personalize information based on profiling, including targeted advertising.<sup>40</sup> The 2020 Specification provides detailed rules on the obligations of both personal information controllers and the third parties with which they share information. These include responsibilities for conducting security assessments of third parties, monitoring third parties, and disclosing to individuals that a third party will have access to their information.<sup>41</sup> The 2020 Specification also requires the information controller to take immediate action if it learns that a third party with which it has shared data has processed information inappropriately.<sup>42</sup> The 2020 Specification adopts aspects of the GDPR model. The guidance, for example, requires companies that gather large amounts of personal information to appoint a data protection officer (though the Chinese specification is not technically binding). The guidance also imposes duties on data controllers with respect to third parties with whom they share information.

However, distinct differences remain. One of the architects of the 2018 Specification, Yuehong Hong, observes that these rules are “stricter than the U.S., but not as much as the EU.”<sup>43</sup> For example, unlike the EU, where consent must be explicit, the Chinese interpretation of consent seems to permit implied consent, at least for non-sensitive personal information.<sup>44</sup> The right to port your data from one online service provider to another, while broad under the GDPR, is limited by the 2018 Specification only to an individual’s basic information, as well as health, psychological, education and work information.<sup>45</sup> Yet at certain other points, the Chinese law, at least on its face, can be even more demanding than the EU law. For example, the Cybersecurity Law seems to make consent the exclusive basis for information collection, unlike EU law which allows a variety of bases for collecting personal information, including a category of “legitimate interests.”<sup>46</sup> A draft proposal from the Cyberspace Administration of China would require network operators to inform “the local cyberspace administration when they collect important data or sensitive personal information;”<sup>47</sup> this would enhance the ability to regulate for security-related goals.

Security is also a key motivation for other aspects of the data regime. In comparison to the US’s all-permissive approach to cross-border data flow and the EU’s careful control on outward flows of personal data, China has moved towards highly restrictive policies to keep data within its own borders.<sup>48</sup> On June 13, 2019, China released a draft regulation on the outbound transfers of personal information, separating its treatment of “important data” and “personal information,” which it had previously categorized under one umbrella.<sup>49</sup> With regards to the outbound transfer of personal information, the 2019 draft permits domestic network operators to enter into contractual agreements with foreign data receivers to allow for the transfer of personal data.<sup>50</sup> In order to transfer or access personal data outside the China, data controllers must (1) inform the data subject of the overseas transfer, (2) obtain express consent from the data subject, (3) store a copy of the data within China, (4) conduct a security assessment and file this with the local CAC, 5) establish data transfer agreements with overseas data receivers, 6) submit an annual report to the CAC on all related data transfers, 7) keep a record of all cross-border data transfers for a minimum of five years and 8) to appoint an officer

> 40 Hogan Lovells, _supra_ note 39, at 4.

> 41 Sheng & Xu, _supra_ note 32.

> 42 Hogan Lovells, _supra_ note 39, at 6.

> 43 Pernot-Leplay, _supra_ note 28, at 82, n. 150 and accompanying text.

> 44 _Id_ . at 84. The proposed amendments to the Standard also make provision for implied consent.

> 45 _Id_ . at 101.

> 46 GDPR art. 6.

> 47 Ken Dai & Jet Deng, _2019 China Data Protection Cybersecurity Annual Report_ (Dentons 2020).

> 48 Richard D. Taylor, _“Data Localization”: The Internet in Balance_ , 44 J. TELECOMM. POL’Y at 8 (2020).

> 49 The Diplomat, _China’s New Data Protection Scheme_ (July 2019), <u>https://thediplomat.com/2019/07/chinasnew-data-protection-scheme/.</u>

> 50 Taylor at 8.

8