On 13 June 2019, the Cyberspace Administration of China (CAC) released a new draft of proposed measures on the security assessment for the export of personal information, two years after the previous draft was released. The 2019 version of the draft Measures on Security Assessment of Personal Information Export (2019 Draft Measures) fundamentally changes the proposed regulatory regime on personal information export from that proposed in the 2017 draft. If enacted, the 2019 Draft Measures will have a significant impact on the way that personal information export is regulated and will increase the compliance burden for both domestic and overseas companies that collect personal data information from China.
The 2019 Draft Measures mark a major change of the approach taken by the CAC in regulating the export of personal information. They regulate the export of personal information with the export of important data to be regulated by a separate regime. Although the 2019 Draft Measures do not expressively require all personal information to be stored in China (as was proposed in the very first draft in 2017), they achieve a similar effect given that personal information will not be permitted to be exported without completing the mandatory government evaluation. The CAC is seeking to replace the regime primarily based on the self-assessment in the 2017 Draft Measures with one based on mandatory governmental assessment and pre-approval and to insert certain mandatory items in the Export Contract as a tool to impose data protection obligations on overseas receivers.
The changes, if enacted, will dramatically increase the administrative burden for the government as well as the compliance workload and cost for domestic and overseas companies that collect personal information from China. In addition, there will be judicial and practical challenges to enforcing the Export Contract without a clear opinion being given by the judiciary. The applicability of the 2019 Draft Measures to overseas personal information collectors and the role of representatives remain to be clarified by the CAC. We hope the next draft of the regulations will address these issues, which will be vital for their successful implementation.