Written by Rebecca LUO

  

As the end of 2022 approaches, regulations related to data transfer released in China this year are worthy of attention or taking a look-back for multinational companies investing in China and companies involved in cross-border business. It has been more and more significant for companies to keep abreast of data compliance trends so as to comply with data compliance related policies and regulations in PRC.

In order to regulate the transfer of personal information outside of China, protect the personal information, as well as promote the safe and free flow of cross-border personal information, the Cyberspace Administration of China (“CAC”) released the Standard Contract Provisions for the Export of Personal Information (Draft for Comment) (“Standard Contract Provisions Draft”) on June 30, 2022 in accordance with the Personal Information Protection Law of the People's Republic of China (“PIPL”).

Where a personal information processor that enters into an agreement with the overseas recipient to provide personal information outside of China in accordance with Paragraph 1(3), Article 38 of the PIPL, the information processor and the overseas recipient shall sign a standard contract for the export of personal information ("Standard Contract") in accordance with aforesaid Standard Contract Provisions. Other contracts related to the export of personal information and signed by the personal information processor and the overseas recipient shall not conflict with the Standard Contract.

Personal information processors who meet the following conditions at the same time may provide personal information overseas by signing a Standard Contract:

(1) non-critical information infrastructure operators;

(2) handling personal information of less than 1 million people;

(3) since January 1 of the previous year, the accumulated amount of personal information provided overseas is less than 100,000 people;

(4) since January 1 of the previous year, the accumulative number of sensitive personal information provided overseas is less than 10,000 people.

At the same time, the Standard Contract Provisions Draft stipulates that personal information processors should conduct an impact assessment of personal information protection before providing personal information overseas, and lists the main contents that should be included in the Standard Contract and the impact assessment.

It is worth noting that the Standard Contract Provisions Draft introduces something new - the filing obligation: personal information processors should file with the local provincial-level cyberspace administration department within ten (10) working days from the effective date of the Standard Contract by submitting the Standard Contract and Personal Information Protection Impact Assessment Report. Personal information processors can carry out export of the personal information after the Standard Contract takes effect.

It is stated in the Standard Contract Provisions Draft that the personal information processor shall be responsible for the authenticity of the filing materials, while it does not mention the substantive review of the submission materials is required. Such filing requirement is widely understood as that the local provincial-level cyberspace administration department will only conduct formality review of the filing materials, that is, the review tends to be for archiving purpose in preparation of the subsequent supervision, not as an prior administrative approval procedure. However, in view of the fact that the Standard Contract Provisions for the Export of Personal Information have not yet been formally implemented, it is recommended that relevant companies shall continue to pay attention to the details of the subsequent legislative process and filing procedures.

 

Source: http://www.cac.gov.cn/2022-06/30/c_1658205969531631.htm from Cyberspace Administration of China.