Thread by @henrysgao

In addition to the anti-sanctions law, China also issued a Data Security Law yesterday, which includes some good news and some not-so-good news.

I will start with the good news:

1. The law explicitly mentions in two provisions that China will safeguard and promote the free flow of data, which is consistent with China’s new position on data flow in the RCEP;

2. China will actively participate in the making of international rules on data security and standards. This is consistent with China’s active participation in the WTO JSI negotiations on e-commerce, which was analyzed extensively in my paper at ssrn.com/abstract=36953….

Now let me turn to the not-so-good news:
1. In most countries, data protection laws focus on personal data. In China, however, there is also the highly ambiguous concept of “important data”, as mentioned in Art. 31 of the Cybersecurity Law.

Now Data Security Law creates yet another type called “core data”, which is more important than important data & subject to the most stringent restrictions. “Core data” includes those on national security, lifeline of national economy, key people's livelihood, public interests.

There seems to be a lot of overlap between "core data" and important data on “critical information infrastructure”, which as I discussed in this paper is a rather vague concept: ssrn.com/abstract=34302…

2. Under Cybersecurity Law, review on data transfer is only required for important data collected and generated by operators of critical information infrastructure.

Under Data Security Law, however, even the transfer of important data collected and generated by other data processors could be subject to security review, subject to the rules to be made by the Cyberspace Administration of China.

3. Data security issues will now be decided and coordinated by the Central National Security Commission of the Chinese Communist Party.