China – Guidelines For Cross-Border Data Transfer Security Assessment Released For Second Round Of Public Comment.

 

19 September, 2017

 

 

The National Information Security Standardization Technical Committee (“TC 260”) released a second draft of the Information Security Technology-Guidelines for Cross-Border Data Transfer Security Assessment on August 30, 2017 (the “New Draft”) allowing for public comment to be offered prior to October 13, 2017.

 

Before that, TC 260 released the first draft of these guidelines on May 27, 2017 (the “First Draft”). In the New Draft, the following major modifications and clarifications have been made from the previous draft. 

 

I. Clarification of the Definition of Operations within the Territory of China

 

The draft of the Measures for Security Assessment of the Cross-Border Transfer of Personal Information and Important Data (the “Assessment Measures”) released by the Cyberspace Administration of China and the First Draft both provide that security assessments shall be carried out where network operators provide personal information and important data collected and generated in the course of operations within the territory of China to overseas parties. The New Draft clarifies and details the concept of “operations within the territory of China” for the first time. According to the New Draft, a network operator who is not registered within the territory of China but who conducts business within or provides products or services to the territory of China shall also be deemed as conducting “operations within the territory of China”. When determining whether a network operator is conducting business within or providing products or services to the territory of China, factors that shall be taken into account include (but are not limited to)  website being in Chinese language,  settlement  in RMB, and  delivery commodities to China. This provision will undoubtedly broaden the scope of application of the obligation of security assessment for data exports, expanding the New Draft to reach beyond China’s borders. The New Draft also provides that network operators within the territory of China who only conduct business with or provide products or services to overseas institutions, organizations or individuals without involving personal information and important data of domestic citizens shall not be deemed conducting “operations within the territory of China”.

 

II. Clarification of the Definition of Data Export

 

As provided in the New Draft, the data export means “the one-time or continuous activity in which a network operator provides personal information and important data collected and generated by network or other means in the course of operations within the territory of China to overseas institutions, organizations or individuals by means of directly providing or conducting business, providing services or products, etc.” According to the New Draft, the following circumstances shall be deemed as data exports:

 

• The personal information and important data is provided to any entity within the territory of China who is not subject to the jurisdiction of China or not registered within the territory of China;
• The data which is not transferred to or stored in places other than China is accessed and viewed by overseas institutions, organizations and individuals (except for public information and webpage visits);
• A network operator group exports its internal data which involves personal information and important data collected and generated in the course of its operations within the territory of China.

 

The following circumstances shall not be deemed data exports:

 

• The personal information and important data not collected or generated in the course of operations within the territory of China is exported via China without any variation or processing.
• The personal information and important data not collected or generated in the course of operations within the territory of China is exported after being stored and processed in China without involving any personal information or important data collected and generated in the course of operations within the territory of China.

 

III. Further Clarification of the Conditions for Initiating Security Self-Assessment

 

The New Draft requires that network operators  to carry out security self-assessments every year and further specifies that a self-assessment  should be initiated:

 

(1) when data is to be exported;

 

(2) before a critical information infrastructure operator carries out the data export;

 

(3) with respect to personal information and important data to be exported with products or businesses that have completed security self-assessments for data export, when there is a major change in the purpose, scope, type, quantity and other aspects of the data export, the recipient changes, or a major security incident occurs;

 

(4) as required by the competent industry or regulatory authorities. The New Draft provides that “the data exported by a network operator shall be deemed as a single export and subject to a single assessment if the conditions of continuous export are met,” where the “continuous export” refers to “such data exports that have the same purpose and recipient with no significant change in the scope, type and quantity and the interval between two exports being less than one year.”

 

Furthermore, the New Draft requires that in the case of multiple parties involved in a data export (e.g. when using cloud services or subcontracting services), the originator of the data export shall be responsible for the security self-assessment. For example, if a cloud service client actively requests a cloud service provider to make a data export, the cloud service provider shall cooperate with the cloud service client to carry out the security self-assessment and the cloud service client shall assume the corresponding responsibilities. If the cloud service provider actively proposes to make a data export, the cloud service client shall cooperate with the cloud service provider to carry out the security self-assessment and the cloud service provider shall assume the corresponding responsibilities.

 

IV. Self-Security Assessment Process

 

The New Draft requires that network operators shall establish working groups for data export security self-assessments mainly consisting of professionals in law, policy, security, technology, management and other areas, and whose responsibilities include reviewing data export plans submitted by business units and regularly carrying out inspections and spot checks on the data exports. 

