![Global rules on foreign direct investment](https://www.nortonrosefulbright.com/-/media/images/nrf/nrfweb/knowledge/publications/us_24355_legal-update--fdi-alert.jpeg?w=265&revision=a5124a65-abf9-40e4-8e96-9df39ffdb212&revision=5250068427347387904&hash=96B456347C3246E5649838DF281C5F5D)
Publication
Global rules on foreign direct investment (FDI)
Cross-border acquisitions and investments increasingly trigger foreign direct investment (FDI) screening requirements.
Global | Publication | March 2017
China’s guidance on privacy of personal data is set to change in the near future, following the publication of a draft guideline in late 2016. Though a date has not yet been set for the guideline to be finalised, companies should take the opportunity to assess whether they will need to make changes to their systems and processes to bring them in line with the guidance as currently set out.
The draft guideline document, “Information Security Technology - Personal Data Security Specification”
(“Guideline”), issued by the National Information Security Standardisation Technical Committee, is the most comprehensive statement on the protection of personal data issued by the Chinese government to date.
Although the Guideline will not be mandatory or legally binding, once finalised and adopted it may serve as best practice in relation to the protection of personal data in China, and is likely to become a major reference document for Chinese authorities wishing to implement cyber security laws and regulations. It may also indicate the future direction of China’s legislation in this area.
In this briefing, we outline the key aspects of the draft Guideline and discuss the implications for businesses in China.
Unlike Chapter Four (Network Information Security) of the Cyber Security Law of China (which applies only to network operators), the draft Guideline applies to all types of entities in China using information systems to process personal data (including public institutions and companies, etc).
However, the draft Guideline does not apply to entities which have less than ten employees or less than RMB 1 million in revenue and process personal data of no more than 10,000 individuals in any consecutive twelve month period. In addition, the draft Guideline governs the entire life cycle of personal data, including the collection, storage, use, transfer, and disclosure of personal data.
The definition of “Personal Data” in the draft Guideline is similar to that in the Cyber Security Law, except that it explicitly includes biological identification data, behavioral data and geological location. Examples of “Personal Data” generally include:
Crucially, the Guideline provides a definition of “Personal Sensitive Data” that has not been defined elsewhere in Chinese laws and regulations. “Personal Sensitive Data” is defined as “data that may lead to bodily harm, property damage, reputational harm, harm to personal heath, or discriminative treatment of an individual if such data is disclosed, leaked or abused.”
Examples of “Personal Sensitive Data” include:
As the examples are not exhaustive, the Guideline provides detailed criteria for determining when data is “Personal Sensitive Data”. Such criteria mainly focus on the risk of harm should there be any disclosure, leak or abuse of personal data.
By providing general definitions, specific examples and detailed criteria, the Guideline helps data controllers (that is, entities or individuals who determine the purposes and methods of personal data processing) to identify “Personal Data” and “Personal Sensitive Data” with more certainty.
The draft Guideline imposes various specific obligations on data controllers which are in line with the provisions of the Cyber Security Law. Some of the significant obligations include the following:
The draft Guideline explicitly provides that data controllers shall be responsible for the security of the personal data they hold, regardless of how the data was obtained. Accordingly, the Guideline outlines a risk management framework that data controllers should follow. Under such framework, a data controller shall:
The draft Guideline also outlines an emergency disposal and reporting framework. It requires data controllers to develop emergency response plans for any personal data security incidents. Data controllers should provide regular training and exercises to the relevant staff (at least once a year). If a data security incident occurs, a data controller shall:
In addition to the general requirements in Chapter Four of the Cyber Security Law, the draft Guideline specifically requires that express consent (rather than implied consent) must be obtained from data subjects for the collection of personal sensitive data. It also provides that special reminders should be given for the collection of information relating to personal IDs, passports and driving licences. If a data controller intends to modify the purpose, method and scope of data processing, the Guideline provides that it shall first obtain the consent from data subjects in order to do so.
The draft Guideline requires personal data controllers to limit the amount of collected data to what is necessary to accomplish a purpose that has been specified to data subjects. Similarly, the storage period of personal data should be minimised. Upon expiration of the storage period, data controllers shall promptly delete or anonymise the personal data. Personal sensitive data shall be stored only after it has been encrypted. Subject to the purpose of data processing, anonymisation and pseudonymisation of personal data may be used in order to mitigate security risks. The Guideline recommends that data controllers should immediately pseudonymise any personal data they receive.
The Guideline requires data controllers to provide data subjects, in respect of the processing of their data, with methods to:
If the data controller authorises a third party (e.g. a data processing service provider) to process personal data, the data controller should conduct a data security assessment or an audit on such third party, and request from it a data security risk assessment report and information concerning other necessary qualifications.
The draft Guideline generally prohibits the transfer or disclosure of personal data unless certain pre-conditions are fulfilled.
For example:
If a data security incident in connection with a transferee (that is, the recipient of the personal data from the original data controller) occurs and causes damage to data subjects, the transferor (that is, the original data controller) shall assist data subjects in seeking compensation from the transferee (or itself provide proper compensation to data subjects).
However, it remains unclear whether the data subjects are entitled to sue either the transferor or the transferee in case of a data security incident of the transferee and to what extent the transferor should be liable for the damages and losses caused by such incident to the data subjects.
The Guideline has yet to address cross-border transfers of personal data, given the complexities of the issue. In general, this could present challenges for multi-national companies which routinely share personal data with their affiliated companies or third party data processors.
It is also important to note that, under the draft Guideline, if a data controller is merged with or is acquired by a third party, engages in reorganisation or undergoes a change of control, a transfer of personal data will be deemed to have occurred. In that case, the data controller must fulfill the relevant pre-conditions before such merger, acquisition, reorganisation or change of control takes effect.
The draft Guideline is one step further for the protection of personal data following the promulgation of the Cyber Security Law in November 2016. It is a strong indication of the Chinese government’s intention to strengthen the protection of personal data. Although the Guideline is marked as “GB/T” (which stands for “Recommended National Guideline” in Chinese), and may be adopted by businesses on a voluntary basis, the Guideline is likely to serve as “quasi-implementing rules” in respect of the Cyber Security Law in relation to the protection of personal data, and Chinese authorities may regard it as a major reference document to evaluate legal compliance of businesses.
Once finalised and adopted, the Guideline could present compliance challenges for businesses. For example:
We therefore recommend that businesses should carefully study the requirements proposed by the Guideline and review their current data protection policies in order to ensure compliance with best practice for the protection of personal data in China.
As the draft Guideline is subject to further revision and adoption, we will continue to monitor the situation and provide updates on significant developments.
Publication
Cross-border acquisitions and investments increasingly trigger foreign direct investment (FDI) screening requirements.
Publication
Artificial intelligence (AI) raises many intellectual property (IP) issues.
Publication
We are delighted to announce that Al Hounsell, Director of Strategic Innovation & Legal Design based in our Toronto office, has been named 'Innovative Leader of the Year' at the International Legal Technology Association (ILTA) Awards.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023