At long last, China has issued the Standard Contract terms and the Measures for implementing them.
- They apply to any personal information data export from China, except those of a heightened concern (i.e. critical information or large volume and/or sensitive data transfers) or where a voluntary assessment by the Cybersecurity Administration of China (CAC) is decided.
- They require the data exporter to conduct a Personal Information Privacy Impact Assessment, with detailed questions to be assessed.
- They require the entering into of a designated Standard Contract with the receiving party, with far-reaching obligations on both the exporter and the data recipient.
- These documents must be filed with the CAC within 10 days of the signing of the Standard Contract.
- These obligations take effect on 1 June 2023 (although a six-month grace period is in place for transfers made before 1 June 2023).
We note that these Measures do not alter the obligations under Article 39 of the Personal Information Protection Law, which require separate informed consent be obtained from the data subject (although we note very few exceptions that may be used to otherwise obtain consent). We also note that such cross-border transfers are allowed only where it is “really needed” by the business (PIPL Article 38).
Given these far-reaching new obligations, we are counseling companies that want to export personal information from China to immediately assess their new obligations and move toward meeting them prior to the 1 June 2023 deadline.
In a new development, we note that China is weighing a restructure to establish a data administration bureau. This new organization would likely become the data regulator overseeing data administration in Mainland China, taking over some roles from the Cyberspace Administration of China. We will provide an update accordingly.
For a more detailed review of the new Measures and the designated Standard Contract, please see this alert. In addition, we are hosting a webinar, China’s New Standard Contractual Clauses – What Do They Mean for You? to provide a deeper dive on these changes. There will be two sessions taking place to cater for different time zones, 22 March 2023 for EU/UK/MENA and 23 March 2023 for the Americas. Sign up here.