Source: http://ecovis-beijing.com/en/blog-en/articles/864-new-draft-introduces-security-review-for-cross-border-data-exports
Timestamp: 2017-06-28 06:55:05
Document Index: 245801720

Matched Legal Cases: ['Art. 17', 'Art. 9', 'Art. 10', 'Art. 12', 'Art. 8', 'Art. 9', 'Art. 10']

New Draft Introduces Security Review for Cross-Border Data Exports
HomeAbout UsNewsArticlesInterviewsServicesAccountingAuditingTax LegalTeamDownloadsBrochuresWebinarsContact UsEventsCareersU-Start Contest New Draft Introduces Security Review for Cross-Border Data Exports
Written by Richard Hoffmann	Published: 12 April 2017	On 11 April 2017, China’s Cyberspace Administration (CAC) published the draft of a new regulation called Measures for the Security Review of Cross-Border Transfers of Individual and Important Data (chin. 个人信息和重要数据出境安全评估办法).
The draft is based on the new Cyber Security Law and China’s National Security Law, which were passed in 2016 and 2015 respectively. It forms the legal basis for a security assessment for data transfers out of China by internet operators. These include internet providers, administrators and online service providers (Art. 17).
For which data do I need a security review?
Art. 9 of the draft states that a security review is mandatory for data transfers meeting the following conditions:
Data includes personal information of more than 500 000 persons
Data volume exceeds 1000 GB
Data includes information on sensitive areas, such as nuclear facilities, chemical and biological specimens, population health data, large engineering projects, marine
environment, and sensitive geospatial data.
Data on cyber security leaks and security related data breaches
Other data related to national security, public welfare, or industrial management
What must data not be transferred out of China?
The following data must not leave China (Art. 10):
Individual information which can harm personal interests or has not received the approval by the concerned person
Information, which can pose a risk to the political, economic, scientific, or military security or to the public interest
Other information as defined by security organs
Who carries out the assessment
According to the current text, the operators are required to conduct their own security review at least once a year (Art. 12). The assessment report should include the following information (Art. 8):
Reason for the cross-border transfer
Nature of individual data, including quantity, scope, type, grade of sensitivity, approval of persons concerned
Nature of important data, including quantity, scope, type, grade of sensitivity
Safety standards of recipient and safety environment of receiver country
Risk evaluation of possible leakage, data corruption, falsification or abuse after transfer
Risk evaluation with regard to national security, public interest, or individual rights
If the assessment is mandatory (see Art. 9), the assessment has to be submitted to the relevant industry or control agencies, which have to deliver their feedback within 60 working days (Art. 10).
The draft is open for public comments until 11 May 2017 . Remarks and opinions can be sent to the following e-mail (This email address is being protected from spambots. You need JavaScript enabled to view it.
) or to: