日前，礼丰律师事务所受国际知名法律媒体《中国法律商务》(China Law & Practice)的邀请，撰文从实务角度介绍上海自贸区临港新片区和北京自贸区有关数据跨境的便捷规则。两篇文章题为《临港生物医药数据便捷跨境传输规则》(Lin-Gang's Fast-Track Biomedical Data Transfer Rules)和《北京自贸区数据出境负面清单》(The Data Outbound Negative List of the Beijing Free Trade Zone)，由合规部合伙人宇文沛律师及合规部胡运思律师撰写。
Lin-Gang’s Fast-Track Biomedical Data Transfer Rules
Standfirst: New rules applicable to Shanghai’s Lin-Gang New Area have been released. AUTHOR of Lifeng Partners analyzes their workings, how they fit into China’s existing system of cross-border data transfer rules and why they are so significant for biomedical companies operating in the zone.
•China’s current three-pillar cross-border data transfer regulatory regime is generally regarded as complicated
•New rules issued by the Lin-Gang Special Area appears to amount to a fourth mechanism for cross-border data transfer
•The new mechanism is applicable where the personal information of less than 100,000 individuals is processed (excluding sensitive personal information)
•Completion times under the new mechanism could be as short as 15 working days; simplified documents and free supervision of filing are also attractive factors
•Policy changes may impact the rules, but on balance the new system should benefit eligible companies
On May16, 2024, the Lin-Gang Special Area of the China (Shanghai) Pilot Free Trade Zone(“Lin-gang”) released itsGeneral Data List for the Cross-Border Transfer of Data in Biomedical Sector Scenarios (Trial Implementation)(the “New List”)(临港新片区生物医药领域数据跨境场景化一般数据清单（试行）). The New List coversdata in five biomedicalscenarios:
•Clinical trial and R&D
• PV and Medical Device AE Monitoring
•Medical enquiries
•Complaints
•Vendor Management
A wide scope of data across the whole biomedicalsectoral ecosystem are included in the New List. According to Article 13 ofthe Lin-Gang Special Area of the China (Shanghai) Pilot Free Trade Zone, Measures for the Administration of Cross-Border Flow of Data by Category and Level (Trial Implementation).(中国（上海）自由贸易试验区临港新片区数据跨境流动分类分级管理办法（试行）) (the “Measures”), the listed data can be transferred provided that such data transfer activity has filed with the Lin-Gang Special Area Administration (临港新片区管委会) (the “Administration”). In other words, outbound transfer of general data in Lin-gang is subject to an ex-ante condition of obtaining a filling clearance.We will refer to this process as the “Lin-gang CBDT legal mechanism”.
Upon completion of the Lin-gang CBDT legal mechanism, including fulfilling an administrative filing formality and archiving usinga platform operated by the Administration, companies can transfer their listed general data overseas, without prejudice to future random inspection of their cross-border data transfer (“CBDT”) activities by the Administration.
For those biomedicalcompanies whose CBDT activities do not trigger the thresholds of China’s general CBDT mechanisms—concluding the Standard Contractual Clauses and filing withtheCyberspace Administration of China (the “CAC”), obtaining personal information protection certification or conducting the CAC’s security assessment—they tend to believe that the adoption oftheLin-gang CBDT legal mechanism is deemed as obtaining a governmental endorsement for the company’s CBDT activities. The Lin-gang CBDT legal mechanism isthusexpected to becomeChina’sfourth data export mechanism, in parallel with other CBDT mechanisms.
The Lin-Gang Special Area Cross-border Data Flow Service Center (the “Service Center”), the institution responsible forreceivingand reviewingtherelevantfiling application documents, has intended to shiftthetemporal and pecuniary burdens oftheLin-gang CBDT legal mechanism by (1) accelerating the duration of review and approval of filing documents to approximate 15 working days;and(2) providing free supervision ofthe preparation offiling documents.
Who benefits from the New List?
Nevertheless, according to the New List and the Lin-Gang Special Area of the China (Shanghai) Pilot Free Trade Zone,OperationalGuidelinesfor theGeneral Data Listsfor the Cross-Border Flow of Data(中国（上海）自由贸易试验区临港新片区数据跨境流动一般数据清单操作指南（试行）) (the “Guideline”), only companies registered in Lin-gang and other areas of the Shanghai Pilot Free Trade Zone (Shanghai FTZ), when conducting CBDT activities in Lin-gang,are eligible to adopt the Lin-gang CBDT legal mechanism. Critical Information Infrastructure Operatorsareexcluded. Companies registered in Zhangjiang Science City, where more than400 biomedicalcompanies are currently locatedmay implement the Lin-gang CBDT legal mechanism if their domicile is zoned into the Shanghai FTZwith CBDT activities happen in Lin-gang.
