REGULATIONS

CAC seeks comments on revising Administrative Measures for Internet Information Services

On January 8, 2021, the Cyberspace Administration of China (“CAC”) issued the Administrative Measures for Internet Information Services (Revised Draft for Comments) (the “Draft for Comment”) for public comments by February 7, 2021.

The Draft for Comment applies to any organization or individual within the territory of the People’s Republic of China providing Internet information services to domestic users by using domestic and foreign network resources.

The Draft for Comment requires that those who engage in Internet information services, which belong to operating the business of telecommunications, shall obtain the business license from the competent department of telecommunications; those who do not belong to operating the business of telecommunications shall undertake the filing-for-record formalities with the competent department of telecommunications. Those who have not obtained the business license of telecommunication business or have not completed the filing-for-record formalities shall not engage in Internet information services.

The Draft for Comment requires that Internet information service providers, Internet network access service providers and their staff shall adopt technical measures and other necessary measures to protect the identity information and log information collected and used from leakage, damage and loss.

http://www.cac.gov.cn/2021-01/08/c_1611676476075132.htm

 

MOFCOM issued the Rules on Counteracting Unjustified Extra-Territorial Application of Foreign Legislation and Other Measures

On January 9, 2021, the Rules on Counteracting Unjustified Extra-Territorial Application of Foreign Legislation and Other Measures (“Rules”), are hereby promulgated by Ministry of Commerce of the People’s Republic of China (“MOFCOM”) and shall be effective as of the date of the promulgation.

These Rules apply to situations where the extra-territorial application of foreign legislation and other measures, in violation of international law and the basic principles of international relations, unjustifiably prohibits or restricts the citizens, legal persons or other organizations of China from engaging in normal economic, trade and related activities with a third State (or region) or its citizens, legal persons or other organizations.

These Rules require that where a citizen, legal person or other organization of China is prohibited or restricted by foreign legislation and other measures from engaging in normal economic, trade and related activities with a third State (or region) or its citizens, legal persons or other organizations, he/it shall truthfully report such matters to the competent department of commerce of the State Council within 30 days.

These Rules require that the State shall establish a working mechanism composed of relevant central departments (“Working Mechanism”), to take charge of counteracting unjustified extra-territorial application of foreign legislation and other measures. Where the Working Mechanism, upon assessment, confirms that there exists unjustified extra-territorial application of foreign legislation and other measures, it may decide that the competent department of commerce of the State Council shall issue a prohibition order to the effect that, the relevant foreign legislation and other measures are not accepted, executed, or observed (“prohibition order”). The prohibition order may be suspended or withdrawn by decision of the Working Mechanism based on actual circumstances.

A citizen, legal person or other organization of China may apply to the competent department of commerce of the State Council for exemption from compliance with a prohibition order. Meanwhile, these Rules follow that where a person complies with the foreign legislation and other measures within the scope of a prohibition order, and thus infringes upon the legitimate rights and interests of a citizen, legal person or other organization of China, the latter may, in accordance with law, institute legal proceedings in a people’s court, and claim for compensation by the person.

http://www.mofcom.gov.cn/article/zwgk/zcfb/202101/20210103029710.shtml\

 

PBOC issued the Administrative Measures for Credit Reporting Business (Draft for Comment)

On January 11, 2021, the People’s Bank of China (“PBOC”) issued the Administrative Measures for Credit Reporting Business (Draft for Comment) (the “Draft for Comment”) for public comments by February 10, 2021.

On credit information collection, the Draft for Comment stipulates that credit agencies should:

  • follow the principle of “minimum and necessary” and credit information collection should not be excessive;
  • examine the business legitimacy, information source, information quality, information security and authorization of information subject of the information provider to ensure the legality, accuracy and sustainability of credit information collection;
  • clarify with the information provider their respective rights and obligations in data correction, objection of handling, information security, etc.; and
  • obtain the information subject’s consent, and inform the information subject clearly of the purpose, source and scope of credit information collection, as well as the possible adverse consequences of not agreeing to the information collection.

http://www.pbc.gov.cn/tiaofasi/144941/144979/3941920/4160598/index.html

 

MIIT launches pilot program on classified and graded management of cybersecurity of industrial Internet enterprises

On January 13, 2021, the Ministry of Industry and Information Technology (“MIIT”) issued the Circular on Launching the Pilot Program on Classified and Graded Management of Cybersecurity of Industrial Internet Enterprises (the “Circular”).

The Circular provides that, in light of the actual development of the industrial Internet in various regions, and by taking into full consideration the willingness of various regions to participate in the program, 15 provinces (autonomous regions and municipalities directly under the Central Government) including Tianjin, Jilin, Shanghai, Jiangsu, Zhejiang, Anhui, Fujian, Shandong, Henan, Hunan, Guangdong, Guangxi, Chongqing, Sichuan, Xinjiang are initially scheduled to launch the pilot program.

The Circular requires that, through the pilot program:

  • the rationality, effectiveness and operability of rules, standards and procedures of classification and grading for cybersecurity of industrial Internet enterprises, and security-series protection specifications for industrial Internet shall be perfected, and the construction of a classified and graded management system for cybersecurity of industrial Internet enterprises shall be accelerated;
  • the main responsibility of the cybersecurity of pilot enterprises shall be performed, to form a reproducible and popularized classified and graded management model of cybersecurity of industrial Internet enterprises; and
  • a batch of typical solutions for cybersecurity of industrial Internet shall be summarized, a batch of excellent demonstration enterprises shall be selected, and a batch of professional service organizations shall be cultivated.

https://www.miit.gov.cn/jgsj/waj/gzdt/art/2021/art_eb95e60794794fc29f768233e7d7739d.html

 

SPP issued the Provisions on the Handling of Cybercrime Cases by the People’s Procuratorates

On January 25, 2021, the Supreme People’s Procuratorate (“SPP”) issued the Provisions on the Handling of Cybercrime Cases by the People’s Procuratorates (the “Provisions”) for implementation as of the date of issuance.

The Provisions has a total of 65 articles in seven chapters, including general provisions, guided collection of evidence and case review, review of electronic data, and attendance in court in support of public prosecutions.

The Provisions require that the people’s procuratorate should strengthen the punishment in handling cybercrime cases in whole and pay attention to examining and discovering the clues of upstream and downstream related crimes. For a suspected crime, if the public security organ does not put it on file for investigation and should apply for approval of arrest but does not apply for approval of arrest, or if the case should be transferred for prosecution but does not be transferred for prosecution, supervision shall be carried out according to law.

https://www.spp.gov.cn/spp/xwfbh/wsfbh/202101/t20210125_507446.shtml

 

CONTACT US

If you would like to receive our legal update via email, please contact jianghongyu@anjielaw.com.

For more information, please contact:

Samuel Yang | Partner

AnJie Law Firm

P: +86 10 8567 2968

M: +86 1391 0677 369

E: yanghongquan@anjielaw.com

Hongquan (Samuel) Yang is a partner with AnJie Law Firm. He has worked as in-house counsel and external lawyer in the technology, media and telecoms (TMT) sectors for nearly 20 years and is regarded as a true expert in these areas. He advises clients on a wide range of regulatory, commercial and corporate matters, especially in telecommunications, cybersecurity, data protection, internet, social networking, hardware and software, technology procurement, transfer and outsourcing, distribution and licensing, and other technology-related matters. He also advises clients on compliance and investigation matters.

Samuel has been recognized as a Leading Individual in PRC TMT firms (Legal 500, 2020), a Band 1 Cyber Security & Data Protection Lawyer (LEGALBAND, 2019, 2020) and one of the Top 10 Cyber Security and Data Protection Lawyers in China (LEGALBAND, 2018). Legal 500 commented that Samuel and his team at AnJie have a particular strength in “telecom-related regulatory and general commercial legal services” and “issues such as cyber security and data protection areas” and have “built a real niche” in these areas.

Samuel mainly serves Fortune 500 companies, large state-owned enterprises and leading Chinese internet companies. Samuel is a regular contributor to many legal journals and his publications regarding Chinese data protection and cybersecurity laws are well-received and widely reproduced.

Before joining AnJie, Samuel worked for British Telecom, CMS and DLA Piper.

Let’s talk tech and Chinese money.

Since antiquity, China had led the world with its adoption of cutting-edge currency

Today, there is an immense amount of interest surrounding China’s new digital yuan (“DCEP” – Digital Currency Electronic Payment).

However, China’s history of currency innovation goes back to ancient times. Unlike Roman coins, ancient Chinese coins are marked by a square hole in the middle, allowing the bearer to efficiently string large amounts together for ease of transport.

A “开元通宝”, kāiyuán tōng bǎo; ‘Circulating treasure from the inauguration of a new epoch’. Attribution: Unknown.

Another innovation was the use of bolts of silk. In ancient times, silk was issued to garrisoned troops along the silk road as a form of payment, because it was lighter than coins and easier to transport overland from the then-imperial capital of Chang’An (present-day Xi’an).

A plain, basket-weave (one thread over, one thread under) bolt of silk from the 3rd or 4th century CE and currently housed at the British Museum. Before it snapped in half, this bolt was sent as payment to garrisoned Chinese troops in the silk road city of Krorän (also known as Loulan). Attribution: Valerie Henson, The Silk Road, Colour Plate 5A.

Promissory bank notes appeared a few hundred years after silk bolts were used, in Tang dynasty China. These promissory notes allowed merchants to conclude large transactions without needing to carry heavy loads of metal coins (Tiě qián, 贴钱) on their person. Another few hundred years later, real paper currency (Jiāo zi, 交子) appeared in Song dynasty China (although Chinese paper already existed when silk was used as payment, it was mostly for wrapping and it took some time for paper currency Jiāo zi to emerge).

China is starting a new chapter in its currency innovations

Fast forward to today: with the proliferation of Wechat Pay and Alipay during the 2010s, China has, more than a millennium after inventing paper bank notes, become the first major economy to transform into a cashless society. In this regard, China is already miles ahead of other developed markets.

In line with its history of currency innovation, China is again writing a new chapter. However this time, there is one major difference. Past Chinese improvements on money were usually incremental. Paper and silk are lighter than copper, and digital wallets weigh no more than the smartphone they’re carried. That latter also bring some additional record-keeping features, like a basic receipt for the parties’ reference.

Unlike these incremental evolutions, the DCEP is a revolutionary advance in currency. Allowing near-instant foreign exchange settlement and built on blockchain, the DCEP is perfectly traceable and allows the People’s Bank of China (“PBOC“, Chinese Central Bank) and state owned banks to collect data not only on transactions between users (the parties, the date, and the amount exchanged, among other details) but also on each subsequent transaction using DCEP. There is immense potential for using this ledger data to fuel the growth of fintech in China.

To better understand this, imagine for a moment if every transaction for every US Dollar in circulation — for the lifetime of each dollar — were recorded by the Federal Reserve on a ledger. These dollars are stored and exchanged in digital wallets, each of which has an “address” (like a bank account number) tied to a person or company.

Whether in New York, Paris, or Shanghai, the Federal Reserve now knows the name, timestamp, and amount exchanged for every transaction completed in USD. Now imagine that the Federal Reserve makes this data available to tech giants, either to help detect crime, encourage innovation, or even to help the government raise money. Imagine also that they share this information with law enforcement to help them identify and catch criminals, and fight money laundering and tax evasion.

Obviously, the Federal Reserve won’t be able to realize these scenarios for legal and political reasons. It is very limited in what it can do with a digital dollar. It would be illegal for it to sell user data without user consent and privacy concerns in the US would quickly lead to public backlash against sharing data with law enforcement programs. It should be noted that the US Federal Reserve is considering a Central Bank Digital Currency (CBDC), though this has yet to launch and its scope is set to be much narrower than in the scenarios described above.

The PBOC, on the other hand, is more than ready to push a digital currency to its fullest potential, from government departments to beyond China’s borders. As of January 2, 2020, the PBOC had already filed 84 patent applications for the DCEP, and the DCEP is scheduled to be in use in time for the 2022 Winter Olympics in Beijing. The plan is to first implement its use across government institutions, then large Chinese companies, and then finally to help forge a path along the new land, maritime, and “digital” silk roads as a settlement layer in the Belt and Road Initiative (“BRI“). Former PBOC Governor Zhou Xiaochuan recently spoke at length on the potential for the DCEP to transform cross-border trade.

There are plans to share DCEP data to fight crime. According to Yao Qian, founder of the PBOC’s Digital Currency Research Lab, the DCEP’s data will also be shared with law enforcement. Of course, as suggested in a report by the Bank of International Settlements, the benefits to law enforcement could be minimal because ordinary criminals will tend to avoid a fully traceable currency. That said, it could be used to great effect to fight white-collar crime and corruption. For example, after government treasuries convert all Yuan to the DCEP, their spending (and the spending of government contractors) could be tightly monitored. This may lead to much greater transparency in areas like government product procurement, construction, and other public tenders, which are particularly vulnerable to bad actors. Similarly, once large companies convert to DCEP, it follows that their staff payroll and a funds paid to suppliers will also be traceable.

Moreover, there are already plans in place for the mass-commoditization of data in China, which may enable marketing DCEP data. This year, it was revealed that Shenzhen will establish a “data trading market” and “take the lead” in exploring new mechanisms for data property rights protection and utilisation (see 2020 Implementation Plan for the Pilot Comprehensive Reform of Building a Pilot Demonstration Zone of Socialism with Chinese Characteristics in Shenzhen). To be clear so far, there is no indication this this is intended to market DCEP data, but it does open very interesting opportunities should the government decide to do so.

Implications of China’s DCEP for Insurtech & Insurers

In terms of creating Insurtech products for end-users, the DCEP’s implications for Insurtech depend in part on whether and to what extent the DCEP will enable or support smart contracts. Smart contracts are already featured on other crypto tokens, most notably the Ethereum Virtual Machine (“ERC-20“) which supports developing smart contracts by using the Solidity programming language, a combination of Javascript and C++.

While initially a cause for alarm in some jurisdictions, blockchain smart contracts hold great potential that is increasingly well-understood by regulators. In addition to powering the telematics behind Insurtech products (for more on the potential for telematics in China see our past article, “Can Foreign Investors Capitalize on Insurtech’s Growth in China?”), smart contracts enable automating transfers of rights in exchange for funds and lowering transaction costs (especially for multi-party agreements).

This technology forms the basis of Initial Coin Offerings (“ICO“). Through ICOs, smart contracts allow a fundraising venture to execute only after sufficient investors have agreed to the financing terms. In exchange for funding the venture, the investors receive a token, a kind of digital share certificate recorded on blockchain.

Although ICOs provide an innovative and potentially important vehicle to support fundraising for new ventures and ideas, lack of regulation and rampant fraud raised serious regulatory concerns when they became popular a few years ago. For more on this, see Zetzsche et al., “The ICO gold rush: It’s a scam, it’s a bubble, it’s a super challenge for regulators”, Harvard International Law Journal, vol. 60, no. 2, 2019. ICOs have been banned in the PRC Mainland since September 2017 (PBOC, CAC, MIIT, SAIC, CBRC, CSRC, and CIRC Announcement on Preventing Financial Risks from Initial Coin Offerings).

