Opinion | Easier cross-border data transfers back up China’s business-friendly messaging with practical change
- Allowing the resumption of cross-border data transfers in day-to-day business shows pragmatism can still prevail in Chinese policymaking
- The regulatory ambiguity of requiring a cybersecurity review for almost any data generated in China was paralysing for the business community
China has been building up a comprehensive and strict data regulatory framework over the last couple of years. With these rules, intended to ensure sufficient state oversight of cross-border data transfers, regulators have rushed to translate Beijing’s strategic security concerns into articulated rules that individuals and businesses must follow.
The impact of this move has been clear: with one law drafted after another, the state gradually increased its power over data with sometimes vague legislation, leaving government agencies to sort out the details of enforcement. Yet not even the administrative state has ironed everything out, leaving business executives and corporate lawyers scratching heads over what is allowed.
Some believe that new data rules are intentionally vague to give arbitrary power to regulators through impromptu implementation. More realistically, a sense of national emergency pushed Chinese regulators to rush new regulations before having a clear idea of how the rules could be implemented.
In this haste to plug loopholes or address potential security threats, business interests are often not fully considered – and sometimes they are sacrificed.
Another important regulation came into effect in September 2022, requiring that the export of “important data” and personal information go through a security review, again adding to business uncertainty.
