Cybersecurity and Data Protection: A Study on China's New Cybersecurity Legal Regime and How it Affects Inbound Investments in China

• Author: Chen Ji
• Pages: 537-552

Cybersecurity and Data Protection: A Study on

China’s New Cybersecurity Legal Regime and

How It Affects Inbound Investment in China

C

HEN

J

I

I. Introduction

“Data is the lifeblood of the modern global economy. Digital trade and

cross-border data flows are expected to continue to grow faster than the

overall rate of global trade. Businesses use data to create value and many can

only maximize that value when data can flow freely across borders.”

1

China’s highest legislative body issued its first cybersecurity law on

November 7, 2016, which became effective nationwide on June 1, 2017

(“Cybersecurity Law”).

2

Commentators opine that “businesses operating in

China should [pay significant attention to the Cybersecurity Law] because it

contains several provisions that could greatly impact their information

security practices and liabilities.”

3

To date, the Chinese governments have issued several implementation

rules to provide more detailed guidance on the general requirements set out

in the Cybersecurity Law.

4

Some of these implementation rules are in draft

forms issued for public comments.

5

Certain draft industry standards, once

officially adopted, are voluntary only (meaning enterprises can choose

whether to comply with such standards or not).

6

However, this article still

considers such voluntary standards because they provide detailed

instructions to the general mandatory obligations.

7

These voluntary

standards may also serve as safe harbor in reality during governmental

enforcement actions.

8

1. Global Digital Trade I: Market Opportunities and Key Foreign Trade Restrictions, Inv.

No. 332 – 561, USITC Pub. 4716 (Aug., 2017).

2. Ron Cheng, China Passes Long-Awaited Cyber Security Law, F

ORBES

(Nov. 9, 2016, 7:07

PM), https://www.forbes.com/sites/roncheng/2016/11/09/china-passes-long-awaited-cyber-

security-law/#572c013f24d2.

3. Drew Foerster, China’s Legislature Gears Up to Pass a Sweepingly Vague Cybersecurity Law,

B

USINESS

L

AW

T

ODAY

(May 2016), https://www.americanbar.org/publications/blt/2016/05/

02_foerster.html.

4. Tod Liao and Judy Wang, China’s Cybersecurity Law and Draft Implementation Rules,

M

ORGAN

L

EWIS

, (May 25, 2017), https://www.morganlewis.com/pubs/chinas-cybersecurity-

law-and-draft-implementation-rules.

5. Id. para. 2.

6. Id. para. 24.

7. Id.

8. Id.

THE INTERNATIONAL LAWYER

A TRIANNUAL PUBLICATION OF THE ABA/SECTION OF INTERNATIONAL LAW

PUBLISHED IN COOPERATION WITH

SMU DEDMAN SCHOOL OF LAW

538 THE INTERNATIONAL LAWYER [VOL. 51, NO. 3

A spokesman of the Cyberspace Administration of China (“

CAC

”) also

held press conference on June 1, 2017 to respond to enterprise concerns and

public questions on the Cybersecurity Law (“June 2017 Press Conference”).

9

Comparing with the usual timeline that China passes its new laws,

Chinese governments acted quickly in passing the new regime,

10

showing

China’s determination in regulating its cyberspace.

Before issuance of the Cybersecurity Law, China already has an existing

legal regime governing its cyberspace.

11

However, such existing legal regime

is generally regarded as relying only on lower-level legislation, piecemeal

and not very well coordinated.

12

The Cybersecurity Law is the first

systematic approach at the highest legislative level for the Chinese

governments to regulate its cyberspace.

13

While enhancing protection set

out under the existing legal regime, the new cybersecurity legal regime

introduced new requirements (to be discussed below).

14

As a road map, Section 2 of this article outlines the basic framework of the

new cybersecurity legal regime. Sections 3-5 respectively analyses the

following “controversial” requirements introduced under the new regime

and their impact on foreign investments in China: (1) data localization and

cross-border transfer restrictions, (2) restrictions for network operators to

collect and use personal data in China, and (3) PRC national cybersecurity

review. Section 6 summarizes generally legal penalties for any violation of

each of such obligations for completeness. Section 7 concludes with overall

suggestions to foreign investors and legal advisors for evaluating investment

in China.

Where applicable, this article compares the new Chinese cybersecurity

legal regime against the relevant legal regime of the United States (“

US

”). I

have particularly selected the US legal regime for comparison because the

US appears to be the “toughest” contester against the Cybersecurity Law.

15

Also, the US legal regime is one of the legal frameworks that the Chinese

9. Xiang Hang, , W˘anglu`o ¯anqu´an f ˘a ji˘ed ´u:

K¯aiq˘a w˘ogu ´o x`ınx¯ı w˘anglu `o l`ıfa j`ınch´eng [Interpretation of Cyber Security Law: Opening the

Legislative Process of China’s Information Network], NPC, (Nov. 10, 2016 2:38 PM), http://

www.npc.gov.cn/npc/lfzt/rlyw/2016-11/10/content_2002309.htm.

10. See China’s Cybersecurity Law six months on: enforcement begins but implementation ongoing, D

E

B

RAUW

B

LACKSTONE

W

ESTBROEK

, (Nov. 16, 2017), https://www.debrauw.com/newsletter/

chinas-cybersecurity-law-six-months-enforcement-started-implementation-ongoing/.

11. Chen Jihong, Interpreting “The Law of Cyber Security”: A Perspective of Eight Perspectives,

L

EXIS

C

HINA

, (Nov. 15, 2016), http://hk.lexiscn.com/law/prof_articles_content.php?article_id=

205818&lang=en.

12. See China’s Cybersecurity Law, supra note 10.

13. Id.

14. See generally id.

15. Ling Ping, Danyou Maoyi Meiguo Yaoqiu Zhongguo Tingzhi Shishi Wangluoanquan Fa

() [Concern on Trading, the US urges China to stop

enforcing the Cybersecurity Law], R

ADIO

F

REE

A

SIA

(Sep. 26, 2017), http://www.rfa.org/mandarin/

yataibaodao/jingmao/yl-09262017111629.html (discussing US has submitted reports to WTO

stating that China should stop enforcing the Cybersecurity Law).

THE INTERNATIONAL LAWYER

A TRIANNUAL PUBLICATION OF THE ABA/SECTION OF INTERNATIONAL LAW

PUBLISHED IN COOPERATION WITH

SMU DEDMAN SCHOOL OF LAW