While ICOs remain restricted in the PRC, they are now legally regulated in Hong Kong and Taiwan as Security Token Offerings (“STO“). STOs combine the power of an ICO with the stringent regulations of the securities market.

Integrating the digital Yuan with an eventual STO regime would be revolutionary in a couple of different ways. First, allowing STOs — whether in Hong Kong or in the PRC assuming they are legalized — to be denominated in DCEP would greatly benefit fundraising for this innovative space. This would be a win for both private investors and the government: investors gain access to a powerful new fundraising tool, while the government can monitor and regulate STOs under its financial exchanges by bringing them within the fold of Chinese securities laws. This would allow regulators to implement mandatory disclosure rules to protect investors from the risks of fraud associated with ICOs, and further displace unofficial cryptocurrencies by channeling existing ICO action into the legitimate STO system. Together, these changes would make institutional investors more likely to treat STOs as serious investment opportunities. As a result, enabling the DCEP to support STOs would cement the DCEP’s appeal for fundraisers and institutional investors while helping the government keep tabs on this new activity in public exchanges.

Legalizing STOs and allowing them to be denominated in DCEP also opens up major new underwriting opportunities for property insurers. Say, for example, that an opportunity presents itself for a new insurance line of business — a new Chinese rocket company wants to launch missions into space to replenish the International Space Station, or launch a new satellite. Given the risks, it cannot find an insurer willing to underwrite and sell such an insurance policy.

With a DCEP-denominated STO, an insurer could decide to underwrite such a policy on the condition that an STO attracts an adequate number of co-insurers and reinsurers, and then exchange the tokens as financial assets. If there’s adequate market interest after the STO is listed, then the policy would launch (as would the rocket ship!), be divided into token shares, and then be distributed into each insurer and reinsurer’s book of business in exchange for their DCEP payments. After the STO is written, all of these subsequent steps would happen automatically and significantly reduce transaction costs. Innovations like this are already occurring, for example Nexus Mutual, a blockchain company providing a decentralized financial alternative to insurance cover. Depending on how innovative the regulators wish to be, such “policy tokens” could then be resold as securities to investors on the Shanghai, Shenzhen, or Hong Kong stock exchange. In an interview with Sergey Nazarov, co-founder of Chainlink (a company developing “oracles” for smart contracts), one possibility under discussion is for the revenue from such policies to  even become tokenized, and then bought and sold as a fixed-income investment asset.

Due to its instant settlement capability, denominating these investments in DCEP would also open the door for participation from foreign insurers provided that they satisfy market access requirements (for more on this, see our past articles, WFOE Shopping — How Do Beijing, Shanghai, And Shenzhen Compare For Establishing An Insurance WFOE In China?; and China, GATS, Trump: Do Non-US Insurers Get A Piece Of The China-US Trade Deal?).

Second, integrating the DCEP with an STO regime would be particularly welcome for insurance investors, for whom restrictions on equity investments were recently relaxed in November 2020. Coming into effect on November 12, the Notice on Matters Related to Insurance Fund Financial Equity Investment (the “Notice“) lifts a significant number of prohibitions on equity investments by insurers. In particular, it divides permissible investments into a positive and a negative list. Generally, as long as an equity investment prospect is safe, liquid (stable cash flow and a track record of dividends), profitable, legally registered and not engaged in serious legal disputes, is led by an honest team, presents no risk of related-party transactions, is not involved in real estate, is not a serious environmental polluter, and is not on the NDRC’s negative list, then an insurer is free to invest in it. Although in practice a significant number of ICOs were risky, failed, and would not meet these criteria for investment, in theory this opens the door for lucrative new investment opportunities if the government opens the door to PRC STOs with sufficient securities regulations in place.

While this DCEP/STO revolution is far from a reality, the government is already moving towards an “internet of blockchains” that would allow the DCEP to work far better with existing smart contract ecosystems. One government initiative, the Blockchain Services Network (“BSN“, 区块链服务网络, qū kuài liàn fúwù wǎngluò) is designed to allow cross-platform compatibility and support popular Western frameworks such as “Hyperledger Fabric (already supported), Ethereum, EOS and Digital Asset’s DAML” (Forbes). The BSN is aimed at “providing a robust, low-cost, high-availability, multi-cloud, internet-of-blockchains infrastructure”, and was launched in collaboration with large Chinese enterprises including UnionPay, China Mobile Communications Corporation, Design Institute, and China Mobile Communications Corporation Government (ibid).

As for personal insurance, this would depend in large part whether and to what extent DCEP data will be turned over to the private sector. Realistically, most personal data would be off-limits — absent user consent, we most likely will not enter a dystopian future where central banks sell data on personal lifestyle habits to insurers in order to adjust health policy rates. However, as discussed above, it would be feasible for the PBOC to make some personal data available to some financial institutions in order to help fight financial crimes, and this may including combating risks such as insurance fraud. It would also be feasible for new insurance contracts to stipulate that some benefits will only be paid out in DCEP. While insurers would not collect DCEP data, they may thereafter be able to request production of such data in the event of a lawsuit disputing the claim, and detect suspicious activity after the benefits are paid with the help of forensic experts.

Besides fraud prevention, one form of data that would be particularly helpful is data on insurance disputes. Insurtech smart-contracts could feasibly house not only insurance policies, but also dispute resolution provisions which connect to mediation, arbitration, or even Chinese internet courts. One example, SageWise, already provides a dispute resolution clause to be integrated within smart contracts. The data generated from disputes, i.e. the nature of the disputed claim, the amount, and the party which prevails, could help regulators identify and take action against standard clauses showing a high-frequency of disputes, while allowing insurance companies to better allocate resources in drafting and communicating sensitive policies to their clients. This would allow not only resolution of disputes, but also prevention of future disputes.

If allowed to be used by the private sector, we can expect there to be strict guardrails in place for how DCEP data is used, which would make it especially difficult for foreign insurers seeking to enter China’s Insurtech market to satisfy local requirements. Under Article 37 of China’s Cybersecurity Law (2017) (“CSL“), Chinese citizens’ personal data, together with critical business data collected in China, must be stored within mainland China, and companies must undergo a security assessment before exporting such data across the border. Thus although possible to make visible from an insurer’s headquarters in London or New York, this would almost certainly require a local Chinese partner or subsidiary that can pass the CSL’s security assessment prior to sending such data to a foreign server.

Conclusion

From bolts of silk to blockchain bits and bytes, China has a rich history of currency innovation that continues to the present day.

This time, China is implementing a currency innovation so revolutionary that it will take years to fully grasp its potential. The DCEP allows near-instant settlement and will play a significant role in the land, maritime, and digital silk roads, with the potential to transform cross-border trade.

Legalizing STOs and allowing them to be denominated in DCEP would unleash a wide range of new investment and underwriting opportunities for insurers. The DCEP would be especially powerful if it can support smart contracts. As for data, the DCEP may present great advantages to insurers in terms of risk and fraud detection, though this depends in large part on the extent to which PBOC data is shared with other financial institutions.

In light of the DCEP’s untapped potential, the 2022 Winter Olympics in Beijing will — just like the 2008 Beijing Summer Olympics — display to the world a modern, dynamic China with its sight set on even further horizons.

REGULATIONS

CAC seeks comments on scope of necessary personal information required for 38 types of Apps

On December 1, 2020, the Cyberspace Administration of China (“CAC”) issued the Scope of Necessary Personal Information Required for Common Types of Mobile Internet Applications (Draft for Comment) (the “Draft for Comment”) for public comments by December 16, 2020.

The Draft for Comment stipulates the scope of necessary personal information required for 38 common types of Apps such as map navigation App, online car-hailing App, and instant messaging App. In particular, the Draft for Comment provides that as long as a user gives consent to the collection of its necessary personal information required for an App, such App shall not refuse the user’s installation and use. Meanwhile, a total of 12 types of Apps, including online live streaming App, online audio and video App, short video App, and browser App, shall provide basic functional services without asking personal information of users.

http://www.cac.gov.cn/2020-12/01/c_1608389002456595.htm

 

Three departments released the Announcement on Issuing the Import Licensing List and Export Control List of Commercial Cryptography and Relevant Administrative Measures

On December 2, 2020, the Ministry of Commerce (the “MOC”), the State Cryptography Administration (the “SAC”) and the General Administration of Customs (the “GAC”) jointly released the Announcement on Issuing the Import Licensing List and Export Control List of Commercial Cryptography and Relevant Administrative Measures (the “Announcement”).

Main contents of the Announcement are as below:

  1. In order to safeguard national security and public interests, it is hereby decided to carry out import licensing and export control for relevant commercial cryptography.
  2. Regarding the import of items and techniques set out in the Import Licensing List of Commercial Cryptography, i.e., encrypted telephone sets, encrypted fax machines, cryptographic machines (cards) and encrypted VPN equipment, the import license of dual-use items and techniques shall be applied for with the MOC.
  3. Regarding the export of items and techniques specified in the Export Control List of Commercial Cryptography, including security chips, key management products, special cryptographic equipment and cipher development and production equipment, the export license of dual-use items and techniques shall be applied for with the MOC.

This Announcement shall enter into force on January 1, 2021, and the Announcement No. 18 of the State Cryptography Administration and the General Administration of Customs, the Announcement [2012] No. 64 of the General Administration of Customs and the State Cryptography Administration, the Announcement No. 27 of the State Cryptography Administration and the General Administration of Customs, and the Announcement No. 38 of the State Cryptography Administration, the Ministry of Commerce and the General Administration of Customs are to be repealed simultaneously.

http://www.mofcom.gov.cn/article/zwgk/zcfb/202012/20201203019733.shtml

 

MIIT announced the seventh batch of Apps for infringement on users’ rights and interests

On December 21, 2020, the Ministry of Industry and Information Technology (“MIIT”) announced the seventh batch of apps for infringement on users’ rights and interests. The main problems involved are as follows:

  1. collecting and using personal information in violation of laws and regulations;
  2. asking for permission mandatorily and in an excessively frequent way;
  3. deceiving and misleading users to download Apps; and
  4. App information on the App distribution platform is not clear.

https://www.miit.gov.cn/jgsj/xgj/gzdt/art/2020/art_13136b980ab444519feac1c3b3c48086.html

 

MHRSS: A human resource service agency shall ensure personal information security

On December 23, 2020, the Ministry of Human Resource and Social Security (“MHRSS”) issued the Administrative Provisions on Online Recruitment Services (the “Provisions”), which will take effect from March 1, 2021.

On personal information protection, the Provisions provide:

  • A human resource service agency engaged in online recruitment services shall strengthen cybersecurity management, fulfill cybersecurity protection obligations, and take technical or other necessary measures in accordance with the requirements of national cybersecurity laws, administrative regulations and multi-level protection system of cyber security, to ensure the security of the recruitment service network, information system and user information.
  • A human resource service agencyshall establish and improve the information protection system for online recruitment service users, and shall not disclose, tamper with, damage or illegally sell, or illegally provide other people with the ID card number, age, gender, address, contact information and business status of the employer.
  • Ahuman resource service agency shall conduct self-examination on the information protection of online recruitment service users at least once a year, record the self-examination situation, and timely eliminate the security risks found in the self-examination.
  • Where a human resource service agency engaged in online recruitment services does need to provide an overseas institution with the personal information and important data collected and generated in its operations within the territory of China due to business needs, it shall comply with relevant laws and administrative regulations of the State.

http://www.mohrss.gov.cn//xxgk2020/fdzdgknr/zcfg/bmgz/202012/t20201223_406512.html

 

MIIT issued the Construction Guidelines of Data Security Standard System in Telecom and Internet Industry

On December 25, 2020, the Ministry of Industry and Information Technology (“MIIT”) issued the Construction Guidelines of Data Security Standard System in Telecom and Internet Industry (the “Guidelines”)

The Guidelines include standards of basic generality, critical technology, safety management and critical areas. The standards of basic generality include the definition of terms, data security framework, data classification and grading, etc., which provide basic support for various standards. The critical technology standards regulate the critical technology of data security from a whole life cycle dimensions of data collection, transmission, storage, processing, exchange, destruction, etc. Security management standards include data security specification, data security assessment, monitoring, early warning and disposal, emergency response and disaster backup, security capability certification, etc. Critical areas standards include 5G, mobile Internet, Internet of vehicles, Internet of things, industrial Internet, cloud computing, big data, artificial intelligence, blockchain and other critical areas.

Data security standards in the field of the Internet of vehicles mainly include the data security of the cloud platform of the Internet of vehicles, the data security of V2X communication, the data security of the intelligent connected vehicle, and the data security of the mobile App of the Internet of vehicles, etc.

Data security standards in the field of mobile Internet mainly include personal information protection of mobile applications, SDK security of mobile applications, etc.

Data security standards in the field of artificial intelligence mainly include data security of artificial intelligence platform, personal information protection of artificial intelligence terminal, etc.

https://www.miit.gov.cn/zwgk/zcwj/wjfb/txy/art/2020/art_4a6aca0048b742ea97cfb280e981125e.html

 

CONTACT US

If you would like to receive our legal update via email, please contact jianghongyu@anjielaw.com.

For more information, please contact:

Samuel Yang | Partner

AnJie Law Firm

P: +86 10 8567 2968

M: +86 1391 0677 369

E: yanghongquan@anjielaw.com

Hongquan (Samuel) Yang is a partner with AnJie Law Firm. He has worked as in-house counsel and external lawyer in the technology, media and telecoms (TMT) sectors for nearly 20 years and is regarded as a true expert in these areas. He advises clients on a wide range of regulatory, commercial and corporate matters, especially in telecommunications, cybersecurity, data protection, internet, social networking, hardware and software, technology procurement, transfer and outsourcing, distribution and licensing, and other technology-related matters. He also advises clients on compliance and investigation matters.

Samuel has been recognized as a Leading Individual in PRC TMT firms (Legal 500, 2020), a Band 1 Cyber Security & Data Protection Lawyer (LEGALBAND, 2019, 2020) and one of the Top 10 Cyber Security and Data Protection Lawyers in China (LEGALBAND, 2018). Legal 500 commented that Samuel and his team at AnJie have a particular strength in “telecom-related regulatory and general commercial legal services” and “issues such as cyber security and data protection areas” and have “built a real niche” in these areas.

Samuel mainly serves Fortune 500 companies, large state-owned enterprises and leading Chinese internet companies. Samuel is a regular contributor to many legal journals and his publications regarding Chinese data protection and cybersecurity laws are well-received and widely reproduced.

Before joining AnJie, Samuel worked for British Telecom, CMS and DLA Piper.

REGULATIONS

NISSTC issued the Guidelines for Data Security of Online Car-booking Services (Draft for Comment)

On November 10, 2020, the Secretariat of the National Information Security Standardization Technical Committee (“NISSTC”) issued the Information Security Technology – Guidelines for Data Security of Online Car-booking Services (Draft for Comment) (the “Draft”) for public comments by January 8, 2021.

The Draft specifies the types, scope, methods and conditions of collection, storage, use, sharing, public disclosure and deletion of data, as well as data security management requirements.

