I. Introduction

Data security is an important component of national security. Cross-border transfer of data not only concerns the security of personal information, but also national security and social public interests. On July 7, 2022, the Cyberspace Administration of China published the Measures for Security Assessment of Cross-border Data Transfer (hereinafter referred to as the "Assessment Measures"), which took effect on September 1, 2022. The promulgation of the Assessment Measures aims to implement the relevant provisions on cross-border data transfer in the Cybersecurity Law, Data Security Law, and Personal Information Protection Law, regulate cross-border data transfer activities, protect personal information rights and interests, maintain national security and social public interests, and promote secure and free cross-border flow of data. This article provides an interpretation of the Assessment Measures from the perspective of enterprises.

II. Legal Provisions

The Assessment Measures explicitly state that the security assessment of important data and personal information collected and generated in the course of operating within the territory of the People's Republic of China when provided to overseas recipients shall be governed by these Measures. The Assessment Measures also specify the circumstances under which data cross-border security assessment shall be declared, as well as the specific requirements, assessment procedures, supervision and management systems, legal liabilities, and compliance rectification requirements for data cross-border security assessment.

The following will interpret the legal provisions from three aspects: scope of application, circumstances of data cross-border transfer, and security assessment of data cross-border transfer.

1.Scope of Application

According to the relevant provisions of the Assessment Measures[①], in any of the following four circumstances, data security assessment shall be declared to the national cyberspace authority through the provincial-level cyberspace authority at the location of the data processor:

(1) Data processors provide important data to overseas recipients;

Important data generally refers to data that, once tampered with, destroyed, leaked, or unlawfully obtained, utilized, etc., may endanger national security, economic operation, social stability, public health and safety, etc. However, the Data Security Law specifies that the catalog of important data shall be determined by various regions and departments. Therefore, enterprises in different industries need to determine the important data subject to security assessment based on the regulations of the relevant departments at their location and in their industry.

(2) Critical information infrastructure operators and data processors processing personal information of more than one million individuals provide personal information to overseas recipients;

(3) Data processors who have cumulatively provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals to overseas recipients since January 1 of the previous year provide personal information to overseas recipients;

(4) Other circumstances stipulated by the national cyberspace authority that require declaration of data cross-border security assessment.

The key points include the identification of important data, identification of critical information infrastructure operators, and identification of sensitive personal information.

ØImportant Data

Generally refers to data that, once tampered with, destroyed, leaked, or unlawfully obtained, utilized, etc., may endanger national security, economic operation, social stability, public health and safety, etc. However, the Data Security Law specifies that the catalog of important data shall be determined by various regions and departments[②]. Therefore, enterprises in different industries need to determine the important data subject to security assessment based on the regulations of the relevant departments at their location and in their industry.

ØCritical Information Infrastructure Operators

According to the relevant provisions of the Regulations on Security Protection of Critical Information Infrastructure, the competent departments and supervisory management departments of important industries and fields, as the departments responsible for security protection work, are responsible for identifying operators and shall promptly notify the operators of the identification results[③]. Therefore, if an enterprise receives notification from the security protection work department, the enterprise is a critical information infrastructure operator.

ØSensitive Personal Information

The identification of sensitive personal information can be made based on the relevant definitions of sensitive personal information in the Personal Information Protection Law[④]. At the same time, reference can be made to the personal sensitive information enumerated in the Information Security Technology - Personal Information Security Specification, such as personal property information, personal health and physiological information, personal biometric information, personal identity information, etc. Sensitive personal information should also be identified based on the scenario in which it is used.

2.Circumstances of Data Cross-border Transfer

According to the Q&A on the Assessment Measures, data cross-border transfer activities mainly include: First, data processors transmit and store data collected and generated during domestic operations to overseas locations. Second, data collected and generated by data processors is stored domestically, but overseas institutions, organizations, or individuals can access or use it.

At the same time, according to the relevant provisions of the Cybersecurity Review Measures, Data Security Law, Personal Information Protection Law, and Cybersecurity Law[⑤], the specific circumstances of data cross-border transfer mainly include: (1) Overseas listing; (2) Overseas judicial or law enforcement agencies requesting data; (3) Overseas entities collecting domestic information; (4) Providing data to overseas recipients; (5) Other circumstances of data cross-border transfer.

