to take care of compliance matters with CAC data security requirements.<sup>51</sup> While this technically allows cross-border data flows, the hurdles can be so high that many may find them to complex or expensive to manage.<sup>52</sup> The 2020 Draft Data Security Law addresses “important data,” which must be kept strictly local. “Important data” relates to China’s national, economic and public security as well as social stability.<sup>53</sup> The 2020 draft seeks to establish a system to monitor and warn of security data leaks, an emergency response system to handle security leak accidents, and a national security review system to investigate activities that may pose security threats.<sup>54</sup> Other guidelines such as the 2020 Personal Financial Information Protection Technical Specification issued by the People’s Bank of China also govern the cross-border transfer of financial information and more specialized forms of data.<sup>55</sup> Neither the 2019 Personal Information Outbound Transfer Security Assessment Draft nor the 2020 Draft Data Security Law nor the 2020 Personal Financial Information Protection Technical Specification is yet binding law. While the 2017 Cybersecurity Law is binding, its laws are vaguely drafted and flexible in terms of interpretation.<sup>56</sup> Even though companies are not bound by law to comply with these guidelines, they are strongly encouraged to implement them to their best ability and treat these guidelines as the direction that the Chinese government intends to move.<sup>57</sup> On July 2, 2020, the National People’s Congress of China published a draft version of the new Data Security Law.<sup>58</sup> The draft law would clearly establish extraterritorial jurisdiction over companies outside China whose data usage harms Chinese national security. The draft also would establish that certain data with national security implications would be subject to export controls.

Practitioners suggested that a key cost of compliance was in setting up privacy management systems, including data mapping. One significant challenge was to change the internal culture to prioritize privacy.

# II. Costs of Private Compliance

The cost for complying with privacy law varies dramatically—from the baker managing a relatively small database of her regular customers’ orders to the 1,000-person company supplying information services to a variety of clients across multiple jurisdictions. In this Part, we summarize a variety of studies on the costs of compliance with respect to data privacy law in the EU and the United States.

The different studies paint vastly different portraits of costs. One study estimates mean expenditure for privacy compliance to be $1 million in 2018, the year the GDPR first went into effect, and $622,000 in 2019.<sup>59</sup> Another study, meanwhile, found an average focused on GDPR compliance

> 51 DLA Piper, _Data Protection Laws of the World Handbook_ 3 (2020), <u>https://www.dlapiperdataprotection.com/index.html?t=about&c=AO</u> at 5.

> 52 _Cf_ . Anupam Chander, _Is Data Localization a Solution for_ Schrems II?, 23 J. INT’L EC. L. 771 (2020), at https://doi.org/10.1093/jiel/jgaa024 (arguing that hurdles for cross-border transfer out of the European Union post judicial rulings may be so burdensome as to effect a ”soft data localization”).

> 53 Yan Luo & Zhijing Yu, _China Issued the Draft Data Security Law_ , INSIDE PRIVACY (2020), <u>https://www.insideprivacy.com/data-security/china-issued-the-draft-data-security-law/.</u>

> 54 _Id._

> 55 Norton Rose Fulbright, _PBOC Issues New Specification on Personal Financial Information_ (March 2020), <u>https://www.nortonrosefulbright.com/en/knowledge/publications/fcdc5f10/pboc-issues-new-specificationon-personal-financial-information.</u>

> 56 Pernot-Leplay, _supra_ note 29, at 49, 74.

> 57 _Id._

> 58 Nick Becket, Amanda Ge & Roxie Meng, _China Publishes Draft Data Security Law_ (CMS, 2020).

> 59 _See infra_ note 69 and accompanying text.

9