China Launches “Standard Contract Clauses” Regime for the Export of Personal Information

On 30 May 2023, the Cyberspace Administration of China (together with its local counterparts, the CAC) issued the Guideline to the Filing of the Standard Contract for Outbound Transfer of Personal Information (First Edition) (the Guideline) which took immediate effect. The Guideline aims to guide and help personal information (PI) handlers to file the standard contract clauses (the SCCs) for PI export pursuant to the Measures on the Standard Contract for Outbound Transfer of Personal Information (the SCCs Rule) which took effect on and from 1 June 2023.

As one of the three regimes for PI export, the SCCs filing regime is expected to be a more broadly applicable regime compared with the other two more complicated regimes^[1], especially for those Chinese affiliates of multi-national groups which have a necessity to transfer PI abroad.

According to the Guideline, a PI handler shall, within ten working days from the effective date of the SCCs, file the SCCs with the provincial CAC, in writing (both physical and electronic format). The provincial CAC shall, within fifteen working days upon receipt of the materials, complete the review of the materials and notify the PI handler of the filing outcomes (i.e. “pass” or “fail”). In the event of an unsuccessful filing, the relevant PI handler who made the filing will receive a notice of and the reasons for the unsuccessful filing.

Notwithstanding the common perception that a filing is a procedural process, the Guideline explicitly provides that a successful SCCs filing is not guaranteed by the CAC. We therefore cannot rule out the possibility that the CAC will review the submitted materials substantively and provide comments accordingly. The Guideline is also silent on the legal implications or liabilities of any failure to complete the SCCs filing. Pursuant to the SCCs Rule and the Guideline, the SCCs filing can be completed after the SCCs come into effect and the PI export can also be carried out after the SCCs come into force - this means that theoretically speaking, the SCCs filing is neither a pre-condition of the validity of the SCCs nor a prerequisite of the PI export.

Given that the SCCs Rule and Guideline have prescribed the content of the SCCs which should be strictly adhered to, it is expected that strict adherence to the SCCs with limited supplemental provisions will largely increase the certainty for the PI handlers to obtain a successful SCCs filing. Therefore, the PI handlers should pay close attention and adhere to the SCCs filing requirements. We cannot rule out the possibility that if the PI handler fails to successfully lodge the SCCs filing, the CAC may in practice require the PI handler to suspend its prior PI export.

The SCCs Rule also provide a 6-month grace period for PI handlers to rectify their activities, meaning that the PI handlers should complete the SCCs filing before 30 November 2023. It is also worth noting that the Guideline requires PI handlers to complete the PI protection impact assessment within a 3- month period prior to the SCCs filing. It is therefore advisable for PI handlers to start preparatory work for the SCCs filing as soon as possible and seek professional legal advice where needed at an early stage of the process to secure a timely and successfully SCCs filing and PI export.