half or more of their revenue from selling consumers’ personal information. Because many businesses in the United States (and elsewhere) meet this threshold, the CCPA effectively governs most multinational corporations (wherever they are based) that serve the United States.<sup>26</sup> The CCPA requires businesses to disclose the types and sources of personal data the business collects from customers, while granting California residents the right to access and delete personal information. The CCPA thus relies on a notice and consent model. The CCPA is principally enforced by California’s Attorney General. These rights include the right to be notified about what personal information is collected and to opt out of the sale of that information.

C. Compliance under the Chinese Data Privacy Regime China’s data privacy regime is the newest of the three jurisdictions described here. It is best understood against the backdrop of China’s development as a leading technological power that has simultaneously sought to maintain strong government control and public order. China’s approach reflects a now nearly decade-old “national strategy to embrace ‘big data.’”<sup>27</sup> With its data protection laws, China has embraced three goals simultaneously—to protect citizens’ lawful interests, to protect networked information security, and to protect national security and public order.<sup>28</sup> A fourth goal, the promotion of China’s technological advancement, has also been a key consideration in its implementation of data protection laws.

State security has been a focus of Chinese data policy from the start. The Golden Shield— nicknamed “the Great Firewall of China”—sought to ensure that the internet would not be used to disseminate information that might threaten public order and might even be used to create “an ennobling space where netizens complete their transformation into perfect citizens.”<sup>29</sup> Typically, data protection policies are focused on the protection of the data of individuals and not at the promotion of state interests. However, data protection policies by their nature expand regulatory control over the activities of private companies and individuals, paving the way for China to operate its web and flow of data under the model of a cyber-sovereignty.<sup>30</sup> By focusing on state security, China prefers to implement regulations such as data localization laws to keep all its information within its borders, which enhances its ability to monitor and regulate information.<sup>31</sup> In 2016, the Cyberspace Administration of China (CAC) issued Administrative Rules on Information Services via Mobile Internet Applications (the App Rules), seeking to directly regulate China’s burgeoning app industry. These rules require app providers to obtain any necessary licenses or qualifications required of information services, make clear the nature and scope of data collection and use, and obtain consent from users before using location, address book, and camera features. App providers are also required to register the real names of their users, alongside information content

> 26 See Anupam Chander, Margot Kaminski, & William McGeveran, _Catalyzing Privacy Law_ , <mark>MINN. L. REV</mark> (forthcoming 2021).

> 27 Jinting Deng, _Should the Common Law System Welcome Artificial Intelligence_ : A Case Study of China's SameType Case Reference System, 3 GEO. L. TECH. REV. 223, 229 (2019). As Lu Chuanying, a scholar with the Shanghai Institutes for International Studies, describes, China has become a “leading data power ( 数据大国 ) on a global scale.” Graham Webster & Rogier Creemers, _A Chinese Scholar Outlines Stakes for New 'Personal Information'_ - _and 'Data Security' Laws,_ New America (May 28, 2020), <u>https://www.newamerica.org/cybersecurity initiative/digichina/blog/chinese-scholar-outlines-stakes-new-personal-information-and-data-security-lawstranslation/.</u>

> 28 Emmanuel Pernot-Leplay, _China's Approach on Data Privacy Law: A Third Way Between the U.S. and the E.U.?_ , 8 PENN. ST. J.L. & INT’L AFF. 49, 69 (2020).

> 29 Lorand Laskai, _Nailing Jello to a Wall_ , in CONTROL 191 (ed. Jane Golley et al.).

> 30 _Id._ at 197.

> 31 Pernot-Leplay, _supra_ note 28, at 104.

6