The requirements of data collection are as follows:

  • before collecting the personal information of users, online car-booking service operators shall inform users and obtain the consent of users;
  • When users refuse to provide personal information other than the minimum necessary personal information, online car-booking service operators shall not refuse to provide the online car-booking service; and
  • When users refuse to provide the minimum necessary personal information corresponding to the optional business function of online car-booking service, online car-booking service operators can refuse to provide the corresponding optional business function service but should not refuse to provide online car-booking service.

The requirements of data transmission and storage are as follows:

  • When online car-booking service operators transmit personal information through the Internet, they should adopt security measures such as encryption;
  • Online car-booking service operators shall store the personal identification information, facial recognition features and audio and video trip recordings data of passengers and drivers separately;
  • It is not suitable for online car-booking service operators to store the travel track and audio and video trip recordings data in the office terminal, but in the server with security measures.

The Draft also stipulates that online car-booking service operators should not abuse big data analysis and other technical means to set unfair trading conditions based on user consumption records and consumption preferences, thus infringing on users’ legitimate rights and interests.

https://www.tc260.org.cn/front/bzzqyjDetail.html?id=20201110160208&norm_id=20201030200001&recode_id=40116

 

NISSTC issued the Guidelines on the Code of Ethics for Artificial Intelligence (Draft for Comment)

On November 9, 2020, the Secretariat of the National Information Security Standardization Technical Committee (the “NISSTC”) issued the Practice Guide to Cybersecurity Standards – Guidelines on the Code of Ethics for Artificial Intelligence (Draft for Comment) (the “Draft”) for public comments by November 23, 2020.

The Draft gives safety risk warnings regarding potential ethical issues associated with artificial intelligence (“AI”), and provides guidelines for AI research and development, design and manufacturing, deployment and application, consumer use and other related activities.

On deployment and application, the Draft stipulates that the deployer should explain the functions, limitations, risks and impacts of systems, products or services related to AI to users in a timely, accurate, complete, clear and unambiguous manner, and explain the relevant application process and application results. The deployer should also provide users with a clear and easy way to operate mechanism to refuse or stop using systems, products or services related to AI. After users refuse or stop using systems, products or services related to AI, the deployer should provide users with alternative non-AI options as far as possible.

https://www.tc260.org.cn/front/postDetail.html?id=20201109163419

 

RCEP: To protect the personal information of electronic commerce users

On November 15, 2020, the Regional Comprehensive Economic Partnership Agreement (“RCEP”) was concluded. The RCEP consists of 20 chapters, covering comprehensive market access commitments on goods, services, investment and other areas.

The Chapter “Electronic Commerce” of RCEP stipulates that the party to the RCEP is:

  • encouraged to improve trade management and procedures through electronic means;
  • required to create a favorable environment for electronic commerce, to protect the personal information of electronic commerce users, provide protection for online consumers, and strengthen supervision and cooperation on unsolicited commercial electronic information.

On cross-border transfer of information by electronic means, RCEP also provides the party shall not prevent cross-border transfer of information by electronic means where such activity is for the conduct of the business of a covered person.

http://fta.mofcom.gov.cn/rcep/rceppdf/d12z_en.pdf

 

Announcement on 35 App for non-compliance with collecting and using personal information

On November 13, 2020, Task Force on Apps for Illegal Collection and Use of Personal Information (“Force”) finds that there are problems in the collection and use of personal information of 35 Apps. It is suggested that the relevant App operators should rectify the existing problems in time and feedback the rectification situation to the Force within 30 days from now on. After the 30 days, the Force will verify the rectification situation, submit the review results to the relevant departments, and handle those that cannot be effectively rectified according to laws.

https://mp.weixin.qq.com/s/KGFSSM9yuIxs9Wrv2tR24w

 

Live streaming platforms shall establish a mechanism for personal information protection 

On November 13, 2020, the Cyberspace Administration of China (“CAC”) issued the Administrative Provisions on Live Streaming Marketing Information Content Services (Draft for Comment) (the “Draft”) to solicit public comments by November 28, 2020.

The Draft stipulates that live streaming platforms shall establish a sound mechanism for registration and cancellation of accounts and live streaming marketing business, information security management, codes of conduct for marketing, minors’ protection, users’ rights protection, personal information protection, credit evaluation and data security. At the same time, the Draft provides live streaming platforms shall strengthen the service management of live streaming information on the Internet. If illegal and bad information is found, it shall immediately take measures to deal with it, keep relevant records and report to the relevant competent authorities. Live streaming platform shall prevent and stop illegal advertising, price fraud and other violations of users’ rights and interests and warn users of the risks of private transactions outside the platform in a prominent way.

http://www.cac.gov.cn/2020-11/13/c_1606832591123790.htm

 

PBOC issued the Testing and Evaluation Guidelines for Classified Protection of Cybersecurity of Financial Industry and the Implementation Guidelines for Classified Protection of Cybersecurity of Financial Industry

On November 11, 2020, the People’s Bank of China(“PBOC”) formally issued two standards in financial industry, namely the Testing and Evaluation Guidelines for Classified Protection of Cybersecurity of Financial Industry (“Testing and Evaluation Guidelines”) and the Implementation Guidelines for Classified Protection of Cybersecurity of Financial Industry (“Implementation Guidelines”).

The Testing and Evaluation Guidelines stipulate the general requirements and extended requirements of security evaluation for Level-2, Level-3 and Level-4 protected objects in the financial industry. The Testing and Evaluation Guidelines are applicable to guide financial institutions, evaluation institutions and the competent departments of cybersecurity classified protection in the financial industry to conduct security evaluation on the security status of the classified protection objects.

The Implementation Guidelines include six parts, which regulate:

  • the cybersecurity framework of the financial industry and the security requirements corresponding to different security levels,
  • the basic framework and terminology definition of the cybersecurity level protection work in the financial industry,
  • the cybersecurity post setting requirements of financial institutions,
  • the cybersecurity post ability requirements,
  • the cybersecurity personnel ability evaluation requirements,
  • the cybersecurity training related requirements, and
  • the financial institutions cybersecurity level protection audit implementation requirements, etc.

The Implementation Guidelines are applicable to guide financial institutions, evaluation institutions and competent departments of financial industry to implement classified cybersecurity protection.

https://www.cfstc.org/bzgk/gk/view/bzxq.jsp?i_id=1891

https://www.cfstc.org/bzgk/gk/view/bzxq.jsp?i_id=1885

 

NISSTC issued the Practice Guide to Cybersecurity Standards – Security Guidelines for Using Software Development Kit (SDK) for Mobile Internet Applications

On November 27, 2020, the Secretariat of the National Information Security Standardization Technical Committee (“NISSTC”) issued the Practice Guide to Cybersecurity Standards – Security Guidelines for Using Software Development Kit (SDK) for Mobile Internet Applications (“Guidelines”).

The Guidelines provide the responsibilities of the parties involved in the use of the SDK and the common security issues, as well as the security principles and measures of App providers and SDK providers for common problems. The Guidelines are applicable to preventing SDK security and compliance risks when App providers use the SDK, and also provide reference for SDK providers in protecting SDK security and user personal information.

According to the Guidelines, App providers should take adequate security measures to ensure that there is no security risk when using SDKs, such as conducting security assessment on the SDK before integrating SDKs, conducting continuous dynamic monitoring or regular security assessment on the integrated SDK, signing a cooperation agreement with SDK providers or further improving the cooperation agreement with the SDK providers.

Besides, SDK providers should collect personal information at the lowest frequency necessary to realize its own business functions, and enhance its own security by means of code audit and code obfuscation.

https://www.tc260.org.cn/upload/2020-11-27/1606438309423027911.pdf

 

CONTACT US

If you would like to receive our legal update via email, please contact jianghongyu@anjielaw.com.

For more information, please contact:

Samuel Yang | Partner

AnJie Law Firm

P: +86 10 8567 2968

M: +86 1391 0677 369

E: yanghongquan@anjielaw.com

Hongquan (Samuel) Yang is a partner with AnJie Law Firm. He has worked as in-house counsel and external lawyer in the technology, media and telecoms (TMT) sectors for nearly 20 years and is regarded as a true expert in these areas. He advises clients on a wide range of regulatory, commercial and corporate matters, especially in telecommunications, cybersecurity, data protection, internet, social networking, hardware and software, technology procurement, transfer and outsourcing, distribution and licensing, and other technology-related matters. He also advises clients on compliance and investigation matters.

Samuel has been recognized as a Leading Individual in PRC TMT firms (Legal 500, 2020), a Band 1 Cyber Security & Data Protection Lawyer (LEGALBAND, 2019, 2020) and one of the Top 10 Cyber Security and Data Protection Lawyers in China (LEGALBAND, 2018). Legal 500 commented that Samuel and his team at AnJie have a particular strength in “telecom-related regulatory and general commercial legal services” and “issues such as cyber security and data protection areas” and have “built a real niche” in these areas.

Samuel mainly serves Fortune 500 companies, large state-owned enterprises and leading Chinese internet companies. Samuel is a regular contributor to many legal journals and his publications regarding Chinese data protection and cybersecurity laws are well-received and widely reproduced.

Before joining AnJie, Samuel worked for British Telecom, CMS and DLA Piper.

REGULATIONS

MIIT launches 2020 program of checking cyber security in telecommunications and internet industries

On October 9, 2020, the Ministry of Industry and Information Technology (“MIIT”) issued the Circular on Working Effectively on the 2020 Program of Checking the Cyber Security in the Telecommunications and Internet Industries (the “Circular”).

The Circular provides that the checking object includes networks and systems constructed and operated by basic telecommunication enterprises, Internet enterprises, domain name registration management and service institutions that have obtained the permission of competent telecommunication authorities according to the law. In addition, the checking will focus on the critical information infrastructure as well as important network units and their carrying information systems of the telecommunications and Internet industries, including but not limited to 5G network infrastructure, Mobile App Store, Internet of Things platforms, Industrial Internet platform, Internet of Vehicles application service platform and online car-hailing information service platforms.

Three main contents of the checking are the implementation of cyber security management, technical measures for cyber security protection, and hidden dangers of major cyber security risks.

http://www.miit.gov.cn/n1146285/n1146352/n3054355/n3057724/n3057729/c8112434/content.html

CAC seeks opinions on revising Administrative Provisions on Information Services Provided through Official Accounts to Internet Users

On October 15,2020, the Cyberspace Administration of China (“CAC”) issued the Administrative Provisions on the Information Services Provided through Official Accounts to Internet Users (Draft for Comments) (the “Draft”) for public comments by October 30, 2020.

The Draft stipulates that a platform for the information services provided through official accounts should: prohibit those official accounts that have been closed in accordance with the law and agreement from re-registering with the same account names; review the application for the registration of official accounts engaged in producing the information on the economic, education, health, justice and other fields, and require users to provide the evidentiary materials related to their professional background and professional qualifications when registering; official account information service platform can suspend or terminate the provision of services according to the service agreement for those official accounts that are not logged in or used for more than six months after Internet users have registered; prohibit the compulsory subscription to or following of official accounts of other users without the informed consent of Internet users; and ten kinds of behaviors are prohibited, among which it is required not to “manipulate and utilize multiple platform accounts, release homogeneous information in batch, generate false traffic data, and create false public opinion hot spots”.

http://www.cac.gov.cn/2020-10/15/c_1604325530663495.htm

Standing Committee of the National People’s Congress adopts the Export Control Law

 The Export Control Law of the People’s Republic of China (the “Export Control Law”), adopted at the 22nd Session of the Standing Committee of the 13th National People’s Congress on October 17, 2020, is promulgated, effective on December 1, 2020.

According to the Export Control Law, the term “export control” refers to prohibitive or restrictive measures taken by the State against the transfer of controlled items from the territory of the People’s Republic of China to overseas, and the provision of controlled items by citizens, legal persons and other non-incorporated organizations of the People’s Republic of China to foreign organizations and individuals.

The Export Control Law provides reciprocal measures: where any country or region harms the national security and interests of the People’s Republic of China by abusing the export control measures, the People’s Republic of China may take reciprocal measures against such country or region in light of the actual situations.

The Export Control Law also stipulates that where an exporter has established an internal compliance system for export control and is in good operation, the State’s export control authorities may grant it a general license or take other facilitation measures for relevant controlled items exported by it. Specific measures shall be formulated by the State’s export control authorities.

http://www.npc.gov.cn/npc/c30834/202010/cf4e0455f6424a38b5aecf8001712c43.shtml

China will establish a biosafety information sharing system and biosafety information release system

The Biosecurity Law of the People’s Republic of China (the “Biosecurity Law”) is adopted at the 22nd Session of the Standing Committee of the Thirteenth National People’s Congress of the People’s Republic of China on October 17, 2020, effective April 15, 2021.

The Biosecurity Law provides that the State will establishes a biosafety information sharing system. The national biosafety work coordination mechanism shall organize to establish a unified national biosafety information platform, and the relevant authorities shall collect and deliver the biosafety data and materials and other information to the national biosafety information platform to achieve information sharing.

In addition, the Biosecurity Law provides that the State will establishes a biosafety information release system. Major biosafety information such as the overall situation of the national biosecurity, major biosecurity risk warnings, major biosecurity incidents and their investigation and handling information shall be released by the members of the national biosafety work coordination mechanism according to the division of their responsibilities; other biosafety information shall be released by the relevant departments under the State Council, the local people’s governments at or above the county level and the relevant departments thereof according to their responsibilities and authority. No organization or individual may fabricate or spread false biosafety information.

The Biosecurity Law also requires that where the information on human genetic resources of China is to be provided or made available for use to any overseas organization or individual or the institution established or actually controlled thereby, a report shall be submitted in advance to the department in charge of science and technology under the State Council and information backup shall be submitted.

http://www.npc.gov.cn/npc/c30834/202010/85c189382f6641f8aac2fa1994809df7.shtml

The Chapter Network Protection has been added to the Law on the Protection of Minors

The 22nd Session of the Standing Committee of the 13th National People’s Congress adopted the Law of the People’s Republic of China on the Protection of Minors (Revised in 2020) (the “Law “) on October 17, 2020, which shall take effect from June 1, 2021.

The Chapter Network Protection has been added to the revised Law and the provisions on the protection of minors’ personal information are as follows:

  • Information processors who process personal information of minors through the Internet shall follow the principles of legality, legitimacy and necessity. On processing the personal information of minors under the age of 14, the consent of their parents or other guardians shall be obtained, except as otherwise provided by laws and administrative regulations.
  • If minors, theirparents or other guardians require the information processor to correct or delete the personal information of minors, the information processor shall take timely measures to correct or delete the personal information, unless otherwise provided by laws and administrative regulations.
  • If the Internet service provider discovers that minors release private information through the Internet, they shall prompt them in time and take necessary protection measures.
  • If the Internet service provider discovers that the user publishes or disseminates information that may affect the physical and mental health of minors without making a noticeable reminder, it shall make a reminder or notify the user to be reminded; if no reminder is given, the relevant information shall not be transmitted.
  • If the Internet service provider finds that the user publishes and disseminates the information that endangers the physical and mental health of minors, it shall immediately stop transmitting the relevant information, take measures such as deleting, shielding and disconnecting links, keep relevant records, and report to the cyberspace administration, public security and other departments.
  • If the Internet service provider discovers that a user has committed an illegal or criminal act against a minor by using its Internet service, it shall immediately stop providing Internet service to the user, keep relevant records and report to the public security organ.

http://www.npc.gov.cn/npc/c30834/202010/82a8f1b84350432cac03b1e382ee1744.shtml

Network transaction operators shall keep the personal information collected strictly confidential 

On October 20, 2020, the State Administration for Market Regulation issued the Measures for the Supervision and Administration of Online Transactions (the “Draft”) for public comments by November 2, 2020.

