July 2023
Di Wu and Teresa Huang
In recent years, development of the network economy and people’s emphasis on personal information has increased rapidly. In order to meet the growing demand for personal information export and protection, the Cyberspace Administration of China announced the “Measures for the Standard Contract for Outbound Transfer of Personal Information” (hereinafter referred to as the “Measures”), which became effective on June 1, 2023. In order to guide and help personal information processors orderly file standard contracts for the export of personal information, the Cyberspace Administration of China also issued the “Guidelines for the Filing of Standard Contracts for Outbound Transfer of Personal Information” (First Edition) (hereinafter referred to as the “Filing Guidelines”) on May 30. The main purpose is to cooperate with the implementation of the “Measures” to protect the rights and interests of personal information going abroad, and regulate the activities of personal information going abroad. The specific content is summarized as follows:
The “Filing Guidelines” also clearly stipulates the applicable scope of personal information processors, which mainly include: (1) non-critical information infrastructure operators; (2) those who handle personal information of less than 1 million people; (3) those who accumulatively provide personal information to less than 100,000 people overseas since January 1 of the previous year; (4) those who accumulatively providing sensitive personal information to less than 10,000 people overseas since January 1 of the previous year. At the same time, the “Filing Guidelines” lists the export behaviors of personal information, including: (1) Personal information processors transmits or stores personal information collected and generated in domestic operations overseas; (2) the personal information collected and generated by the personal information processor is stored in China, but can be can queried, retrieved, downloaded, and exported by overseas institutions, organizations, or individuals; (3) Other personal information export behaviors stipulated by the Cyberspace Administration of China.
The “Filing Guidelines” emphasizes the importance of evaluation reports. Personal information processors shall, within 10 working days from the effective date of the standard contract, file with the local provincial network information department by delivering written materials and attaching electronic versions of the materials. The filing materials should include the “Personal Information Protection Impact Assessment”. In addition, the “Filing Guidelines” also proposes that within the validity period of the standard contract, personal information processors should re-assess the impact of personal information protection, supplement or re-conclude the standard contract, and perform the specific necessary actions in accordance to the filing procedures. In particular, personal information processors need to be responsible for the authenticity of the materials they submit. If false materials are submitted, they will be dealt with according to the filing failure, and the corresponding legal responsibilities will be investigated according to law.
The “Filing Guidelines” also stipulates the contact methods for consultation and reporting, so that personal information processors can have channels for consultation when encountering difficulties in the relevant filing process.
After the release of the “Filing Guidelines”, local governments have also successively issued relevant notices, including the guidelines for the filing of standard contracts for outbound transfer of personal information in Beijing, the notice of the Shanghai Municipal Cyberspace Administration for the filing of standard contracts for outbound transfer of personal information, the guidelines for the filing of standard contracts for outbound transfer of personal information in Fujian Province, and the notice of the Internet Information Office of Guangdong Province on the filing of standard contracts for outbound transfer of personal information. It is recommended that enterprises understand the regulations and practical requirements of the central and local governments before handling the relevant filing work to avoid delays in filing due to incomplete document preparation.
The contents of all newsletters of Shanghai Lee, Tsai & Partners (Content) available on the webpage belong to and remain with Shanghai Lee, Tsai & Partners. All rights are reserved by Shanghai Lee, Tsai & Partners, and the Content may not be reproduced, downloaded, disseminated, published, or transferred in any form or by any means, except with the prior permission of Shanghai Lee, Tsai & Partners.
The Content is for informational purposes only and is not offered as legal or professional advice on any particular issue or case. The Content may not reflect the most current legal and regulatory developments. Shanghai Lee, Tsai & Partners and the editors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The contributing authors’ opinions do not represent the position of Shanghai Lee, Tsai & Partners. If the reader has any suggestions or questions, please do not hesitate to contact Shanghai Lee, Tsai & Partners.