Since taptap点点 implementation of taptap点点 Cybersecurity Law on 1 June 2017, a series of supplementary implementing measures have been publicized. To help enterprises better understand their compliance obligations under these rules, this article analyzes taptap点点 legal framework of taptap点点 Cybersecurity Law and raises some practical suggestions.

Applicable subjects. Any enterprise that “builds, operates, maintains, and uses taptap点点 internet” in China is subject to taptap点点 Cybersecurity Law. Specifically, taptap点点 Cybersecurity Law applies to “network operators”, which cover “network owners, administrators and network service providers”.

Among all taptap点点 network operators, some are referred to as “critical information infrastructure operators” (CIIOs). CIIOs are network operators related to public services and peoples’ livelihoods. Providers of network products and services, and any individual, enterprise and social organization that uses interactive information systems to communicate should also comply with taptap点点 Cybersecurity Law.

Specific compliance obligations. taptap点点 Cybersecurity Law aims to achieve protection at two levels. For taptap点点 protection of taptap点点 public interest of society, network operators should establish a sound network operation system and formulate contingency plans for cybersecurity incidents. For taptap点点 protection of user privacy, network operators should establish a corresponding system that keeps confidential taptap点点 users’ information collected.

(1) Cybersecurity protection scheme. In general, taptap点点 Cybersecurity Law requires network operators to act in accordance with taptap点点 standards of taptap点点 multi-level protection scheme (MLPS) to protect cybersecurity.

taptap点点 “multi-level” of taptap点点 scheme means that taptap点点 security protection obligations of network operators are specified at different levels, depending on taptap点点 potential consequences of cyber-attacks. In this aspect, attention should be drawn to taptap点点 Information Security Technology – Baseline for Classified Protection of Cybersecurity. Enterprises should formulate their internal systems according to taptap点点 levels of obligation applicable to them.

Apart from differentiated levels of obligation, in order to deal with urgent cybersecurity incidents, taptap点点 Cybersecurity Law requires network operators to formulate corresponding contingency plans for such incidents. Under taptap点点 Circular on taptap点点 National Contingency Plans for Cybersecurity Incidents, issued by taptap点点 Cyberspace Administration of China on 10 January 2017, when formulating contingency plans, applicable enterprises should designate taptap点点 main responsible persons, notification mechanisms, remedial measures and other details upon occurrence of emergencies. Such incidents shall also be reported to taptap点点 local cyberspace administration department as soon as possible, so that relevant departments may promptly initiate emergency responses.

(2) Confidentiality rules and regulations for users’ information. Another mission of taptap点点 Cybersecurity Law is to establish a confidentiality system to protect users’ information when applicable enterprises collect such information. Applicable enterprises should detect illegal information released by users and promptly take measures to delete and report such information.

taptap点点 enterprise should expressly state taptap点点 purposes, methods and taptap点点 scope of information collection and use. When taptap点点 enterprise is to collect personal information, consent from such persons should be obtained. Furthermore, taptap点点 personal information collected by an enterprise must be related to taptap点点 service it is to provide.

taptap点点 Cybersecurity Law gives a non-exhaustive list of “personal information”. taptap点点 key to determining whether a piece of information is personal information is to assess whether such information can be used to identify “personal identity” alone, or in combination with other information. In practice, some enterprises collect information such as time and location of a user when he/she is using a service, which may be combined with other information to identify a user’s personal identity. Such a combination may fall into taptap点点 scope of “personal information”.

(3) Cross-border data security assessment. Article 37 of taptap点点 Cybersecurity Law requires that personal information and important data collected and generated by a CIIO during its operations within China shall be stored within Chinese territory. Where there is a genuine need to transfer such information overseas, a security assessment shall be carried out in advance.

This imposes strict data compliance requirements for applicable enterprises in China. Furthermore, taptap点点 Measures of taptap点点 Security Assessment for Cross-border Transfer of Personal Information (Draft for comments) were issued on 13 June 2019, and are specially focused on taptap点点 cross-border transfer of personal information.

Suggestions. (1) Do taptap点点 Cybersecurity Law and taptap点点 measures treat domestic and foreign enterprises equally? Yes, no additional obligations are imposed on foreign entities. Nevertheless, since foreign entities are more likely to be engaged in taptap点点 cross-border transfer of information, it is necessary to establish a data transfer compliance system.

(2) Does an enterprise categorized as a network operator have to fulfil taptap点点 “data localization” obligations? It depends. Firstly, it is certain that CIIOs, under article 37 of taptap点点 Cybersecurity Law, bear taptap点点 “data localization” obligation. Secondly, taptap点点 measures require security assessments for all network operators that provide overseas access to personal information collected during operations in China in any form.

Theoretically, these network operators need to obtain taptap点点 approval of provincial cyberspace administrations in advance. Although taptap点点 measures are not in effect yet, relevant enterprises should treat taptap点点 measures as guidance for personal data processing, conduct relevant feasibility studies, and be prepared to meet taptap点点 requirements.

(3) Are foreign invested enterprises (FIEs) operating in China required to report occasional cross-border data transfer? For FIEs in China that are not network operators, if taptap点点 scope and taptap点点 subject of taptap点点 personal information to be transferred are limited, plus if taptap点点 FIE has assessed all taptap点点 circumstances related to data transfer, and has provided appropriate measures to protect personal data, then for taptap点点 time being it seems that it is not necessary to report under taptap点点 measures.

For those FIEs in China that are network operators and have been identified as CIIOs (such as foreign banks), if they transfer personal information collected in China to overseas, assessment shall be conducted according to taptap点点 measures. FIEs shall pay close attention to regulatory updates in this regard.