On the protection of personal information, the Draft stipulate that network transaction operators shall obtain the authorization and consent of the collector when collecting and using the personal information of users, and clearly state the purpose, necessity, scope and method of collection and use based on the principle of legality, legitimacy and necessity. It is not allowed to adopt a one-off general authorization method, or to force or disguisedly force the collector to agree to the collection and use of information that is not directly related to business activities by default authorization, binding with other authorizations, or stopping installation and use. When collecting and using sensitive information such as biometric information, health information, property information, social information, etc., authorization and consent of the collector shall be obtained one by one. Network transaction operators and their staff shall keep the personal information collected strictly confidential and shall not provide it to any third party, including related parties, without the authorization and consent of the collector.

http://www.samr.gov.cn/hd/zjdc/202010/t20201020_322434.html

MIIT strengthens in-process and ex-post regulation of foreign-funded telecommunications enterprises

On October 20,2020, the Ministry of Industry and Information Technology (“MIIT”) issued the Circular on Strengthening the In-process and Ex-post Regulation of Foreign-invested Telecommunications Enterprises (the “Circular”).

The Circular provides that the MIIT will cease to approve and issue the Examination Decision on Foreign Investment in Telecommunications (the “Decision”) from the date of issuance of the Decision of the State Council on Cancelling and Decentralizing a Number of Administrative Licensing Items, and the examination of foreign investments will be included in the process of approval of business licensing for telecommunications accordingly. The Circular further clarifies that foreign-invested enterprises that have been approved with the Decision issued previously may continue to apply for the business licensing for telecommunications in accordance with legal procedures. When directly applying for the business licensing for telecommunications or for changes in the telecommunications business, subsequent foreign-invested enterprises are required to concurrently submit relevant application materials on foreign investments, and the MIIT will handle the applications in accordance with laws and regulations.

The Circular also stipulates that restrictions on shareholding ratio held by foreign investors and other access policies and requirements shall be still subject to the Administrative Provisions on Foreign-funded Telecommunications Enterprises, the Telecommunications Regulations of the People’s Republic of China, the Special Administrative Measures (Negative List) for Foreign Investment Access, and other legal documents.

http://www.miit.gov.cn/n1146295/n1652858/n1652930/n3757020/c8126050/content.html

The Law of the People’s Republic of China on Personal Information Protection (Draft) is released

On October 21, 2020, the 22nd Session of the Standing Committee of the 13th National People’s Congress released the Law of the People’s Republic of China on Personal Information Protection (Draft) (the “Draft”) for public comments by November 19, 2020.

The Draft provides it shall apply to activities conducted by organizations and individuals to process the personal information of natural persons within the territory of the People’s Republic of China. And it shall also apply to activities outside territory of the People’s Republic of China to process the personal information of natural persons within the territory of the People’s Republic of China under any of the following circumstances:

  • personal information processing is to serve the purpose of providing products or services for natural persons within the territory of the People’s Republic of China;
  • personal information processing is to serve the purpose of analyzing and evaluating the behaviors of natural persons within the territory of the People’s Republic of China; or
  • having other circumstances as stipulated by laws and administrative regulations.

On the cross-border transfer, the Draft requires that critical information infrastructure operators and personal information processors who process personal information up to the amount as specified by the State cyberspace authorities shall store within the territory of the People’s Republic of China the personal information which they collect and generate within the territory of the People’s Republic of China. If it is really necessary to provide such information overseas, critical information infrastructure operators and personal information handlers shall pass security assessment organized by the State cyberspace authorities; if any law, administrative regulation or the State cyberspace authorities stipulate that security assessment may not be conducted, such provision shall prevail.

The Draft also provides that where personal information is processed in violation of this Law or personal information is processed without any necessary security protection measure in compliance with regulations, authorities performing personal information protection duties shall order a correction, confiscate any unlawful income, and issue a warning; and, if correction is not made, a fine of up to CNY1 million shall be imposed on the personal information processor if it is an organization; and any directly liable person-in-charge or any other directly liable individual shall be fined between CNY10,000 and CNY100,000. If the unlawful act mentioned in the preceding paragraph is grave, authorities performing personal information protection duties shall order a correction, confiscate any unlawful income, and impose a fine of up to CNY50 million, or 5% of last year’s annual revenue, and may also order the suspension of related business operations or suspension of business for rectification, and/or report to relevant competent authorities for the cancellation of the related business permit or cancellation of the business license; and any directly liable person-in-charge or any other directly liable individual shall be fined between CNY100,000 and CNY1 million.

http://www.npc.gov.cn/flcaw/userIndex.html?lid=ff80808175265dd401754405c03f154c

The Ministry of Industry and Information Technology announced the fifth batch of Apps on infringement of users’ rights and interests

The Ministry of Industry and Information Technology recently organized a third-party testing agency to inspect the mobile phone application software and urge enterprises which do not meet relevant requirements to rectify. As of October 26, there are 131 Apps that have not been rectified, and these Apps should be rectified before November 2. In this test, many problems were found in input method Apps, travelling Apps, e-commerce Apps, audio and video Apps. Some App stores and mobile application distribution platform management entities have not fulfilled their responsibilities, and SDK enterprises illegally collected user personal information.

http://www.miit.gov.cn/n1146290/n1146402/c8136537/content.html

 

CONTACT US

If you would like to receive our legal update via email, please contact jianghongyu@anjielaw.com.

For more information, please contact:

Samuel Yang | Partner

AnJie Law Firm

P: +86 10 8567 2968

M: +86 1391 0677 369

E: yanghongquan@anjielaw.com

Hongquan (Samuel) Yang is a partner with AnJie Law Firm. He has worked as in-house counsel and external lawyer in the technology, media and telecoms (TMT) sectors for nearly 20 years and is regarded as a true expert in these areas. He advises clients on a wide range of regulatory, commercial and corporate matters, especially in telecommunications, cybersecurity, data protection, internet, social networking, hardware and software, technology procurement, transfer and outsourcing, distribution and licensing, and other technology-related matters. He also advises clients on compliance and investigation matters.

Samuel has been recognized as a Leading Individual in PRC TMT firms (Legal 500, 2020), a Band 1 Cyber Security & Data Protection Lawyer (LEGALBAND, 2019, 2020) and one of the Top 10 Cyber Security and Data Protection Lawyers in China (LEGALBAND, 2018). Legal 500 commented that Samuel and his team at AnJie have a particular strength in “telecom-related regulatory and general commercial legal services” and “issues such as cyber security and data protection areas” and have “built a real niche” in these areas.

Samuel mainly serves Fortune 500 companies, large state-owned enterprises and leading Chinese internet companies. Samuel is a regular contributor to many legal journals and his publications regarding Chinese data protection and cybersecurity laws are well-received and widely reproduced.

Before joining AnJie, Samuel worked for British Telecom, CMS and DLA Piper.

REGULATIONS

The Chinese side proposes a Global Initiative on Data Security

On September 8, 2020, Foreign Minister Wang Yi delivered a keynote speech at a high-level meeting of an international seminar themed with “Seizing Digital Opportunities for Cooperation and Development” and proposed a Global Initiative on Data Security (“Initiative”). The Initiative mainly includes the following.：

First, approach data security with an objective and rational attitude, and maintain an open, secure and stable global supply chain.

Second, oppose using information and communications technology (ICT) activities to impair other States’ critical infrastructure or steal important data.

Third, take actions to prevent and put an end to activities that infringe upon personal information, oppose abusing ICT to conduct mass surveillance against other States or engage in unauthorized collection of personal information of other States.

Fourth, ask companies to respect the laws of host countries, desist from coercing domestic companies into storing data generated and obtained overseas in one’s own territory.

Fifth, respect the sovereignty, jurisdiction and governance of data of other States, avoid asking companies or individuals to provide data located in other States without the latter’s permission.

Sixth, meet law enforcement needs for overseas data through judicial assistance or other appropriate channels.

Seventh, ICT products and services providers should not install backdoors in their products and services to illegally obtain user data.

Eighth, ICT companies should not seek illegitimate interests by taking advantage of users’ dependence on their products.

https://www.fmprc.gov.cn/web/ziliao_674904/1179_674909/t1812949.shtml

  

The Ministry of Public Security issued the Guiding Opinions on the Implementation of Multi-Level Protection System of Cybersecurity and Critical Information Infrastructure Security Protection System

Recently, the Ministry of Public Security issued the Guiding Opinions on the Implementation of Multi-Level Protection System of Cybersecurity and Critical Information Infrastructure Security Protection System (“Opinions”), the Opinions mainly include the following:

  1. Implementing the multi-level protection system of national cybersecurity
  • Deepening the work of network classification filing

Network operators which are classified as Level 2 or above shall file with the public security organ and the competent department of the industry.

  • Carrying out cybersecurity classification assessment regularly

Network operators which are classified as Level 3 or above shall entrust a classification assessment institution in line with the relevant provisions of the state to carry out cybersecurity classification assessment once a year, and timely submit the assessment report to the public security organ and the competent department of the industry. The new network above Level 3 should be put into operation after passing the classification assessment.

  • Implementing cryptography security protection requirements

Network operators which are classified as Level 3 or above shall correctly and effectively adopt cryptography technology for protection and use cryptography products and services meeting relevant requirements.

  1. Establishing and implementing the critical information infrastructure security protection system
  • Organizing to identify critical information infrastructure

The competent departments (hereinafter referred to as the “ Protection Departments”) of important industries and fields, such as public communication and information services, energy, transportation, water conservancy, finance, public services, e-government, national defense science and technology industry, shall formulate rules for the recognition of critical information infrastructure in their respective industries and fields and report them to the Ministry of Public Security for the record.

  • Strengthening the protection of important data and personal information.

Establishing and implementing the important data and personal information protection system. Operators shall store within the territory of the People’s Republic of China the personal information and important data collected and generated during its operation within the territory of the People’s Republic of China. Where such information and data have to be provided abroad for business purposes, security assessment shall be conducted pursuant to relevant provisions.

http://www.nanning.gov.cn/zt/rdzt/2020wsxcz/zcfg_0910/t4461545.html

Beijing: allow foreign companies to invest in virtual private networks 

The State Council recently approved the Work plan for Deepening a New Round of Comprehensive Pilot Projects for the Opening up of Beijing’s Service Industry and the Construction of a Comprehensive Demonstration Area for the Expansion of National Service Industry (“Plan”), the Plan will:

  1. Allow foreign companies to invest in domestic internet virtual private networks (VPN), with a proportion of foreign shares not exceeding 50 percent. Overseas telecommunications carriers can set up joint ventures to provide such services for foreign enterprises in Beijing.
  2. Support the application of Internet of vehicles (intelligent connected-cars) and automatic driving map and build the Beijing–Shanghai Internet of vehicles highway.
  3. Standardize the safe and orderly cross-border flow of data, explore the establishment of data security management mechanisms such as data protection capability certification and promote the pilot project of security management and assessment on data cross-border transfer.

http://www.gov.cn/zhengce/content/2020-09/07/content_5541291.htm

 

The China Banking and Insurance Regulatory Commission：To standardize health management services of insurance companies to ensure the safety of relevant data and information

The China Banking and Insurance Regulatory Commission (“CBIRC”) has issued the Circular on Standardizing Health Management Services of Insurance Companies (the “Circular”) on September 6, 2020.

The Circular emphasizes the following personal information protection work:

  1. informing customers of the content, process, standard, term, precautions and possible risks of health management services in advance and obtain the informed consent of customers.Participation by any third-party service cooperation organization shall be informed at the same time;
  2. obtaining the consent of customer when obtaining the customer’s health data; and
  3. not providing the customer’s personal information or any health data without the authorization of the customer to ensure data security and protect personal privacy according to law.

http://www.cbirc.gov.cn/cn/view/pages/ItemDetail.html?docId=927766

 

The People’s Bank of China: To obtain the consent of financial consumers when collecting their financial information

 On September 15, 2020, the People’s Bank of China (“PBOC”) issued the Implementing Measures of the People’s Bank of China for Protection of Financial Consumers’ Rights and Interests (“Measures”), which will take effect on November 1, 2020.

On protection of financial information of consumers, the Measures provide that banks and payment institutions shall:

  • adhere to the principles of legitimacy, bona fide and necessity, and obtain the explicit consent of financial consumers or their guardians, unless otherwise stipulated by laws and administrative regulations;
  • not collect consumers’ financial information unrelated to their business, nor adopt improper means to collect consumers’ financial information, and nor force consumers to collect their financial information in disguise;
  • not refuse to provide financial products or services on the ground that financial consumers do not agree to have their financial information processed, except that processing their financial information is necessary for providing financial products or services;
  • use appropriate means to enable financial consumers to independently choose whether or not to consent to the use of their financial information by banks and payment institutions for the purposes of marketing, user experience improvement or market investigation. Where the financial consumers do not agree, banks and payment institutions shall not refuse to provide financial products or services.If banks and payment institutions send financial marketing information to financial consumers, they shall provide them with ways to refuse to continue receiving the financial marketing information;
  • specify in the terms the purpose, method and content of collection and scope of use, and remind financial consumers of the possible consequences of such consent in an obvious and easy-to-understand way where banks and payment institutions have obtained the consent to the collection and use of financial information from consumers under standard terms; and
  • use consumers’ financial information pursuant to the provisions of laws and regulations and for the purpose agreed between both parties and shall not use such information beyond the agreed scope.

http://www.pbc.gov.cn/tiaofasi/144941/144957/4099060/index.html

 

The Ministry of Commerce promulgated the Provisions on the Unreliable Entity List

 On September 19, 2020，the Ministry of Commerce promulgated the Provisions on the Unreliable Entity List (“Provisions”) which shall take effect from the same date of the promulgation.

The State shall establish the Unreliable Entity List System (“System”) and a working mechanism participated by relevant central departments (hereinafter referred to as “the Working Mechanism”) to take charge of organization and implementation of the System. The Office of the Working Mechanism is located at the competent department of commerce of the State Council.

The Working Mechanism shall, based on the results of the investigation and by taking into overall consideration the following factors, make a decision on whether to include the relevant foreign entity in the Unreliable Entity List (“List”), and make an announcement of the decision:

  • the degree of danger to national sovereignty, security or development interests of China;
  • the degree of damage to the legitimate rights and interests of enterprises, other organizations, or individuals of China;
  • whether being in compliance with internationally accepted economic and trade rules; and
  • other factors that shall be considered.

