![workplace-with-people-in-walking-in-blurred-motion-in-modern-office-space_AdobeStock_714071973](https://www.nortonrosefulbright.com/-/media/images/nrf/hero/workplace-with-people-in-walking-in-blurred-motion-in-modern-office-space_adobestock_714071973.jpeg?w=265&revision=757b8aa8-f74f-4e2d-9ccd-084ec5192278&revision=5250277392097387904&hash=380B464034E4102358A0D456AAB43445)
Publication
Merger law reform in Australia: What next after the Exposure Draft?
As expected, the Australian Commonwealth Treasury released an exposure draft for the proposed new Australian merger regime on 24 July 2024.
Global | Publication | June 2019
On June 13, 2019 Measures for Personal Data Cross-Border Transfer Security Assessments (Draft for Comment) (Measures) were issued by the Cyberspace Administration of China, along with an invitation for submissions to be made as part of a public consultation. The Measures lay down stricter requirements in relation to cross-border transfers of personal data with the intention to better safeguard internet users’ rights, public interests and national security.
The Measures set out a number of general requirements and implementing provisions for aspects of a network operator’s assessment obligation, assessment standards and reporting procedures. They also introduce specific requirements for contracts between personal data transferors and overseas recipients, and protective measures to be adopted by PRC authorities.
The Measures require that network operators should perform a security assessment and report it to the competent PRC authority if they intend to transfer personal data to overseas parties. In addition, the Measures specify that, where personal data is collected by foreign network operators during business operations, their domestic representative or domestic entities are to perform such assessment obligations.
The PRC Cybersecurity Law introduced the concept of “critical information infrastructure” (CII) in key industrial sectors of China. It requires that CII operators go through a security assessment procedure and report to the relevant competent PRC authorities if they intend to transfer personal data on important data abroad. The Measures seem to extend these requirements to certain non-CII operators. As such, this Measures, if implemented as they stand today, will potentially conflict with the data localisation requirements set out in the Cybersecurity Law.
The Measures stipulate that, prior to any cross-border transfer of personal data, network operators should disclose their security assessments to their respective provincial-level cyberspace authorities. Network operators should also disclose to the authorities any contracts with overseas recipients of personal data, as well as analytical reports concerning security risks and safeguards in relation to personal data.
The Measures provide that standards in relation to a security assessment should focus on the following items
Under the Measures the following items should be clearly provided for in the contract between the network operator (as the data transferor) and the overseas recipient
The Measures give PRC cyberspace authorities the power to take steps to suspend or cease transfers of personal data to overseas parties if
Once implemented, the Measures will no doubt have a major impact on the data compliance activities of network operators, which are defined widely to include companies in all industry sectors who use the internet or networks to do business in China. Accordingly network operators who collect personal data should prepare themselves for the assessment and reporting procedures. In addition, network operators may need to revisit their current contracts with data recipients in order to address all the requirements under the Measures.
Although the Measures represent important legislative progress in relation to the data privacy regime in China, they still leave some significant areas to be clarified. For example, key issues such as how to resolve the potential conflict between the Measures and the Cybersecurity Law in relation to the requirements for personal data localisation still needs to be clarified.
Given that the Measures are still in draft form, they may be subject to further modification before they are finalised. As a legal team specialising on PRC data compliance, we will keep monitoring changes in relation to the draft Measures and issue updates if necessary.
Publication
As expected, the Australian Commonwealth Treasury released an exposure draft for the proposed new Australian merger regime on 24 July 2024.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023