Evolution of Chinese Domestic Cybersecurity Regulations

Evolution of Chinese Domestic Cybersecurity Regulations: From Fragmented Laws to a Unified Approach Presented by: Sheng Zhang, Associate Professor & Assistant Dean Deputy Secretary General, China International Investment Arbitration Forum Date: 18 January 2021 Content - Domestic Law and Policies - Fragmented Regulations and Focus on Data Localization • Regulation on Internet Information Service of the People's Republic of China (2000, revised in 2011) - • State Secrets • Personal Financial Information • Health Information Toward a Unified Approach • Basic Laws and Three Pillars • Cybersecurity Law (2016) • E-Commerce Law (2018) • Civil Code (2020) • Data Security Law (Draft for Comments) (2020) Domestic Law and Policies Phase I: Different Regulations and Focus on Data Localization (before 2016) - Regulation on Internet Information Service of the People's Republic of China (2000, revised in 2011) - [Article 17] A profitable Internet information service provider shall obtain approval from the Ministry of Information Technology (MII) before applying for public listings at domestic or international stock markets or seeking foreign investment by creating a Sino foreign equity or contractual joint venture. The foreign investment ratio in the joint venture shall conform to the relevant laws and regulations concerning foreign investment. Phase I: Fragmented Regulations and Focus on Data Localization (before 2016) - State Secrets • - Law on Guarding State Secrets (2010) Personal Financial Information • Art.6, Notice by the People's Bank of China Regarding the Effective Protection of Personal Financial Information by Banking Institutions (2011) - Health Information • Art. 10, Notice of the National Health and Family Planning Commission on Issuing the Measures for the Administration of Population Health Information (Trial) Phase II: Toward a Unified Approach (2016--) - - Basic Laws and Three Pillars • Cybersecurity Law (2016) • Data Security Law (Draft) (2020) • Personal Information Protection Law (Draft) (2020) Cybersecurity Law (2016) • [Article 37] Personal information and important data collected and produced by critical information infrastructure operators during their operations within the territory of the People's Republic of China shall be stored within China. If it is indeed necessary to provide such information and data to overseas parties due to business requirements, security assessment shall be conducted in accordance with the measures developed by the national cyberspace administration in conjunction with relevant departments of the State Council, unless it is otherwise prescribed by any law or administrative regulation. - E-Commerce Law (2018) • [Article 73] The state shall promote the exchange and cooperation with different countries and regions in e-commerce, participate in the development of international e-commerce rules, and promote the international mutual recognition of electronic signature and electronic identities. - Civil Code (2020) • - Chapter VI Right of Privacy and Protection of Personal Information Data Security Law (Draft for Comments) (2020) • Article 33  Where foreign law enforcement bodies need to consult data stored within the mainland territory of the People's Republic of China, relevant organizations and individuals shall report the matter to the relevant competent department, and may only provide it after having obtained permission. Where the People's Republic of China has concluded or joined an international treaty or agreement with provisions on foreign law enforcement bodies consulting domestic data, those provisions shall be followed.