The Working Mechanism may, based on actual circumstances, decide to take one or several of the following measures (hereinafter referred to as the “Measures”) against the foreign entity which is included in the List, and make an announcement of the decision:

  • restricting or prohibiting the foreign entity from engaging in China-related import or export activities;
  • restricting or prohibiting the foreign entity from investing in China;
  • restricting or prohibiting the foreign entity’s relevant personnel or means of transportation from entering into China;
  • restricting or revoking the relevant personnel’s work permit, status of stay or residence in China;
  • imposing a fine of the corresponding amount according to the severity of the circumstances; and
  • other necessary measures.

http://www.mofcom.gov.cn/article/b/fwzl/202009/20200903002593.shtml

 

Beijing：To explore the establishment of international information industry and digital trade port

On September 21, 2020, the State Council announced the Overall Plan of China (Beijing) Pilot Free Trade Zone (the “Plan“).

The Plan points out that Beijing will explore the establishment of international information industry and digital trade port. The specific measures are as follows:

  • having priority to explore software real name certification, data origin label identification, import and export of data product, etc. on the premise of controllable risks;
  • building the digital copyright trading platform to promote the development of intellectual property protection and intellectual property financing business;
  • conducting efficient and convenient digital import and export inspection on software and Internet service trade;
  • actively exploring the third-party authentication mechanism for the data protection capability of enterprises; and
  • exploring the establishment of a website filing system to meet the needs of overseas customers.

http://www.gov.cn/zhengce/content/2020-09/21/content_5544926.htm?_zbs_baidu_bk

 

Task Force on Personal Information Protection by Apps: 81 Apps have personal information collection and use problems

On September 17, 2020, the Task Force on the Personal Information Protection by Apps (“Task Force”) found that there were problems in the collection and use of personal information in 81 Apps after the assessment and suggested that the relevant App operators should rectify the existing problems in a timely manner, and feedback the rectification situation to the Task Force within 30 days from the date of the announcement. After the 30 days, the Task Force will verify the rectification situation and submit the review results to the relevant departments; App operators who fail to effectively rectify relevant problems will be punished according to the law.

https://mp.weixin.qq.com/s/hLK2EziD8NSF3G1_0VR_Hg

 

FAQ and Handling Guide for Personal Information Protection by Mobile Internet Application (App) and other two standards released

In the recent 2020 National Cyber Security Promotion Week, the Task Force on the Illegal Collection and Use of Personal Information by Apps (“Task Force”) held a “App Personal Information Protection” theme release event in Beijing (“Event”). At the Event, three standards related to personal information protection by Apps, the FAQ and Handling Guide for Personal Information Protection by Mobile Internet Application (App) (“FAQ and Handling Guide”), Mobile Internet Application (App) System Permission Application Guidelines (“System Permission Guidelines”) and Security Guidelines for Third-Party Software Development Kit (SDK) in Mobile Internet Applications (App) (Draft for Comment) (“Draft SDK Security Guidelines”), were released.

The FAQ and Handling Guide addresses the problems of excessive collection, mandatory claims for permission, frequent claims for permission, and unsynchronized notification of the purpose of collection by Apps. Based on statistics on the frequency of related problems, it gives the top ten frequently asked questions and handling guidelines in current App personal information protection, in order to help App operators prevent and deal with related problems.

The System Permission Guidelines address typical issues such as mandatory, frequent, and excessive claims for system permissions by Apps, bundling authorization, privately calling permissions to upload personal information, and sensitive permissions abuse. It also provides the basic principles and security requirements for system permissions by Apps, which can help App providers standardize App system permission applications and use behaviors and prevent personal information security risks caused by improper use of system permissions.

The Draft SDK Security Guidelines address the problems of third-party SDK’s own security vulnerabilities, malicious third-party SDKs, and unlawful collection and use of personal information by third-party SDKs in the current third-party SDK use practice. Combined with current mobile Internet technology and application status, the Draft SDK Security Guidelines provide practical guidelines for App providers and third-party SDK providers on third-party SDK security issues, aiming to reduce App security and personal information security issues caused by third-party SDKs.

In addition to the above guidelines, the Event also released the promotion video and the English version of the national standard Information Security Technology – Personal Information Security Specification (GB/T 35273-2020) for reader’s convenience; as well as other work results relating to such as App security certification, free evaluation tools, research reports and popular science areas.

https://www.tc260.org.cn/front/postDetail.html?id=20200920124356

 

The People’s Bank of China issued the Financial Data Security Guidelines for Data Security Classification 

On September 23，2020，the People’s Bank of China (“PBOC”) issued the Financial Data Security Guidelines for Data Security Classification (“Guidelines”). The Guidelines applies to financial institutions to carry out data security classification work, as well as third-party assessment institutions to carry out data security inspection and evaluation.

According to the Guidelines, the financial data involved in the security classification include but are not limited to:

  • data collected directly (or indirectly) in the process of providing financial products or services, including data signed or collected through the counter with paper agreement and transferred or saved in computer system after information processing, and electronic information signed or collected through information system;
  • data generated and stored in the information system of financial institutions, including business data, operation and management data, etc.;
  • electronic data generated, exchanged and filed in the internal office network and office equipment (terminal) of financial institutions. For example, daily business processing information, policies and regulations, business or business management data temporarily stored in business terminals, e-mail information, etc;
  • electronic data formed by scanning or other electronic means of the original paper documents of financial institutions;
  • other data that should be classified.

At the same time, the Guidelines provides that according to the influence objects and the degree of impact caused by the data security damage of financial institutions, the data security level is divided into Level 5 to Level 1 from high to low.

https://www.cfstc.org/bzgk/gk/view/bzxq.jsp?i_id=1873

 

Implementation Plan for the Establishment of Beijing International Big Data Exchange: establish and perfect the new data element management system of “separation of ownership and right of use”

On September 29,2020, Beijing Local Financial Supervision and Administration and Beijing Municipal Bureau of Economy and Information Technology issued the Implementation Plan for the Establishment of Beijing International Big Data Exchange (“Plan”).

The Plan will establish and improve the new data element management system of “separation of ownership and right of use”, explore a new mechanism for orderly circulation and efficient utilization of data elements, deeply implement the Beijing big data action plan, and strengthen the integration and application of cross regional, cross domain, cross department and cross level data resources.

The Plan points out that Beijing municipal state-owned enterprises with high-quality data resources will restructure the existing exchange and change its name to Beijing International Big Data Exchange. Strategic investors such as central enterprises and Internet enterprises will be introduced in time to increase registered capital, change business scope and change trading varieties. The service content of Beijing International Big Data Exchange will include data information registration service, data product trading service, data operation management service, data asset financial service and data asset financial technology service

http://jrj.beijing.gov.cn/tztg/202009/t20200929_2103035.html

 

CONTACT US

If you would like to receive our legal update via email, please contact jianghongyu@anjielaw.com.

For more information, please contact:

Samuel Yang | Partner

AnJie Law Firm

P: +86 10 8567 2968

M: +86 1391 0677 369

E: yanghongquan@anjielaw.com

Hongquan (Samuel) Yang is a partner with AnJie Law Firm. He has worked as in-house counsel and external lawyer in the technology, media and telecoms (TMT) sectors for nearly 20 years and is regarded as a true expert in these areas. He advises clients on a wide range of regulatory, commercial and corporate matters, especially in telecommunications, cybersecurity, data protection, internet, social networking, hardware and software, technology procurement, transfer and outsourcing, distribution and licensing, and other technology-related matters. He also advises clients on compliance and investigation matters.

Samuel has been recognized as a Leading Individual in PRC TMT firms (Legal 500, 2020), a Band 1 Cyber Security & Data Protection Lawyer (LEGALBAND, 2019, 2020) and one of the Top 10 Cyber Security and Data Protection Lawyers in China (LEGALBAND, 2018). Legal 500 commented that Samuel and his team at AnJie have a particular strength in “telecom-related regulatory and general commercial legal services” and “issues such as cyber security and data protection areas” and have “built a real niche” in these areas.

Samuel mainly serves Fortune 500 companies, large state-owned enterprises and leading Chinese internet companies. Samuel is a regular contributor to many legal journals and his publications regarding Chinese data protection and cybersecurity laws are well-received and widely reproduced.

Before joining AnJie, Samuel worked for British Telecom, CMS and DLA Piper.

by Samuel Yang, AnJie Law Firm and Practical Law China

An overview of the regulation of cloud computing in China. This note covers the characteristics of cloud computing, including its risks and benefits, the regulatory framework for cloud computing in China and key issues in negotiating cloud computing services.

Scope of this note

What is cloud computing? 

Characteristics of cloud computing

Service models

Deployment models

Benefits of cloud computing

Risks of cloud computing

Cloud computing market development in China

Regulatory framework of cloud computing in China 

Internet resource co-ordination services

Licences required for operating cloud services

Foreign investment restrictions

Work-around arrangements for foreign investors

Security assessment measures for cloud computing platforms

Key legal issues in negotiating cloud service contracts 

Personal privacy and cybersecurity issues

IP protection issues

Service performance

Governing law and applicable law

Scope of this note

In recent years, China has been increasing its regulation in areas such as cybersecurity and data security with legislation such as the Cybersecurity Law 2016 (2016 CSL, with effect from 1 June 2017). Cloud computing is both a rapidly growing market in China as well as subject to this increasing regulatory regime. This note explores the general characteristics of cloud computing, including its risks and benefits, as well as its regulatory framework in China and key issues in negotiating cloud computing service agreements.

(For general information on regulatory developments of cybersecurity and data protection in China, see Practice  note, Quick guide: Cybersecurity and data protection: China.)

What is cloud computing?

Cloud computing is a style of computing in which dynamically scalable and often virtualised resources are provided as a service over the internet. The cloud is a metaphor for networks, internet, computers, laptops, mobile phones and other ways for users to access data centre operations according to their needs. Cloud computing can be powerful enough to reach 10 trillion operations per second, which can be used in computing-intensive operations such as simulating nuclear explosions and predicting climate change and market trends.

The Security Guide for Cloud Computing Services (2016) (Cloud Security Guide) (云计算安全指南2016) issued by the China Academy of Information Communications Technology (CAICT) (中国信息通信研究院) defined cloud computing as:

“a model that provides computing resource services through the network, through which customers, on a dynamic and self-service basis, receive and manage the computing resources provided by the cloud service providers according to their needs. Computing resources include servers, operating systems, networks, software, and storage devices.”

Characteristics of cloud computing

The characteristics of cloud computing include:

  • On-demand self-service. Customers can obtain the required computing resources with limited participation, or even without participation from cloud service providers. In some cases, customers can solely and independently determine the time and quantity of resources that they want to receive.
  • Ubiquitous access. Through a standard access mechanism, customers can use a computer, laptop, mobile phone, tablet or other terminals to access cloud computing services at any time and in any place.
  • Resource pooling. Cloud service providers provide resources (such as computing resources, storage resources and network resources) to multiple customers. These physical or virtual resources can be dynamically allocated or redistributed among the customers according to their needs.
  • Fast scalability. Customers can acquire and release computing resources as needed quickly, flexibly and conveniently. For customers, the resources are “infinite” and they can acquire additional resources at any time.
  • Measurable service. Cloud computing can automatically control or quantify resources in accordance with a variety of measurement methods (such as pay-per-view or re-charge). The measurements may include, for example, storage space, computing power, network bandwidth or active accounts.

Service models

Cloud computing technology is generally categorised into three different service models:

  • Infrastructure as a Service (IaaS). This model concerns the provision of computers, networking, storage, load balancing and virtual machines. These services and end-user hardware and software resources can be expanded or contracted according to customer needs.
  • Platform as a Service (PaaS). In this model, managed service providers help customers by providing work platforms, including execution time, databases, web services, development tools and operating systems, without the need for customers to manually allocate resources.
  • Software as a Service (SaaS). This model includes software components such as virtual desktops, utility applications, content resource management, email and software. In this model, the cloud service provider is responsible for installing, managing and operating the software, and customers log in and use the software through the cloud.

Deployment models

Depending on how the cloud is deployed, there are four models of cloud computing which meet varying customer requirements:

  • Public cloud. In this model, standardised applications, resources, storage and other services are provided to a variety of customers on a shared, self-service, “pay as you go” basis. This deployment model typically provides scalable cloud services and can be efficiently set up.
  • Private cloud. A private cloud is the cloud infrastructure operated solely for a single organisation, that is managed either internally or by a third party, and hosted either internally or externally. In this model, correction, inspection and other security issues need to be taken care of by the organisation itself. In addition, the entire system also requires the organisation’s own money to buy, build and manage. This cloud computing model can provide the full benefit and functionality of the service to its owner.
  • Community cloud. This model is built on a specific group of multiple similar targets, such as companies, that share a common set of infrastructure and the related costs.
  • Hybrid cloud. A hybrid cloud is a mixture of two or more cloud computing models, such as public and private clouds. The models are independent of each other, but are all included within the cloud, so organisations can take advantage of a tailored mix of cloud computing models.

Benefits of cloud computing

The main benefits of cloud computing include:

  • Reducing overhead and energy consumption. The use of cloud computing services can convert hardware and infrastructure construction funds into on-demand services. Customers only pay for the resources used and do not need to bear the cost of building and maintaining the infrastructure, therefore avoiding incurring capital investment. Cloud service providers use a variety of technologies, such as cloud infrastructure, virtualisation, dynamic migration and workload consolidation, to improve resource utilisation so that free resource components can be shut down to reduce energy consumption. Multi-tenant sharing mechanisms and the centralised sharing of resources can meet the peak demand for multiple customers in different time periods, therefore avoiding wasting resources due to capacity design and impact on performance by peak demand. Cloud services reduce operating costs and energy consumption effectively, and therefore are considered to be environmentally friendly.
  • Enhancing business flexibility. Customers using cloud computing services do not need to build a dedicated information system. This shortens the business system construction cycle, enables customers to focus on business functions and innovation, and improves business response speed and quality of service.
  • Improving availability of business systems. The resource pooling and scalability of cloud services enable customers to expand their business systems dynamically to meet the rapid expansion of their business and avoid the interruption of customer service systems due to sudden increases in demand. The backup and multi-copy functions of cloud computing can improve the robustness and availability of business systems and avoid data loss and business failures.
  • Access to professional services. Cloud service providers have professional staff and can update or adopt advanced technologies and equipment in a timely manner. The professional technical, management and personnel support of cloud service providers can give access to a higher level of advanced technical services.

