Further to the Provisions on Promoting and Regulating Cross-border Data Transmission promulgated by the Cyberspace Administration of China on March 22, 2024 (the CBDT Provisions) which substantially reduce the procedural burden associated with transmitting data out of China, Beijing authorities recently issued the Administrative Measures for the Negative List for Data Export from China (Beijing) Pilot Free Trade Zone (for trial implementation) including a detailed negative list (the Beijing Negative List) on August 30, 2024. The Beijing Negative List aims to further liberalize the transmission of data out of the Beijing pilot free trade zone (FTZ) and provide more clarity on the identification of important data. On top of benefiting existing companies in the Beijing FTZ, the business-friendly tone of the Beijing Negative List seems to be a good reason for companies to revisit their current data export set-up and make the best use of the benefits offered under these new rules. Are these rules indeed creating a substantial difference and a game changer? Dr. Michael Tan and Julian Sun, from Taylor Wessing, take a deep dive into the new measures and FTZ, comparing them with other FTZs in China.
What is new?
Among the various breakthroughs introduced by the Beijing Negative List, several are worth noting:
Quantitative criteria for identification of important data
Identification of important data has long been a critical challenge for international companies operating in sensitive sectors or serving sensitive customers in China. Such difficulty arises from the vague and embracing concept of 'important data' driven by national security and public interest concerns. While there have been some recommendable national standards aimed at facilitating the identification of important data, these regulatory efforts may not match the business sector's expectations for a detailed and easily readable guideline to this effect. Now, at least for large quantities of personal information (PI), the Beijing Negative List offers more clarity by stipulating below quantitative criteria for the identification of important data:
- general PI concerning more than 10 million data subjects;
- sensitive PI concerning more than one million data subjects; and
- particularly sensitive PI (e.g., financial accounts and medical information) or sensitive PI controlled by critical information infrastructure operator (CIIO) concerning more than 100,000 data subjects.
In contrast to the earlier perception that general PI concerning more than one million data subjects may qualify as important data, the Beijing Negative List narrows down the scoping of important data in this aspect by significantly raising the quantitative thresholds. Such a shift indicates the regulator’s attitude to focus on those more sensitive but not so common cases while relieving compliance burdens of many other companies as far as national security and public interest will not be so compromised. This is a very positive move in the regulatory landscape.
Enhanced granularity for important data in specific industries
In addition to the above quantitative criteria applicable across all industries, the Beijing Negative List places a particular emphasis on sectors with a significant presence in the Beijing FTZ, such as automotive, pharmaceutical, civil aviation, retail, modern services, and artificial intelligence (AI) training. It provides more detailed examples of important data relevant to each industry.
For instance, in the automotive sector, the Beijing Negative List reiterates the general categories of important data outlined in the Provisions on Automotive Data Security Management (for Trial Implementation) effective on October 1, 2021 (the Automotive Data Provisions), and further substantiates each category with more detailed data fields. For example, the category of 'operation data of vehicle charging networks' under the Automotive Data Provisions may encompass the location, status, billing, and payment information of charging stations, as well as statistics on vehicle charging or battery swapping and charging station usage. Moreover, the Beijing Negative List introduces new categories, such as key vehicle networking service data, which includes remote vehicle control and operating conditions, along with corresponding detailed data fields that qualify as important data. All such detailed guidance is, without question, very helpful for data classification in practice.
Lifted thresholds for personal information export clearance requirements
Under current national rules, an exporter of PI who is not a CIIO shall, in general, go through the security assessment procedure if it intends to export PI concerning more than one million data subjects or sensitive PI concerning more than 10,000 data subjects. For less sensitive cases (i.e., the exporting of PI concerning 100,000 to one million data subjects or sensitive PI concerning no more than 10,000 data subjects), the exporter shall conclude the Chinese Standard Contractual Clauses (SCCs) as the legal basis for their export activities. However, this general approach has not adequately considered industry-specific factors, resulting in an excessive compliance burden for some PI-rich industries. The Beijing Negative List now further lifts thresholds for specific industries, including specific export scenarios. Affected sectors include pharmaceuticals, civil aviation, retail, modern services, and AI training. For example, in the pharmaceutical industry, the threshold triggering a security assessment for clinical trials and drug development has been increased from 10,000 to 50,000 data subjects. For AI training businesses, the threshold for triggering a security assessment has been raised from 10,000 to 100,000 data subjects. This tailored approach, which was not seen in the pilot efforts of other regions, shows a very positive attempt of the local regulators to put more focus on facilitating cross-border data transmission instead of slowing down such transmission due to the vague concerns over national security and public interest.
A comparative view
Prior to the launch of the Beijing Negative List, regional efforts aimed at facilitating cross-border data transmission from China were already underway in other FTZs, such as the Tianjin FTZ and the Shanghai FTZ. Besides their location-tied-up features, different approaches taken by such regional efforts create different implications.
Similar to the Beijing FTZ, the Tianjin FTZ released its negative list for data export on May 8, 2024. However, this list more or less reiterates existing practices under national regulations. The scope of important data remains ambiguous, and the list has faced criticism for failing to deliver the significant breakthroughs anticipated by the business community. From a practical point of view, the Tianjin FTZ's negative list does not appear to demonstrate a sufficient effort to move things forward.
On the contrary, the Lin-gang Special Area of Shanghai FTZ has adopted a quite different approach by formulating the so-called 'general data list' (which can be understood as a whitelist) to clarify data considered non-sensitive by regulators and thus permitted or even encouraged to be exported. Policymakers in the Shanghai FTZ have also embraced an industry- and scenario-specific approach. Their initial whitelists explicitly address practical data export scenarios, including global research and development (R&D) and testing for intelligently connected vehicles, clinical trials, and R&D for new medicines and medical devices, as well as cross-border management of public fund offerings.
While this approach may seem perplexing given that national-level regulations do not recognize the concept of a whitelist and the associated filing requirements impose additional compliance burdens on companies, a whitelist approach can be a very innovative method for facilitating data export by offering endorsement and even asylum from local regulators and government. There is also criticism and different voices in this aspect, but this approach provides for a quite different perspective compared with the routine expectation on 'full clarity and detail' which is always difficult to achieve in the Chinese environment.
Next steps
As the Beijing Negative List only applies to companies incorporated within the Beijing FTZ, one will need to relocate its seat of business into the Beijing FTZ in order to benefit from the facilitation under this list. One will need to take a more strategic view to assess this topic, including any potential relocation plan, by carefully evaluating the following factors:
- Risk of regulatory reversal: The possibility of a regression in the pilot initiatives cannot be entirely excluded, which equally applies to the piloting attempt in Tianjin and Shanghai. This very much depends on the national level's concern for national security and public interest issues, which could easily weigh over the local Government's attempt to facilitate business by reducing regulatory pressures.
- Potential backfire of detailed data scoping: Granularity under the Beijing Negative List could also backfire, as it reduces the room for flexible interpretation in practice. For example, data now mentioned under those new subcategories will unequivocally qualify as important data, whereas previously, companies might still have tried to find some positive arguments to classify similar data differently under the earlier national regulations. This raises the question of whether a 'more detailed and finer granularity' approach, which does not fully resolve issues of certainty, is preferable to a fully endorsed whitelist approach, as practiced in Shanghai.
Conclusion
The Beijing Negative List signals a positive move toward facilitating cross-border data transfers. However, its practical implications for individual companies remain to be seen. Businesses are advised to check through all existing pilot rules across different locations and align their specific data export needs with the benefits provided under these rules. A customized approach based on an in-depth understanding of the real picture on the ground will be very necessary.
