Suggestions
Cliff Lui
Senior Legal Counsel, Asia
Cliff Lui is a seasoned legal professional and accomplished individual with a diverse educational background. He holds a PCLL and a Bachelor of Laws (LLB) from The University of Hong Kong. Cliff also pursued a Bachelor of Business Administration (BBA) with a concentration in Law, Business Administration, and Management at the same prestigious institution. Furthermore, he expanded his knowledge by attending the 6th Youth Leaders' Course of Party Politics, Policies, and Principles under The Law at 国家行政学院 and studied at the German Swiss International School.
Highlights
In what will definitely be a moment of relief for most establishments in China trying to be compliant, the Cyberspace Administration of China promulgated the final version of the Regulations on Promoting and Regulating Cross-border Data Transfers 《促进和规范数据跨境流动规定》 (“Regs”) on 22 March 22 2024, updating the previous draft version of September 2023.
The new Regs recognise that companies of all sizes engage in transferring personal data overseas knowingly or not, and so provide for exemptions from the normal data transfer requirements (standard contract terms or security certification and filing) if the transfers are 'small'. The new Regs also recognise that no government can meaningfully handle data transfer filings and approvals for millions upon millions of entities.
Small in the Chinese sense means transfers of under 100,000 persons' personal data in a 1 calendar year period (unless 'sensitive' or 'important' data is involved). Also exempt are personal data transfers essential for HR management purposes (think multinationals). This should make clear that the targets of personal data transfer controls are large companies who actively and deliberately deal with personal data on a large scale.
That said, personal data must still be accorded respect, and companies should continue to obtain consents, maintain data security and suchlike.
Regs in Chinese: https://lnkd.in/g3XCMa3K
In what may be a moment of relief for many of the nearly 1 million foreign invested enterprises in China, a draft regulation was released on 28 September 2023 by the Cyberspace Administration of China (CAC) that provides for de-minimis exemptions from compliance with the personal information export procedures under the Personal Information Protection Law.
Under the Draft Regulations there would be no need for a Security Assessment, Standard Contract, or personal information protection certification for the cross-border transfer of data in circumstances where:
- data is generated in activities such as international trade, academic cooperation, transactional manufacturing, and marketing if such data does not contain personal information or important data;
- personal information not collected within China is provided overseas;
- it is necessary to provide personal information overseas for entering into or the performance of a contract, such as cross-border shopping, cross-border remittances, travel arrangements, etc.;
- personal information must be provided overseas for human resources management in accordance with labor rules and regulations and the labor contract; or
- personal information must be provided overseas to protect the life, health, or safety of individuals in an emergency.
Pundits expect the draft regulations to come into effect around 1 December.
The draft regulations (中文): https://lnkd.in/g9cCzaPs