Risks of cloud computing

Major risks for customers using cloud computing solutions include:

  • Weakened ability to control data and business systems. In the cloud computing environment, customers migrate their data and business systems to cloud service providers’ cloud computing platforms, thereby losing the direct control over these data and business systems.
  • Difficulty in dividing responsibility between customer and cloud service provider. In the cloud computing environment, the responsibility for customer management and the responsibility for the customer’s data security are accorded to different persons, and it is not easy to delineate the responsibility between them. Furthermore, different service patterns and deployment patterns and the complexity of the cloud computing environment also increase the difficulty of dividing the responsibility between cloud service providers and customers. In addition, cloud service providers may also purchase services from other cloud service providers which will lead to more difficulty in defining their responsibility.
  • Jurisdiction issues. The actual storage location of the data is often outside the customer’s control. Authorities in some countries may require cloud providers to provide access to these data centres in accordance with their national laws, and may even require the providers to provide access to data stored in other countries’ data centres, which changes the jurisdictional relationship between an organisation and its data. (For more information on the Chinese regulatory regime on data transfers from China to other jurisdictions, see Practice note, Cross-border data transfers: China.)
  • Challenges to ownership of customer data. Customer data which is migrated to the cloud computing environment and the data which is generated and accessed in subsequent processes are both under the cloud service providers’ control, and the providers are able to access or use the customer data. In contrast, customers may need to be authorised by the cloud service providers to access, use and manage their own data. If there is no clear regulation, the customer’s ownership and control of its own data is difficult to be guaranteed.
  • Data protection is more difficult. Cloud computing platforms use virtualisation and other technologies to achieve multi-customer shared computing resources. Because the barriers and other protections between virtual machines are vulnerable to attack, the risk of unauthorised data access across virtual machines is significant. As the complexity of cloud computing platforms increases, it is more difficult to implement effective data protection measures against the risks of unauthorised access, tampering, disclosure and loss of customer data. The Chinese government is also planning a new Data Security Law, see Legal update, NPC Standing Committee circulates draft Data Security Law.
  • Data residue. Storage media that store customer data are owned by the cloud service providers, and customers do not manage or control the storage media directly. When customers exit the cloud computing services, the cloud service providers should completely delete the customers’ data, including the backup data. However, to date there are no valid mechanisms, standards or tools in place to verify that the cloud service providers have fully deleted these data. The data may still partially or even completely remain on the cloud computing platform after the client exits the cloud computing service.
  • Potential dependence on specific service providers. Due to the lack of uniform standards and interfaces, customer data and services on different cloud computing platforms are difficult to migrate between platforms, as well as to migrate back from a platform to the customer’s data centre. In addition, cloud service providers, for their own benefit, are often reluctant to provide portability for customers’ data and business. This potential dependence on specific cloud service providers may cause the customer’s business to break down with an interruption to the provision of cloud services that, if severe enough, could result in data and business migration to other cloud service providers at a high cost. Another factor in the potential over-reliance on specific service providers is that the cloud computing service market is still maturing, with limited cloud service providers to choose from.

Cloud computing market development in China

China’s cloud computing market is maintaining an overall trend of rapid development with the following features:

  • Public cloud services are expanding gradually from the internet sector to the industry market.
  • The hardware market dominates the domestic private cloud market.
  • Cloud services, and IaaS in particular, are fully embraced by domestic enterprise users. The domestic IaaS market is the first choice for small and medium enterprises for information technology (IT) resources construction in the fields of games, video and mobile internet.
  • PaaS services have become an important platform and the first choice for internet enterprises due to the low cost, fast deployment, and rich application programming interfaces (APIs) for developers. From the user application perspective, the market is demanding changes to services from initial search or map engine services and web services to big data analysis, security monitoring and other more complex services.
  • SaaS services account for the majority of the cloud computing market demand.

Regulatory framework of cloud computing in China

There were no specific laws and regulations regulating cloud computing services in China before the promulgation of the Circular of the Ministry of Industry and Information Technology on Issuing the “Classified Catalogue of  Telecommunications Services” 2015 (2015 Telecoms Catalogue, with effect from 1 March 2016) by the Ministry of  Industry and Information Technology (MIIT). Although the 2015 Telecoms Catalogue also does not define computing” or “cloud service”, it is generally accepted that the term “internet resource co-ordination services” (IRCS) (互联网资源协作服务业务) in the catalogue refers to cloud services.

For more general information on the regulatory framework of telecommunications in China, see Practice note, Regulation of telecommunications sector in China: Regulatory framework for telecoms sector.

Internet resource co-ordination services

According to the 2015 Telecoms Catalogue, IRCS means:

“the data storage, internet application development environment, internet application deployment and operation management and other services provided for users through internet or other networks in the manners of access at any time and on demand, expansion at any time and co-ordination and sharing, by using the equipment and resources built on database centres” (section B11).

In addition to the catalogue, the MIIT also released the Notice on the Regulation of Cloud Service Market’s Business  Conduct (Draft for Public Comment) (Draft Notice) (关于规范云服务市场经营行为的通知（公开征求意见稿) in November 2016, which expressly states that “cloud service” is one type of IRCS mentioned in the 2015 Telecoms Catalogue (Article 1).

Licences required for operating cloud services

Under the 2015 Telecoms Catalogue, IRCS is a type of Internet Data Centre Service (IDC) (互联网数据中心业 务), which are categorised as value-added telecoms services (VATS). Providing VATS in China requires a telecoms licence (VATS licence) (see Practice note, Regulation of telecommunications sector in China: Telecoms licensing).

Accordingly, the operation of cloud services in China requires a VATS licence dedicated for IDC business, which is also known as an IDC licence.

The description of the term “IRCS” in the 2015 Telecoms Catalogue is broad and generally understood to cover all types of cloud services, namely IaaS, PaaS and SaaS. Accordingly, in theory the operation of all these types of cloud services requires a VATS license dedicated for IDC business. However, according to the MIIT’s 2017 interpretation  the operation of certain types of SaaS services does not require a VATS license if those services are regarded as “pure software services” and do not involve other VATS under the 2015 Telecoms Catalogue.

Foreign investment restrictions

In theory, subject to some foreign capital ratio restrictions, foreign-invested enterprises (FIEs) can apply for an IDC licence according to the Provisions on the Administration of Foreign-Invested Telecom Enterprises 2008  (2008 Foreign-Invested Telecoms Regulations, revised in 2016). The 2008 Foreign-Invested Telecoms Regulations state that a foreign-invested telecommunications enterprise (FITE) operating VATS may not have foreign investors’ capital contribution exceeding 50% (Article 6). In addition, the regulations also require that an FITE providing VATS has registered capital meeting the following minimum capital requirements:

  • At least RMB10 million if the FITE’s operation is nationwide or cross-provincial.
  • At least RMB1 million if the FITE’s operation is within a single province. (Article 5.)

However, as IDC services were not part of the scope of VATS to be opened up to foreign investment that China made at its accession to the WTO on 11 December 2001, IDC licences have only been granted to Chinese companies and their joint ventures with Hong Kong and Macau investors, and not to companies invested in by investors from other jurisdictions. Although Hong Kong and Macau investors are to some extent also treated as foreign investors by Chinese authorities, their eligibility for IDC licences was specially granted in the Closer Economic Partnership Arrangements (each, a CEPA agreement) entered into by China in 2003 with Hong Kong and Macau, respectively. Each CEPA agreement allows Hong Kong and Macau investors to set up joint venture enterprises with Chinese investors in China to provide IDC services. Hong Kong and Macau service suppliers’ shareholding in these joint ventures may not exceed 50% and there is no geographic restriction for the provision of the IDC services within China. For more information on the preferential policies for Hong Kong and Macau service providers under other CEPA arrangements, see Practice note, Regulation of telecommunications sector in China: Preferential policies  under CEPAs.

Except for these special rules for Hong Kong and Macau, foreign investors from other jurisdictions are not eligible for the application of an IDC licence. According to the MIIT website, as of 14 August 2020 there are only twenty Sino-Hong Kong joint ventures which have been granted the VATS licence for the operation of IDC services.

Work-around arrangements for foreign investors

As most foreign-invested companies are not eligible to apply for the IDC licence, they are not allowed to operate cloud services in China under their own names. Foreign cloud service providers have to co-operate with Chinese IDC licence holders to provide cloud services to their customers. These types of co-operation are mainly based on contractual arrangements between the foreign cloud service providers and relevant Chinese IDC licence holders, such as technology licensing, brand licensing and other contractual arrangements, to ensure the foreign cloud service providers can participate in the relevant decision-making process.

However, some types of contractual arrangements between foreign cloud service providers and the relevant Chinese VATS licence holders seem to raise issues of concern to the MIIT, and the Draft Notice appears to have been issued to correct those suspect arrangements. According to the Draft Notice, foreign investors are required to strictly comply with the 2008 Foreign-Invested Telecoms Regulations and the CEPA agreements and other relevant policies concerning IDC services, and to apply for the establishment of FITEs and obtain the corresponding VATS licences before they can operate cloud services in China (Article 3). In addition, the Draft Notice specifically requires Chinese licensed cloud service providers to report their technical co-operation with “relevant entities” to the MIIT, and in the course of such co-operation the licensed cloud service providers should not:

  • Lease or assign their telecoms service licences to the counterparties in any form, or provide resources, venues, facilities or other conditions to the counterparties for their illegal operation.
  • Allow the counterparties to sign contracts with customers directly.
  • Allow the cloud services to be provided only under the trade marks and brands of the counterparties.
  • Illegally provide users’ personal information and network data to the counterparties.
  • Engage in any other illegal acts.

(Article 4.)

The Draft Notice also requires cloud service providers to establish their cloud service platforms in China. When cross-border connectivity is needed, the relevant servers should be connected to overseas networks through the international internet gateways approved by the MIIT. It is forbidden to establish or use other channels for cross border connectivity through private lines, virtual private networks (VPNs) and other means (Article 7). When providing services to domestic customers, service facilities and network data should be kept within China and cross border operation and maintenance and data flow should comply with the relevant regulations (Article 9(4)).

These restrictions on the co-operation between licensed cloud service providers and their contractual counter parties indicate that foreign cloud service providers, when co-operating with Chinese licensed cloud service providers, can only play a subordinate role and that any attempt to “control” the Chinese counterparties would likely be challenged by the MIIT.

Security assessment measures for cloud computing platforms

On 2 July 2019, the MIIT together with other ministries jointly issued the Measures on Security Assessments for Cloud Computing Services 2019 (Measures) (云计算服务安全评估办法), with effect from 1 September 2019. The Measures intend to further flesh out the provisions of the 2016 CSL by improving the security and controllability of cloud computing services procured and used by the Communist Party and government organs and operators of critical information infrastructure (CII). The Measures provide that a cloud computing services provider may apply to conduct a security assessment for a cloud platform, and must submit to the security assessment office a declaration form, as well as a cloud computing service system security plan, reports on the continuity of the business, the security of the related supply chain and the feasibility of customer data migration, and other materials.

For more information on the measures, see Legal update, CAC and others issue security assessment measures for cloud computing services platforms.

Key legal issues in negotiating cloud service contracts

Cloud service providers often do not allow changes to their standard terms and conditions. Considering the multi tenant shared operating model and the multiple components involved in cloud solutions (except for private cloud), proposed changes from different customers may vary greatly. Therefore, it is not economical for cloud service providers to spend time and resources negotiating with customers, especially small and medium-sized customers, to customise their contracts.

Where cloud service providers are willing to discuss changes to their terms and conditions (normally with large corporate customers that have stronger bargaining power), customers are recommended to do their due diligence first to understand any potential legal compliance issues with the proposed cloud solutions or if any gaps exist between the customers’ expectations and the proposed cloud solutions. Customers then need to prioritise the areas they want to mitigate against these issues and deal with them accordingly. The areas of data protection and cybersecurity, intellectual property (IP) rights and service performance are perhaps among the most important for all cloud computing contracts.

Personal privacy and cybersecurity issues

Personal privacy and cybersecurity issues have become some of the primary factors that customers need to take into account in deciding whether to migrate their IT infrastructure to the cloud. The service calculation mode, dynamic virtualisation management and multi-tenant shared operating model of cloud computing services pose a serious challenge to the security and privacy of personal and business data. Both customers and cloud service providers must comply with applicable laws governing personal privacy protection and cybersecurity. Although still at an early stage, various Chinese laws and regulations have imposed some fundamental principles for the protection of personal privacy and cybersecurity (for example, see Practice note, Data privacy in China and Security assessment measures for cloud computing platforms). Before entering into a cloud service contract, the customer needs to ensure that the transfer of personal data to the cloud service provider has been notified to the relevant personal data subjects and that the subjects have consented to the transfer. As the cloud service customer is primarily responsible for the security and personal privacy of its own customers’ data, it needs to ensure that personal data and other customer data are handed over to cloud service providers with sound and robust safeguards. The cloud service provider has the responsibility to ensure the safety of customer data, including personal data processed on behalf of the customers.

The Provisions on Protecting the Personal Information of Telecommunications and Internet Users 2013 issued by the MIIT require that telecommunications business operators and internet information service providers be responsible for the security of users’ personal information as collected and used during the provision of services.

This obligation applies to cloud service providers. Accordingly, in a cloud service contract the customer should require the cloud service provider to abide by all relevant legislation in the personal data protection and cybersecurity areas. The contract should stipulate that the cloud service provider must not release any information to a third party, even when they are requested to disclose the information by a foreign government.

Moreover, the customer should require the cloud service provider not to access, revise, release, use, transfer or destroy any data from the customer without the customer’s consent. (For more information, see Practice note, Data  privacy in China: Data privacy principles).

In addition, when entering into a cloud services contract both the customer and the cloud service provider need to take into account regulations restricting data flow to foreign jurisdictions. This restriction typically applies to those industries which are considered to concern the national security of China. For example, the 2016 CSL requires operators of CII to store within China personal information and important business data that was collected in China. However, these may be transmitted abroad on successful completion of a security assessment by the relevant authorities (Article 37). The cloud service customer therefore needs to assess whether its IT infrastructure can be regarded as CII and if so, it will need to take the relevant requirements into account in the selection of a cloud service provider, and work with the provider to put in place technical and management measures and contractual terms to ensure that the data flows are compliant.

For more information on the 2016 CSL, see Legal update, China passes Cybersecurity Law.

For more information on cross-border data transfers, see Practice note, Cross-border data transfers: China.

For more information on the protection of personal data privacy in China generally, see Practice notes, Data privacy  in China and Data breach notification in China.

IP protection issues

Cloud computing can raise complex IP issues. On the one hand, IP rights are specific to jurisdictions. IP laws vary among jurisdictions, so a protectable IP right in one jurisdiction may not be protected equally, if at all, in another jurisdiction, and an infringement of IP rights in one jurisdiction may not be an infringement in another jurisdiction.

On the other hand, cloud computing is meant to break boundaries and work across jurisdictions, as in the cloud computing environment technology and data are frequently used beyond national borders. This tension can be a significant issue for both cloud service providers and their customers. Both parties should be clearly aware of the specific differences in IP laws that are relevant to their business operations, and should actively manage those discrepancies through their contractual arrangement with each other or through other means, to mitigate the risks of infringing the IP rights of third parties or suffering infringement of their own IP rights.

Another reason for the complexity of IP rights is that cloud computing solutions include multiple components and the relevant IP rights may belong to different licensors. The cloud service provider which signs the contract with a customer may not have the right to license or sublicense all of these IP rights to the customer. A defect which exists in any part of the licensing chain from the original licensor to the customer may present licensing risks and potential liabilities to the customer. Even if the cloud service provider has the right to license or sublicense the necessary IP rights to the customer, the customer may face the risk of service interruption if an essential IP licence in the cloud solution expires and the cloud service provider fails to renew it or provide an alternative solution. To mitigate these risks, the customer should seek full IP right indemnities from the cloud service provider for all service offerings in the cloud solution, while the cloud service provider may try to defend its position by only providing limited indemnities, or by leaving room for it to seek alternative solutions to replace the IP-flawed solutions without providing any indemnities to the customer.

