China Issued the Draft Data Security Law

guest · Jul 4, 2020

China Issued the Draft Data Security Law
July 3, 2020
https://www.insideprivacy.com/data-security/china-issued-the-draft-data-security-law/

On July 2, 2020, the Standing Committee of the National People’s Congress of China (“NPC”) released the draft Data Security Law (“Draft Law”) for public comment.

The release of the Draft Law marks a step forward in establishing a regulatory framework for the protection of broadly defined “data security” in China, with a particular focus on the governance of “important data,” [...]
Many provisions of the Draft Law remain vague and lack guidance on how they might be implemented in practice.

We discuss a few key requirements of the Draft Law in a greater detail below.
Click to expand...

Scope and Geographic Reach
Article 2 states that the Draft Law applies to “data activities” within China, but it also states that organizations and individuals outside of China that conduct data activities which may harm China’s national security, public interests, or the rights of Chinese citizens may be subject to this law.
Data Security Obligations on Entities Carrying out “Data Activities”
Entities that carry out data activities shall establish a system to ensure data security, which includes training personnel and other technical measures.

Remedial measures shall be implemented immediately when vulnerabilities are discovered, and users and the regulator shall be notified of any data security incidents.
[...] overlap with requirements related to important data under the draft Measures for Data Security Management (“Draft Measures”) [...] (see our previous blog post here for a summary of the Draft Measures).
Click to expand...

guest · Jul 4, 2020

Chinese law may require companies to disclose cyber-security preparations outside China
July 3, 2020
https://www.computerweekly.com/news...ose-cyber-security-preparations-outside-China

Companies with operations in China could come under greater pressure to have their cyber security preparations reviewed and certified under a draft law expected to be enforced next year.

China’s draft data security law may also require companies to disclose details about network security in their operations outside China.
China aims to protect what it calls “important data” which, if leaked, may directly affect the country’s national security, economic security, social stability or public health.

“China is considering allowing the law to have an extra-territorial effect that we have not seen before,” said Yan Luo, partner in law firm Covington & Burling in Beijing. “They want to counteract the extra-territorial effect of US law.”
Click to expand...

China is expected to go beyond a technical audit of a company’s cyber security and to consider whether, for example, overseas firms are complying with US sanctions that could damage China’s national security.

“It’s not just a technical review of what protections you have put in place, it could be political elements,” said Luo.
It is not clear how China would take enforcement action against an organisation outside its borders that is deemed to be damaging the country’s national security.

The draft law covers data that may be important to critical industries, but excludes personal data on individuals, military information or state secrets.
Click to expand...

Log in or Sign up

China Issued the Draft Data Security Law

guest Guest

guest Guest

Log in or Sign up

China Issued the Draft Data Security Law

guest Guest

guest Guest

Useful Searches