Who is the regulator of CBDT in Lin-gang?
The Service Center, jointly launched and operated by the Shanghai Cyberspace Administration of China (上海市网信办) andLin-gang Special Area Administration, officially came on stream on April7, 2024.
The Service Center’smissionisto manage the General Data List (for example byresponding to inquiries about the New List), receive and review applications under theLin-gang CBDT legal mechanism, provide support withdata categorization and classification, and bridge the Lin-gang CBDT rules with international data transfer regulations.
What are the filing steps of the Lin-gang CBDT legal mechanism?
There is a four-step filing methodology underthe Lin-gang CBDT legal mechanism, as follows:
•Filing documents preparation: Companies collect and prepare filing documents, including a filing application form and a description of the outbound general data and the outbound scenarios, etc.
•Experts grouping-up: The Service Center will formulate a list of experts who are assigned to make assessment of the filing CBDT activity, then submit the list to the Administration for review and approval.
•Experts assessment: Once the expert group has been set up, it is responsible forconducting anassessment and proposingtheoutcome of the assessment.
•Final decision by the Administration: The Administration will issue a notice of clearance based on its review and approval of the expert group’s proposed outcome and all filing documents.
How long does it take to get a clearance? How long does the clearance remainvalid?
By consultation, the review and approval process of the New List Filing normally takes around 15 working days, varying case by case.The validity period of suchadministrative clearance is one year, which can be extended two months ahead of the expiration date.
Is the Lin-gang CBDT legal mechanism indeed the fourth general CBDT mechanism in China?
With promulgation of the Cybersecurity Law(网络安全法), Data Security Law(数据安全法), Personal Information Protection Law(个人信息保护法), and a raft of ancillary regulations over the past few years, China has introduced a three-pillar CBDT regulatory regime (general CBDT mechanisms), consistingofpassing the CAC’ssecurity assessment, concluding and filing CAC’s Standard Contractual Clauses(jointly as CAC filings), and obtaining personal information protection certification. By setting up a series of volume-based triggering thresholds, data processors who trigger such thresholds must fulfill one of these ex-ante transfer obligations. This regulatory regime has been commented as burdensome by market players for years.
On March22, 2024, the Provisions for Facilitating and Regulating the Cross-Border Flow of Data(促进和规范数据跨境流动规定) (the “New CBDT Rules”) werepublished. The New CBDT Rules reaffirm the three-pillar regime but finally ease the triggering thresholds and designate certain exemptions, and thus have been seen as a signal of the Chinese government’s relaxation of the old CBDT regulatory regime. Article 6 of the New CBDT Rules delegates regulators of pilot free trade zones (FTZs) to promulgate special rules applicable to CBDT activities in the FTZs.
The Lin-gang CBDT legal mechanism is designated by one of the FTZs’special rules. Pursuant to Article 5 of the New List, while outbound-transferred general data contains personal information, as long as the volume of outbound personal information does not exceed 100,000 individuals (excluding sensitive personal information), data processors areeligible to follow the Lin-gang CBDT legal mechanism.
The New CBDT Rules stipulate scenario exemptions and a volume-based exemption to general CBDT mechanisms. However, the New CBDT Rules havebeen silent on the criteria in determining whether a CBDT activity falls within the scope of those exemptions. This means companies may riskbeingcharged with violating ex-ante requirements for CBDT in enforcement actions. Concerning possible regulatory enquiries, companies supposed to be exempted can adopt the Lin-gang CBDT legal mechanism, deemed as getting a governmental endorsement to prove thelegality and security oftheirdata transfers.During the filing procedure, the Service Center will certify that the transferred data is categorized as general data, which can be transferred overseas without beingsubject to general CBDT mechanisms.
To align with the FTZs’special rules on CBDT, the Lin-gang CBDT legal mechanism is only applicable to eligible companies, without prejudice to general CBDT mechanisms under the New CBDT Rules.
Comparedwith general CBDT mechanisms, what is the difference in Lin-gang?