Service performance

In a typical software licensing agreement or hardware sale agreement, there normally is no measurement, or only very simple measurements, provided to determine whether the product performs “normally”. Moreover, due to the vague standards of good performance, usually no compensation is provided to the customer if the software or hardware does not perform well enough. However, as cloud computing is provided as a service covering hardware, software, network and maintenance, there are several more measurable parameters which can be used to determine if the cloud service is provided up to certain standards. It is therefore possible, and necessary, to set up a mechanism of service performance measurement for cloud services and corresponding compensation payable to the customer for poor performance. This mechanism is now a common practice in the cloud industry and is known as a service level agreement (SLA).

The measurements under an SLA can include availability of the service (normally in the form of the percentage of usable time against a certain period of time), the cloud service provider’s response time for customer fault reports, time needed to fix problems (known as mean time to repair or MTTR) or other specific measurable parameters depending on the nature of the cloud services provided. Accordingly, if the cloud service provider fails to meet the relevant parameters set out in the relevant SLA, then a calculated compensation (known as service credits) will be paid by the cloud service provider to the customer. The customer should analyse the measurable parameters in its contracted cloud service and seek to agree with the cloud service provider on the applicable service credits and other SLA provisions. Given that customers may have migrated their essential operating systems and applications to the cloud, they may not tolerate any outage or interruption of the cloud service. A “business continuity” clause deals with how the cloud service provider should act to ensure that the customer can still use the contracted services in the event of an outage or interruption of service. This normally involves the customer requiring certain visibility, as a contractual right, of the cloud service provider’s business continuity plan (BCP). The customer may also require that the provider’s BCP and any changes to it should be discussed with and approved by the customer to ensure that the customer’s own BCP requirements will be integrated as part of the cloud service provider’s BCP practice.

Governing law and applicable law

Cloud service providers and their customers are sometimes located in different jurisdictions, and the operation of the cloud service may also involve other jurisdictions. Therefore, governing law issues should be carefully considered taking into account, for example, whether the law of the relevant jurisdiction has a different set of rules for the handling of personal data and business data from the principles agreed by the parties in the agreement. For example, the data protection rules of the EU are generally stricter than those in China (for more information, see Practice  notes, Data privacy in China and Overview of EU General Data Protection Regulation).

The concept of applicable law is different from the governing law of the agreement, and knowing this is especially important for a customer entering into a cloud service contract. Depending on the jurisdictions where the cloud service provider operates, the laws and regulations of multiple jurisdictions may be applicable to the cloud service.

While it is generally still a good practice for the customer to require the cloud service provider to comply with all applicable laws, the customer should assess whether it will become subject to the laws of a specific jurisdiction because its data will be processed or stored there. If those laws would present challenges to the secrecy and security of its data, the customer may need to consider whether technical measures should be put in place by the cloud service provider to prevent, if possible, the data from being stored or processed in that jurisdiction to avoid the application of its laws.

The Ministry of Commerce launches pilot program on security management for cross border data transfer

On August 14, 2020, the Ministry of Commerce (“MOC”) issued the Master Plan for Comprehensively Deepening the Pilot Program on Innovative Development of Trade in Services (“Plan”), covering 28 provinces and municipalities directly under the Central Government (regions), including Beijing, Tianjin and Shanghai, and the period for the pilot program will be three years.

The Plan proposes to：

  • establish dedicated Internet data channel in pilot areas where feasible, and the Ministry of Industry and Information Technology(“MIIT”) shall formulate relevant policies;
  • explore the classification and supervision model of cross-border data flow and carry out the pilot program for cross-border data transfer security management. Office of the Central Cyberspace Affairs Commission shall formulate relevant policies, pilot program work for cross-border data transfer security management shall be implemented in pilot areas such as Beijing, Shanghai, Hainan, and Xiong’an New Area;
  • develop cross-border services such as big data collection, storage, processing, analysis, mining and trading based on industrial Internet in pilot areas;
  • explore the rules and standards of data service collection, masking, application, trading, supervision, etc.;
  • promote the commercialization and securitization of data assets, and explore the formation of new models for trading of big data;
  • carry out security assessment on cross-border data flow in pilot areas; and
  • establish data security management mechanisms on data protection capability certification, data circulation backup review, cross-border data flow and transaction risk assessment, etc.; encourage cooperation in international cooperation on digital rules in pilot areas and strengthen the protection of data.

For more information ，please refer to http://images.mofcom.gov.cn/fms/202008/20200814092010665.pdf

 

China proposes to tighten controls on import and export of commercial cryptography products.

On August 20, 2020, the State Cryptography Administration released the Regulations for the Administration of Commercial Cryptography (Draft for Comment) (“Draft Regulations”) to solicit public opinions by September 19, 2020.

The Draft Regulations provide that, import of the commercial cryptography in the “Commercial Encryption Import License List” and export of the commercial cryptography in the “Commercial Encryption Export Control List” should be subject to the import and export license for dual-use items issued by the competent commercial department of the State Council.

According to the Draft Regulations, operators of networks and information systems such as unclassified critical information infrastructure, network of Grade III or above (under the network graded protection regime), and national government information system shall:

• use commercial cryptography for protection;

• formulate commercial cryptography application scheme;

• have necessary funds and professionals;

• plan, construct and operate the commercial cryptography safeguard system synchronously;

• carry out the security assessment on commercial cryptography application by itself or commercial cryptography testing institutions.

The above-mentioned network and information systems can be put into operation only after the security assessment on commercial cryptography application. After operation, the assessment shall be conducted at least once a year, and the assessment results shall be filed with the local municipal cryptography administrative department.

The Draft Regulations provide that operators of networks and information systems such as unclassified critical information infrastructure, network of Grade III or above, and national government information system should use commercial cryptography products and services that have been tested or certified, and use commercial cryptography technology listed in the Guidance Catalog of Commercial Cryptography Technology.

The Draft Regulations stipulate that if operators of critical information infrastructure purchase network products and services involving commercial cryptography, which may affect national security, they shall pass the national security examination organized by the state cyberspace department, the state cryptography department and other relevant departments according to the law.

For more information ，please refer to http://www.oscca.gov.cn/sca/hdjl/2020-08/20/content_1060779.shtml

 

China released the revised Catalogue of Technologies Prohibited and Restricted from Export

On August 28, 2020, the Ministry of Commerce and the Ministry of Science and Technology jointly released the revised Catalogue of Technologies Prohibited and Restricted from Export (“Catalogue”). The revisions of the Catalogue removed 4 items of technologies prohibited from export, removed 5 items of technologies restricted from export, added 23 items of technologies restricted from export, and revised technical parameters of 21 items of technologies.

It is worth noting that, in the export restriction section, the Catalogue adds “personalized information push service technology based on data analysis” and “technology of unmanned aerial vehicles”.

For more information ，please refer to http://www.most.gov.cn/kjbgz/202008/t20200828_158546.htm

 

NISSTC seeks public opinions on the Information Security Technology – Cyber-data Process Security Specification

On August 31, 2020, the National Information Security Standardization Technical Committee (“NISSTC“) issued the Information Security Technology – Cyber-data Process Security Specification (Draft for Comment) (“Draft Specification”) for public comments by October 27, 2020.

Highlights of the Draft Specification include:

Provision of data to others: Before providing data to others, network operators should conduct security impact analysis and risk assessment. If national security, public security, economic security, and social stability will be endangered, they must not provide the data to others.

Responsible person for data security: When network operators carry out business and service activities and collect important data and personal sensitive information, they should clarify the person responsible for data security and provide them with necessary resources to ensure that they perform their duties independently. The person in charge of data security should have professional knowledge of data security and relevant management work experience, participate in important decisions related to data processing activities, and perform the following duties:

a) organizing and determining the data protection catalog, formulating a data security protection plan and supervising the implementation;

b) organizing and carrying out data security impact analysis and risk assessment, and supervising the rectification of security risks;

c) reporting data security protection and incident handling to the cyberspace administration and relevant departments as required; and

d) organizing to accept and handle data security complaints and reports.

Transmission and storage: Network operators should take security measures for data transmission and storage activities, including:

a) When transmitting important data and personal sensitive information, security measures such as encryption should be adopted;

b) When storing important data and personal sensitive information, security measures such as encryption, secure storage, access control, and security audits should be adopted; and

c) The storage of personal information should not exceed the storage period agreed with the personal information subject, unless otherwise provided by laws and regulations.

The Draft Specification also provides special rules for the protection of personal information in public health emergencies. For example, in the process of providing information services, when face recognition is used as the authentication method, other authentication methods should be provided for users to choose in principle. The original image that can extract the face recognition information shall not be retained in principle when using face recognition information for identity verification.

For more information ，please refer to https://www.tc260.org.cn/front/postDetail.html?id=20200830094619

 

MIIT: No user’s consent, No commercial SMS or calls

On August 31, 2020, the Ministry of Industry and Information Technology (“MIIT”) issued the Administrative Regulations on Short Messages and Voice Call Service (Draft for Comments) (“Draft Regulations”) to seek public comments by September 30, 2020.

According to the Draft Regulations, any organization or individual shall not send commercial short messages or make commercial telephone calls to the user without his/her consent or request, or if he/she has explicitly refused to receive such SMS/calls. If the user does not explicitly agree, it shall be deemed as refusal. If the user agrees previously and explicitly refuses to accept it later, sending commercial short messages or making commercial telephone calls shall be terminated. If a short message service provider sends port type commercial short messages, it shall ensure that the relevant user has agreed or requested to receive these messages and keep the user’s consent proof for at least five months. A voice call service provider shall not make platform commercial calls, or provide communication resources, platform facilities and other conditions for organizations and individuals who make commercial calls in violation of the Draft Regulations.

For more information ，please refer to http://www.miit.gov.cn/n1146285/n1146352/n3054355/n3057709/n3057717/c8067025/content.html

 

Ministry of Culture and Tourism: Big data analysis and other technical means must not be abused to violate tourists’ rights

On August 31, 2020, the Ministry of Culture and Tourism issued the Interim Provisions on Administration of Online Tourism Business and Services (“Provisions”), which will take effect on October 1, 2020.

According to the Provisions, online tourism operators should implement graded protection system of cyber security, take management and technical measures for cyber security, formulate contingency plans for cyber security and organize regular trainings according to the PRC Cybersecurity Law and other relevant laws to ensure the normal development of online tourism business and services.

Online tourism operators shall protect the tourists’ right of comment and shall not arbitrarily shield or delete tourists’ comments on their products and services, nor shall they mislead, induce, substitute or force tourists to make comments. Comments made by tourists shall be saved and made public.

Online tourism operators should protect the security of tourists’ personal information and other data, and clearly indicate the purpose, method and scope of the collection of tourists’ personal information in advance and obtain the consent of the tourists.

Online tourism operators must not abuse technical means such as big data analysis to set unfair trading conditions based on tourists’ consumption records, travel preferences, etc., and infringe on the legitimate rights and interests of tourists.

According to the Provisions, online tourism operators refer to natural persons, legal persons and unincorporated organizations engaged in online tourism business and services, including online travel platform operators, operators on the platform, and operators who provide travel services through self-built websites and other network services.

For more information ，please refer to http://zwgk.mct.gov.cn/auto255/202008/t20200831_874550.html?keywords=

 

Six government agencies call for recommendation of national green data centers in 2020

On August 6, 2020, the Ministry of Industry and Information Technology (“MIIT”) and five other government agencies issued the Circular on Organizing and Implementing the Recommendation of National Green Data Centers (2020) (the “Circular”).

According to the Circular, all regions shall recommend a batch of well-managed and representative data centers featuring high energy efficiency and advanced technology in major application fields of data centers, such as manufacturing, telecommunications, Internet, public institutions, energy, finance, and e-commerce, in accordance with the Evaluation Indicator System for Green Data Centers.

The Circular provides four basic conditions that a recommended data center shall meet：

  1. The owner of the data center shall have independent legal person status. The data center shall have clear property rights and shall abide by relevant laws, regulations, policies and standards in the process of construction and operation. In the past 3 years (including less than 3 years of establishment), it has had no major safety incidents, environmental protection incidents or other incidents, and no other serious illegal or untrustworthy conducts decided by judicial or administrative agencies;
  2. The data center shall have a clear and complete physical boundary, independent power supply and distribution, and a cooling system that meet the requirements of theAction Plan for Green and Efficient Refrigeration and has been officially operating for one or more consecutive years as of the application date;
  3. The construction and layout shall meet the requirements of the Guiding Opinions on the Construction Layout of Data Centers, and meet the requirements of the local construction planning and other local laws and regulations; and
  4. It is not included in the list of Special Supervision and Rectification for the Energy Efficiency of the Industrial Energy Conservation Supervision Data Center in 2019.

For more information ，please refer to http://www.miit.gov.cn/n1146295/n1652858/n1652930/n3757016/c8045053/content.html

 

China issues the Guide to the Building of National Standard Framework for New Generation Artificial Intelligence

On August 7, 2020, the Standardization Administration and other four government departments issued the Guide to the Building of National Standard Framework for New Generation Artificial Intelligence (“Guide”).

According to the Guide, the framework of standards for artificial intelligence includes eight aspects, namely basic generality, supporting technology and products, basic software and hardware platforms, key general technologies, technologies in key fields, products and service, industry application and safety/ethnics.

The Guide requires that, the top-level design of artificial intelligence standardization should be clarified by 2021, when more than 20 key standards in key general technologies, technologies in key fields, ethics, etc. have been preliminarily researched. By 2023, an artificial intelligence standard system should have been initially established, focusing on the development of key and urgently needed standards such as data, algorithms, system services, and taking the lead in manufacturing, transportation, finance, security, home furnishing, elderly care, environmental protection, education, healthcare, justice and other key industries and fields.

For more information ，please refer to http://www.miit.gov.cn/n1146285/n1146352/n3054355/n3057497/n3057502/c8048365/content.html

NISSTC seeks public opinions on its proposed national standards to identify the boundaries for Critical Information Infrastructure

On August 10, 2020, the National Information Security Standardization Technical Committee (“NISSTC”) released the Information Security Technology – Method of Boundary Identification for Critical Information Infrastructure (Draft for Comment) (“Draft Method”) to seek public opinions.

The Draft Method provides that, boundary identification for critical information infrastructure (“CII”) deals with further analysis and sorting after the competent authority’s identification of the critical business, which the CII operator will identify the network facilities and information systems that are indispensable for the continuous and stable operation of the critical business for the purpose of providing a basis for the protection, review, and emergency response.

The Draft Method provides six factors that should be considered in identifying the boundaries of CII: critical business, network facilities, information system, critical business information, critical business information flow, and basic operation environment.

