulatory orders broadly (not limited to PI), while the DSL/PIPL focus on data sovereignty, PI protection and data transfers. According to Article 36 of the DSL,
This agreement must ensure that the recipient’s PI processing complies with the protection standards stipulated by Chinese laws. Regarding exceptions, Article 38 of the PIPL allows the provision of PI according to international treaties or agreements concluded or acceded to by China. Furthermore, Provisions on Promoting and Regulating Cross-Border Data Flows (“CBDT Provisions”, 促进和 规范数据跨境流动规定 ) provide for the following scenarios that are exempt from the CBDT application proce - dures: • CBDT that does not contain PI or important data; • where data handlers transfer PI collected and generated overseas after being processed domes - tically without involving domestic PI or important data in the process; • for the establishment or performance of contracts to which individuals are parties; • in implementing cross-border HR management based on legally formulated labour rules and col - lective contracts; • in emergency situations to protect the life, health and property safety of natural persons; and • where a non-CIIO data handler provides PI of fewer than 100,000 individuals (excluding sensitive PI) to an overseas recipient since January 1 of the same year. Further, according to Article 6 of the CBDT Provisions, Free Trade Pilot Zones (FTZs) may formulate their own lists of data that is applicable to the CBDT mecha - nism (Negative List). Data handlers within the FTZs are exempted from applying the CBDT mechanism when providing data not included on the Negative List overseas. 5.2 Government Notifications and Approvals For transferring PI and important data abroad, refer to 5.1 Restrictions on International Data Transfers . In addition, the CBDT of certain specially regulated data (eg, human genetic resources information) is subject to specific regulatory rules provided in certain fields and may require government approval, accord - ing to applicable regulatory rules for such CBDT.
61 CHAMBERS.COM
Powered by FlippingBook