When companies fail to comply with the 2017 Cybersecurity Law, they are subject to 100,000 to 1,000,000 RMB (US$14,351 - $143,517) in fines.<sup>150</sup> While the Cybersecurity Law, like the GDPR and to a certain degree the CCPA, applies to businesses and organizations in all industries, several sectors in the private sector have additional requirements regarding data protection and privacy.<sup>151</sup> Within the life sciences industry, China focuses most of its regulation efforts on localizing health care data and scientific research to protect against illicit cross-border transfers of data through legislation such as the Measures for the Management of Scientific Data and the Measures for the Management of Population Health Information.<sup>152</sup> According to Dentons, health care companies comply with the Cybersecurity Law by categorizing its circulated data, developing protection policies, and localizing servers storing this information.<sup>153</sup> The People’s Bank of China led regulatory efforts within the financial industry by publishing the Implementation Measures for Protecting Financial Consumers' Rights and Interests in December of 2019 and bringing into effect the Personal Financial Information Protection Technical Specification in February, 2020.<sup>154</sup> The government published the National Standards on Information Security Technology in March 2020 and they came into force in October 2020.<sup>155</sup> These regulations focus on protecting consumer financial information and aim to crack down on illegal crawler technology.<sup>156</sup> Companies in the financial industry are advised to construct a sound security system by encrypting data and ensuring adequate access controls, and are encouraged to justify the purpose, method and scope of the data collection.<sup>157</sup> The Information Security Technology Personal Information Security Specification governs the E-Commerce industry, including regulations on how companies may obtain consent from customers and store their respective data.<sup>158</sup> Online retail stores are advised to require clear and affirmative consent from customers when collecting personal information, anonymize personal data, have clearly written contracts with suppliers, and prepare a data breach response plan.<sup>159</sup> III. Costs of Public Enforcement How much does it cost to enforce privacy regulations? We examine this question by analyzing the budgets of the agencies tasked with enforcing data privacy law in Europe, the United States, and China.

This section aims to identify the financial and employee resources available to the regulators and compare it with the enforcement actions undertaken by the respective regulators. Both the EU and the US agencies regularly publish this information on an annual basis. While China has in the last two years actively enforced data security and privacy rules, we could not locate information on the budgets for the various Chinese regulators engaged with data privacy enforcement.

China’s data protection regime is the newest of the three major global privacy regimes. Unlike the GDPR and the US regulations, the Chinese data protection regime does not have a single regulator.

> 150 Kpmg China, Wanglu Anquanfa Gailan (网路安全法概 览 ) [An Overview of China’s Cybersecurity Law] at 6 (2017).

> 151 Dai & Deng, _supra_ note 42, at 23.

> 152 _Id._ at 24-25.

> 153 _Id._ at 25.

> 154 Bird & Bird, _supra_ note 34.

> 155 _Id._

> 156 Dai & Deng, _supra_ note 42, at 26.

> 157 _Id._ at 27.

> 158 _Id._ at 28-29.

> 159 _Id._ at 29.

27