Top Qs
Timeline
Chat
Perspective
Data Security Law of the People's Republic of China
From Wikipedia, the free encyclopedia
Remove ads
The Data Security Law of the People's Republic of China (Chinese: 中华人民共和国数据安全法; pinyin: Zhōnghuá rénmín gònghéguó shùjù ānquán fǎ; referred to as the Data Security Law or DSL) governs the creation, use, storage, transfer, and exploitation of data within China. The law is seen to be primarily targeted at technology companies which have grown increasingly powerful in China over the years.[1] The law is part of a series of interlocking but related national security legislation including the National Security Law of the People's Republic of China, Cybersecurity Law and National Intelligence Law, passed during Xi Jinping's administration as part of efforts to strengthen national security.[2][3]
.svg)
Remove ads
Background
In 2018, the United States adopted the CLOUD Act, which allows United States law enforcement to obtain data stored by United States-based companies outside of the United States.[4]: 248 Numerous countries responded with measures to keep data located in their own borders.[4]: 248 In China, the Data Security Law was part of the response to the extraterritorial reach of the CLOUD Act or similar foreign laws.[4]: 250–251
Remove ads
Provisions
Summarize
Perspective
The Data Security Law classifies data into different categories and establishes corresponding levels of protection.[4]: 131 The law protects core data with data localization requirements, and broadly defines core data to include data related to national and economic security, citizens' welfare, significant public interests, and important data.[4]: 250–251 The Data Security Law mandates that data transfer to foreign law enforcement or judicial agencies requires official approval.[4]: 251
In addition, foreign judicial authorities are prohibited from requesting data on Chinese citizens without first seeking permission from Chinese authorities.[5]
Article 36: The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.
On September 28, 2023, the Cyberspace Administration of China (CAC) issued the draft Provisions on the Regulation and Promotion of Cross-Border Data Flows. In the draft, CAC stated no government oversight is needed for data exports if regulators haven't stipulated that it qualifies as “important.”[6][7]
Remove ads
Reactions
Carolyn Bigg of law firms DLA Piper Hong Kong stated that the law represents: “another important piece in the overall data protection regulatory jigsaw in China”, making it: “complex" and "increasingly onerous" for international businesses to navigate through.[1] Chinese technology company stocks fell in reaction to the passing of the law while tech companies such as Meituan, Alibaba and Ant Financial were all placed under regulatory scrutiny prior to its passing. The law is seen to have wide-ranging implications and is seen as another step in the increasing lawfare between China and the United States in areas of trade, intellectual property and national security since the beginning of the US-China trade war which began in 2016.[8]
The German Research Foundation, the Swedish Research Council, and the Swiss National Science Foundation have all avoided co-funding projects in China since the law went into effect in 2021 due to fears of breaching what some consider the law's vaguely defined provisions.[9]
See also
References
Wikiwand - on
Seamless Wikipedia browsing. On steroids.
Remove ads