China cybersecurity rule on exporting of personal information seen raising compliance costs for firms
- Companies have to assess the security implications of exporting personal information outside China and notify cyberspace regulators
- The draft rule, if implemented, should raise the costs of compliance for foreign companies
China has emphasised national security in a draft rule on the export of personal information, a move that would likely drive up the cost of compliance for foreign companies.
Personal information gathered inside China will not be allowed to be transferred across borders if it can “impact national security, damage public interest or is not fully secured”, according to the draft rules published on Thursday by the Cyberspace Administration of China (CAC).
Many countries, including the European Union, also have regulations on cross-border transfer of personal information, though they are formulated mostly to protect the privacy of citizens. Chinese President Xi Jinping has sought to rally support for “cyber sovereignty”, the idea that all countries have the right to regulate the internet within their own borders.
“China is unique in that its pushing this so hard and under many different standards, measures and regulations,” said Nick Marro, Hong Kong-based analyst with The Economist Intelligence Unit. “It’s just that implementation has ended up being a lot more complex. That is why the compliance burden for foreign and Chinese companies is so high.”
The draft rule on the export of personal information is open for public feedback until July 13 and is the third cybersecurity-related regulation published by the CAC since late May. The regulatory move also comes amid the escalating trade war between China and the US, in which national security concerns have been used as the justification for Washington’s trade ban on Chinese tech champion Huawei Technologies.