 

The New Draft requires that business units of network operators who need to conduct data exports shall prepare data security plans and assess the purpose of such export including its lawfulness, appropriateness and necessity as well as the risks of security in accordance with the focus and methods of assessment. Where the permission of the State cyberspace administration and the industry regulatory authority is required for the data export, the network operator shall submit the assessment report to the State cyberspace administration and the industry regulatory authority for approval prior to such export. Like the Assessment Measures, the New Draft also requires network operators to submit security self-assessment reports to the industry regulatory authority or the State cyberspace administration (if there is no definitive industry regulatory authority) under the following circumstances:

 

• The security self-assessment is conducted by a critical information infrastructure operator;
• The amount of personal information exported within one year has reached the amount for reporting as required by the State cyberspace administration and/or the industry regulatory authority;
• The data to be exported includes those related to nuclear facilities, biochemistry, national defense and military industries and demographic health, and sensitive geographic data related to large-scale projects and marine environment as well as other important data;
• The data to be exported involves cyberspace security information such as security flaws in the critical information infrastructure and specific security measures;
• Any other circumstances that may affect the national security, economic development and social public interests.

 

According to the New Draft, the assessment report shall be kept for at least two years instead of five years as outlined in the First Draft. 

 

V. Government Assessment Process

 

Criteria for application of government assessments.  According to the New Draft, the State cyberspace administration and the industry regulatory authority may perform, at their own discretion, government security assessments of the data export, depending on the type, quantity, scope and degree of importance of the data to be exported.  Notwithstanding, a government security assessment shall be triggered when a network operator is required to submit its self-assessment report to the competent regulatory authority for review under such circumstances as listed in Section IV above, when a large number of user complaints or violation reports has been submitted, when the national trade association suggests a government assessment, or otherwise when the State cyberspace administration or the industry regulatory authority deems necessary to perform a government assessment.

 

Assessment plan.  After the assessment is initiated, the competent regulatory authority must formulate an assessment plan, specifying the target of the government assessment, the establishment of an assessment working group and the assessment procedures and method.

 

Assessment report of the assessment working group.  After the competent regulatory authority formulates the assessment plan, the State cyberspace administration and the industry regulatory authority will establish a data export assessment working group to conduct a security assessment of data exports by the target of the government assessment through remote monitoring and on-site inspection in accordance with the assessment plan in line with the focus and methods of assessment as set forth in the Guidelines and to produce the report of the government security assessment.  Such assessment report will specify, amongst other things, the assessment results and the grounds therefor, the critical risk exposures in data exports and recommended corrective actions to mitigate such risks in the process of exporting the data.

 

Committee of experts.  In addition, the State cyberspace administration and the industry regulatory authority will establish a committee of experts, comprised of cyber security experts, data security experts and experts in the fields involved in the assessment.  This committee is responsible for research and analysis of the security self-assessment reports submitted by network operators and the government assessment reports and based on those reports, issuing its opinion on whether to approve the data export concerned.

 

Assessment conclusions.  Taking into account the assessment report and the suggestions given by the committee of experts, the competent regulatory authority will render its decision on whether to approve the data export concerned by giving a written notice to the assessed person. The competent regulatory authority may also carry out periodic inspections on the data export activities by network operators based on the security self-assessment results or the government assessment conclusions and depending on the status of data exports by network operators, and thereby take inspection results and recommend corrective actions by giving a written notice to the assessed person. 

 

VI. Further Clarification of the “Notification – Consent” Requirement for the Export of Personal Data

 

The New Draft further specifies the requirement of “notification – consent” for the export of personal data in the assessment on lawfulness. Prior to obtaining consent from the individuals whose personal information is to be exported, the network operators should expressly notify such individuals of the purpose, type, recipient and risks of the data export as well as its contact person and contact details. 

 

When there is a change in the privacy policy of the network operator or the recipient of exported data, or when there is a major change in the purpose, scope, type, quantity or risks of the data export, consent must be obtained again from the individuals whose personal information is to be exported. Moreover, the New Draft expressly provides that exporting personal information legitimately disclosed to the public should be deemed as an export with the consent of the owner of such personal information.

 

VII. Our Observations

 

The New Draft further specifies the framework for data export assessments as provided in the Assessment Measures – i.e. “self-assessment plus government assessment” – from the aspect of conditions for initiating assessments, process, methods and focus of assessments. Compared to the First Draft, the New Draft puts forward more specific conditions, process and requirements of government assessments. More importantly, the New Draft  specifies unclear and long controversial issues in  previous practices (e.g., the concept of data export, who  should be responsible for the assessment when there are multiple parties involved in the data export, etc.), as well as provides specific guidance for future data export assessments. As the New Draft is still open for public comment, we will continue to monitor its subsequent developments, implementation, and implication to a wide range of companies and industries.