III. Practice of Data Cross-border Security Assessment

1.Process of Data Cross-border Security Assessment

According to the relevant provisions of the Assessment Measures[⑥], after confirming that the cross-border data transfer meets the scope of application of the Assessment Measures, an enterprise should first conduct a self-assessment of data cross-border risks. Key assessment items include:

(1) The legality, legitimacy, and necessity of the purpose, scope, and method of data cross-border transfer and the overseas recipient's processing of data;

(2) The scale, scope, types, and sensitivity of data to be transferred, and the risks that data cross-border transfer may bring to national security, public interests, or the legitimate rights and interests of individuals or organizations;

(3) Whether the overseas recipient's commitments to assume responsibilities and obligations, and whether its management, technical measures, and capabilities to fulfill responsibilities and obligations can ensure the security of transferred data;

(4) The risks of data being tampered with, destroyed, leaked, lost, transferred, or unlawfully obtained or utilized during or after cross-border transfer, and whether channels for protecting personal information rights are smooth;

(5) Whether the contracts or other legally binding documents (hereinafter collectively referred to as legal documents) to be concluded with the overseas recipient regarding data cross-border transfer adequately stipulate data security protection responsibilities and obligations;

(6) Other matters that may affect data cross-border security.

After completing the self-assessment, the enterprise shall submit application materials to the provincial-level cyberspace authority, which shall complete the completeness review within 5 working days from receiving the application materials. If the application materials are complete, they shall be forwarded to the national cyberspace authority; if the application materials are incomplete, they shall be returned to the data processor with a one-time notification of materials to be supplemented. The national cyberspace authority shall, within 7 working days from receiving the application materials, decide whether to accept the application and notify the data processor in writing[⑦].

During the security assessment, if the application materials submitted by the data processor do not meet the requirements, the national cyberspace authority may require supplementation or correction. If the data processor fails to supplement or correct without justified reasons, the national cyberspace authority may terminate the security assessment. The national cyberspace authority shall complete the security assessment within 45 working days after acceptance; if the situation is complex or materials need to be supplemented or corrected, the period will be extended and the data processor will be informed of the expected extended time[⑧].

The validity period of data cross-border security assessment results is 2 years. If the data processor disagrees with the assessment results, it may apply for reassessment to the national cyberspace authority within 15 working days of receiving the assessment results. If the validity period expires but it is necessary to continue data cross-border transfer activities, the enterprise shall re-apply for assessment 60 working days before the expiration of the validity period[⑨].

2.Application Materials for Data Cross-border Security Assessment

According to the relevant provisions of the Assessment Measures[⑩], to apply for data cross-border security assessment, the following materials shall be submitted:

(1) Application form (including commitment letter and application form);

(2) Data cross-border risk self-assessment report (to be completed within three months before the application);

(3) Legal documents to be concluded between the data processor and the overseas recipient (can be contracts, company internal rules, etc.);

(4) Other materials required for security assessment work (materials to support the above three materials).

IV. Conclusion

Through the above interpretation of the Assessment Measures, it can be seen that the data cross-border security assessment work has been standardized and proceduralized. Related enterprises should plan ahead for security assessment when conducting cross-border data transfer, and strengthen their own supervision to achieve compliance status, so as not to affect normal operations. The Assessment Measures protect not only the security of personal information, but also national security and social public interests.

[①]Article 4 of the Measures for Security Assessment of Cross-border Data Transfer

[②]Paragraphs 1 and 3 of Article 21 of the Data Security Law of the People's Republic of China

[③]Article 8 of the Regulations on Security Protection of Critical Information Infrastructure

[④]Article 28 of the Personal Information Protection Law of the People's Republic of China

[⑤]Article 7 of the Cybersecurity Review Measures; Article 36 of the Data Security Law of the People's Republic of China; Paragraph 2 of Article 3 of the Personal Information Protection Law of the People's Republic of China

[⑥]Article 5 of the Measures for Security Assessment of Cross-border Data Transfer

[⑦]Article 7 of the Measures for Security Assessment of Cross-border Data Transfer

[⑧]Articles 11 and 12 of the Measures for Security Assessment of Cross-border Data Transfer

[⑨]Articles 13 and 14 of the Measures for Security Assessment of Cross-border Data Transfer

[⑩]Article 6 of the Measures for Security Assessment of Cross-border Data Transfer