Shorter review and approval duration
To obtain a clearance, the preparatory and review and approval of the filing of the CAC’s Standard Contractual Clausesusually takes months and that of the security assessment filing usually takes longer. By consultation, the review and approval process of the Lin-gang CBDT legal mechanism normally takes around 15 working days. With the Administration’s supervision of the preparation of documents, the entire process of completing the Lin-gang CBDT legal mechanism can be significantly shorter than that of general CBDT mechanisms.
Simplified documentary requirements
The Personal Information Protection Impact Assessment Report (PIPIA Report) and Cross-border Data Transfer Risk Self-assessment, which are mandatory supporting documents for CAC filings, normally contains extensive contents. By consultation, the main supporting document whenapplying for Lin-gang CBDT clearance(a description of the outbound general data and the outbound scenarios), is similar to thePIPIAReport butcould be streamlined subject to the Administration’s regulatory discretion.
Free supervision of filing
According to the Guideline, the Service Center provides a free-of-chargefull-process supervision service for companies who adopttheLin-gang CBDT legal mechanism. For companies who wish to file,thisis expected to save applicants thecost of engaging athird-party consultantandhelp themdevelop government relations through interaction with the staff of the Service Center.
Remaining concerns
Despite the apparent benefits, there remain some concerns relating to the Lin-gang CBDT legal mechanism.
No exemption where thresholds are triggered
For biomedicalcompanies whichwouldtrigger the CAC’s filings orpersonal information protection certification thresholds, the Lin-gang CBDT legal mechanism is NOT an alternative to general CBDT approaches.
According to the Guideline, the Lin-gang CBDT legal mechanism is a scheme only available to companieswhich are not Critical Information Infrastructure Operatorsand whichtransferpersonal information (excluding sensitive personal information) of less than 100,000 individuals outside China since January 1 of the current year. 100,000 individuals is a volume- triggering threshold for concluding the CAC’sStandard Contractual Clauses or obtaining personal information protection certification underthe New CBDT Rules.Thismeans that, once companies have already processed personal information of over 100,000 individuals, it willnot be possible to circumvent the formalities of the general CBDT mechanisms by adoptingtheLin-gang CBDT legal mechanism.
Extra efforts for companies
As mentioned before, the New CBDT Rules havebeen silent on the criteria fordetermining whether a CBDT activity falls within the scope of those exemptions. This hascausedconcernsfrom interestedparties as to whether their CBDT activities are indeed freefrom any pre-transfer requirement, insofar as the interestedparties may have a different illustration of exemption criteria from the regulatory authorities. In avoidance of future regulatory enquiries, the Lin-gang CBDT legal mechanism is normally deemed as a governmental endorsement of applicability of the exemptions by the market players. Nonetheless, thiscosts extra effort, and companies will generallyhave to evaluate the cost-effectiveness ofobtainingsuchclearance.
Awaiting detailed rules
Since the Service Center was launched, Lin-gang has been known for its fast path for CBDT activities. However, to some extent, the process of the Lin-gang CBDT legal mechanism still lacksdetailed clarification. For instance, questionsremain opensuch as the allocation of file-review tasks between the Shanghai CAC and the Administration, the explicit duration forcompleting the Lin-gang CBDT legal mechanism, a pending specific guideline of preparatory work for the requested description of the outbound general data and the outbound scenarios (since there is no publicly available template), and so on.
A notable observation is that the Lin-gang CBDT legal mechanism can be rapidly amendedaccording tochanges inpolicy. The applicability of the Lin-gang CBDT legal mechanism appears alreadyto haveshifted to companies registered in Lin-gang and other areas of Shanghai FTZ, while according to the Measures published in February, the applicability was to companies who were registered in Lin-gang OR whose CBDT activities happen in Lin-gang.
Concluding remarks
Because the New CBDT Rules havesignificantly eased compliance burdens, companies should evaluate their CBDT activities to determine what requirements they are required to meet going forward. The Lin-gang CBDT legal mechanism has created a new strategy for biomedicalcompanies which are seeking governmental clearance for their CBDT,in five transfer scenarios,in order to mitigate the risk of future compliance investigation. The Lin-gang CBDT legal mechanism is a trial system fortheregulation ofCBDT separatefrom thatoperatedby the central government.Though subject to further policy changes, the Lin-gang CBDT legal mechanism can be expected tobring solutions to eligible biomedicalcompanies when consideringtheir international data flows.
此文章系《中国法律商务》(China Law & Practice, CLP)首发。(https://www.chinalawandpractice.com/)
若您有任何相关疑问，可联系礼丰律师事务所进一步垂询：
inquiry@lifenglaw.com