  • Critical business is the core element and the basis for boundary identification of CII;
  • Critical business information is an indispensable information resource for the normal operation of critical business, and also a bridge and link for network facilities and information system to support the informatization for critical business;
  • Network facilities and information system design, collect, integrate, process, present, apply, store and destroy critical business information according to business operation logic and functions to support the automated, intelligent and efficient operation of critical business;
  • Critical business information flow is the flow process in the whole life cycle of critical business information. By sorting out the critical business information flow, network facilities and information systems supporting informatization for critical business can be obtained;
  • Basic operation environment refers to the safety equipment, safety measures, rules and regulations, machinery, plant, water, electricity, etc. supporting basic operation for critical business.

For more information ，please refer to https://www.tc260.org.cn/front/bzzqyjDetail.html?id=20200810142946595318&norm_id=20200112070029&recode_id=39652

 

NISSTC seeks public opinions on the Method for Evaluating Security Protection Capabilities of Critical Information Infrastructure

On August 10, 2020, the National Information Security Standardization Technical Committee (“NISSTC”) issued the Information Security Technology – Method for Evaluating the Security Protection Capabilities of Critical Information Infrastructure (Draft for Comment) (“Draft Method”) for public comments by October 9, 2020.

The Draft Method provides that the evaluation of security protection capabilities of critical information infrastructure (“CII”) includes three parts: capability domain level evaluation, graded protection evaluation, and cryptography evaluation. Before the evaluation of the security protection capability of CII, the CII should first pass the corresponding graded protection evaluation and related cryptography evaluation. Then, the organization should carry out the evaluation according to the evaluation content and evaluation operation method, give the judgment result and grade of each evaluation index, get each capability domain level, and finally obtain the security protection capability level of critical information infrastructure based on the evaluation results of capability domain level and graded protection.

For more information ，please refer to https://www.tc260.org.cn/front/bzzqyjDetail.html?id=20200810142946548146&norm_id=20200112070019&recode_id=39650

 

MIIT seeks public opinions on Guidelines on the Construction of Data Security Standard System in Telecom and Internet Industries

On August 11, 2020，the Ministry of Industry and Information Technology (“MIIT”) issued the Guidelines on the Construction of Data Security Standard System in Telecom and Internet Industries (“Draft Guidelines”) to seek public opinions.

According to the Draft Guidelines, the data security standard system of telecom and Internet industries includes four categories of standards, namely the standards for basic generality, critical technologies, security management and critical fields:

  • the standards for basic generality include definitions of terms, data security framework, and data category and classification;
  • the standards for critical technologies deal with data security technology from the dimensions of the entire life cycle, including data collection, transmission, storage, processing, exchange, and destruction;
  • the standards for security management include data security specifications, data security assessment, monitoring and early warning and handling, emergency response and disaster backup, and security capability certification; and
  • the standards for critical fields mainly include 5G, mobile Internet, connected-car, Internet of Things, Internet of Industry, cloud computing, big data, artificial intelligence, blockchain and other critical fields.

For more information, please refer to http://www.miit.gov.cn/n1278117/n1648113/c8050746/content.html

 

The Ministry of Justice: To strengthen protection of trade secrets and confidential business information in administrative licensing

On August 14, 2020, the Ministry of Justice (“MOJ”) issued the Guiding Opinions on Strengthening the Protection of Trade Secrets and Confidential Business Information in Administrative Licensing (Draft for Comment) (the “Draft Opinions”) for public comments by September 30, 2020.

The Draft Opinions provide that applicants for administrative licenses shall expressly indicate their trade secrets pursuant to the Anti-Fair Competition Law or other laws or regulations, as well as their business information that are needed to be kept confidential when making an administrative license application to an administrative authority, and correctly identify the scope of confidentiality.

When applicants submit the application materials to the administrative authorities, they must clearly indicate the key points of confidentiality, and not generally regard all materials as trade secrets and confidential business information. Such information should be clearly marked on the first page of the paper-based or electronic materials submitted and the key points of confidentiality.

For more information, please refer to http://www.moj.gov.cn/government_public/content/2020-08/14/657_3254208.html

 

Shandong Province releases classification management rules on health care big data

On August 25, 2020, the People’s Government of Shandong Province issued the Measures for the Management of Health Care Big Data in Shandong Province (the “Measures”), which will take effect on October 1, 2020.

According to the Measures, health care big data falls into three categories:

  • health care data involving trade secrets, personal privacy or other types of data which are not allowed to be accessed according to laws and regulations shall be categorized as inaccessible data;
  • health care data with higher requirements for data security, processing capacity, and timeliness or that needs to be acquired continuously shall be categorized as conditional accessible data; and
  • health care data other than the above two categories shall be categorized as unconditional accessible data.

The Measures also stipulate that:

  • for unconditional accessible data, citizens, legal persons and other organizations can access it through the health care big data platform.
  • for conditional accessible data, health care big data management institutions and data using organizations should sign data using agreements to access the data. The agreement shall specify the scope, conditions, data products, confidentiality responsibilities and security measures, etc. of the data.
  • for inaccessible data, it can be accessed after the consent of the relevant obligees or after the desensitization and declassification, unless otherwise provided by laws and regulations.

For more information, please refer to http://www.shandong.gov.cn/art/2020/8/25/art_107851_108458.html

 

If you would like to receive our legal update via email, please contact jianghongyu@anjielaw.com.

 

For more information, please contact:

Samuel Yang | Partner

AnJie Law Firm

P: +86 10 8567 2968

M: +86 1391 0677 369

E: yanghongquan@anjielaw.com

Hongquan (Samuel) Yang is a partner with AnJie Law Firm. He has worked as in-house counsel and external lawyer in the technology, media and telecoms (TMT) sectors for nearly 20 years and is regarded as a true expert in these areas. He advises clients on a wide range of regulatory, commercial and corporate matters, especially in telecommunications, cybersecurity, data protection, internet, social networking, hardware and software, technology procurement, transfer and outsourcing, distribution and licensing, and other technology-related matters. He also advises clients on compliance and investigation matters.

Samuel has been recognized as a Leading Individual in PRC TMT firms (Legal 500, 2020), a Band 1 Cyber Security & Data Protection Lawyer (LEGALBAND, 2019, 2020) and one of the Top 10 Cyber Security and Data Protection Lawyers in China (LEGALBAND, 2018). Legal 500 commented that Samuel and his team at AnJie have a particular strength in “telecom-related regulatory and general commercial legal services” and “issues such as cyber security and data protection areas” and have “built a real niche” in these areas.

Samuel mainly serves Fortune 500 companies, large state-owned enterprises and leading Chinese internet companies. Samuel is a regular contributor to many legal journals and his publications regarding Chinese data protection and cybersecurity laws are well-received and widely reproduced.

Before joining AnJie, Samuel worked for British Telecom, CMS and DLA Piper.

 Author:Hannibal El-Mohtar   Agnes Wang

 

(Attribution: Ravi Kant)

I. How can Hong Kong and foreign insurers currently sell insurance to MainlandChina?

Despite the COVID-19 pandemic, many Mainland residents find foreign insurance policies more attractive than those found in the mainland and continue to cross borders to get their hands on them.

Take Hong Kong for example. The Provisional Statistics of Hong Kong Insurance Industry in the First Quarter of 2020 released by the HK Insurance Authority shows that new office premiums in respect of policies issued to Mainland visitors amounted to $5.4 billion in the first quarter of 2020.

Despite their popularity, when mainlanders purchase HK insurance products, there is a unique set of risks associated with the agreement for all parties concerned. In 2016, the China Insurance Regulatory Commission (“CIRC” the predecessor of the China Banking and Insurance Regulatory Commission, “CBIRC”) issued a risk reminder for Mainland citizens regarding purchasing insurance products in Hong Kong. Specifically, it warned Mainland citizens that:

  • Policies issuedby Hong Kong insurers are not protected by PRC legislation;
  • Risks of changes to PRC or other laws applicable to foreign exchange should not be ignored;
  • There is uncertainty with regard to investment-kind policy yields.

Moreover, CIRC’s warning included a notice for mainland insurance intermediaries. A special 2016 campaign was launched to crack down on the illegal promotion of Hong Kong policies in Mainland China. At least one Mainland insurance intermediary has been sanctioned for illegally promoting or selling foreign insurance products in the Mainland, see Shanghai Banking Insurance Regulatory Insurance Punishment Juezi [2019] No. 36.

Hong Kong insurers, for their part, face risks in navigating restrictions on the PRC’s insurance market access. They are for the most part eager to provide their services to prospective Mainland clients in the PRC’s thriving insurance market. However, like other foreign insurers, they cannot directly sell insurance products unless they have successfully established a joint venture or wholly foreign-owned enterprise (“WFOE”) insurance company in Mainland China.

II. Why is the Insurance Connect Significant for HK and Foreign Insurers?

Through the Greater Bay Area Insurance Connect (the “GBA IC”) Shenzhen will become a unique foothold for Hong Kong insurers serving Mainland clients. The GBA IC allows them to provide post-sale services to Mainland policyholders thanks to unique insurance market access permissions granted specifically to Shenzhen. So far, what is known is that under the GBA IC , two service centers (the “Service Centers”) will be established in Shenzhen — plus one other city, to be determined — featuring “counters for Hong Kong insurers” (the “Service Counters”). The Hong Kong Federation of Insurers, the industry body in Hong Kong, will take the lead in renting office space in each of these two cities. HK-based insurers will then be allowed to set up Service Counters in these Service Centers to serve policy holders living in the Greater Bay Area (the “GBA”). This will allow GBA policyholders to pay premiums for their policies, and modify their personal details under their policies without entering Hong Kong.

Why is this significant? Shenzhen is increasingly sharing Hong Kong’s role as a GBA financial hub. To understand how significant this step is, let’s place this development in context.

Shenzhen already had more financial autonomy than other Chinese cities since it became China’s first special economic zone (“SEZ”) in 1980 (see 1980 Guangdong Special Economic Zone Regulations 广东省经济特区条例).

Shanghai’s dominant status as China’s financial hub has not lessened Shenzhen’s own ambitions as a financial services center. A month after Shanghai’s stock exchange (the “SSE”) reopened, Shenzhen established its own in December 1990 (the “SZSE”). To this day the SZSE remains the only exchange in Mainland China besides the SSE. Note that since 2014, both have been connected with each other and Hong Kong through the Shenzhen/Shanghai-Hong Kong Stock Connect (the “Stock Connect”). More recently, in 2017, an announcement making Shenzhen into the “first pilot city for the development and innovation of insurance” (Shenzhen Insurance Regulatory Commission (2017) No. 14, the SIRC Announcement) was promulgated.

In 2019, Shenzhen received additional consideration as a financial center after being designated China’s “Model City” through the Opinions of the Central Committee of the Communist Party of China on Supporting Shenzhen’s Pioneering Zone for Building Socialism with Chinese Characteristics (2019 Shenzhen Opinions, 中共中央 国务院关于支持深圳建设中国特色社会主义先行示范区的意见). Under para 5 of the Shenzhen Opinions, the Central Committee encouraged the city to promote interconnection and mutual recognition of financial products with Hong Kong and Macao’s financial markets.

In line with the city’s plans for financial reforms, an announcement from this year announcements shows Shenzhen is now set to become a “pilot city” for the development and innovation of the insurance sector in China. On April 24, 2020, the People’s Bank of China, CBIRC, the China Securities and Regulatory Commission, and the State Administration of Foreign Exchange (“SAFE”) released the Opinions on Financial Support to the Construction of Guangdong-Hong Kong-Macao Greater Bay Area [Yin Fa 2020, N. 95] (the “Financial Support Opinions”).

According to the Fiancial Support Opinions, Hong Kong and Macau insurers will be invited to conduct pilot operations in GBA cities, paving the way for the further opening up of China’s insurance market. In addition, it will facilitate the GBA insurance business for HK/Macau insurers and facilitate GBA financial consumers’ access to HK/Macau insurance products.

Actioning these earlier goals, the GBA IC therefore represents a concrete step towards greater market access for Hong Kong insurers. It builds on the Financial Support Opinions, the Shenzhen Opinions, and the SIRC Announcement on becoming a “pilot” city for insurance innovation and development. It is also a feather in Shenzhen’s cap; putting these previous goals into practice is an important confirmation of the city’s direction and its promise as an insurance hub.

Note that as stated, the new GBA insurance regime will not make market access much easier than before for HK capital. At present, it only refers to post-sale transactions. Nevertheless the GBA IC and its integration with, among others, the policies mentioned in the Financial Support Opinions, will certainly make the GBA a more attractive place for foreign capital.


(Attribution: Aline Nadai)

III. How does Shenzhen now compare with Beijing and Shanghai for establishing an Insurance WFOE?

Market Access

When compared to Beijing and Shanghai, Shenzhen’s market access reforms are leading and offer the greatest potential for preferential treatment for foreign insurers. This section examines Beijing and Shanghai’s market access reforms, and then compares them with Shenzhen’s new foreign investment regime.

Beijing

Recent measures build on Beijing’s role as a China’s financial management center and make the city a more favorable site for investing foreign capital in the financial services and insurance sectors. For one, Beijing is the only city in the comprehensive pilot project for the extensive opening-up of the professional services industry. In 2015, the State Council issued the Reply on Approving the Overall Plan for a Comprehensive Pilot Project in Further Opening-up of the Service Industry in Beijing Municipality (国务院关于北京市服务业扩大开放综合试点总体方案的批复, the “2015 Beijing Reply”), which allows Beijing to test a wide range of innovative opening-up policies. This Reply laid out the plans for the further opening-up of Beijing’s service industry, whereby the establishment of foreign-funded professional health and medical insurance institutions would be supported. Since then, the State Council has issued two replies in 2017 and 2019 (the “2019 Beijing Reply”), with the latter putting forward a three-year plan for reform and encouraging professionals in finance to work in the city. These Replies indicate the national government’s past and continued support for expanding Beijing’s role as a financial services center.

Beijing has also been proactive in implementing more permissive rules on foreign ownership in the finance and insurance sectors. In June 2020, the Beijing Municipal Commerce Bureau published the Beijing Action Plan for New Opening-Up Measures (北京市实施新开放举措行动方案,the “Beijing Action Plan”), taking “further opening-up of the financial sector” as a “key task”. Regarding how to further open up the financial sector, the document clearly states that life insurance companies, together with securities companies, fund management companies and futures companies can be fully owned by foreign capital, and foreign insurance institutions can establish health insurance and pension companies in Beijing. Note however that this latter item, permitting full foreign ownership of insurance companies and their provision of pension and life insurance policies, is the implementation of China’s new foreign investment policy as of April 1, 2020 (see our China and the GATS article). It is not a Beijing-specific policy pilot; rather this is expected to eventually be applied by all sub-national jurisdictions in China.

Beijing’s airport districts are also set to become pilot areas for certain financial reform programs. Use of airports to this end is mentioned explicitly in the 2019 Beijing Reply. For Daxing Airport Free Trade District (Beijing), a list for institutional innovations is now available. The list contains 81 measures which involve nearly all governmental institutions responsible for the reform of the District. There are several innovation measures marked as “strong implementability” in the list, among them encouraging foreign investment in the financial sector.

Shanghai

Historically, Shanghai has been a pilot zone for testing market access liberalization for financial services. For a time, Shanghai was the only city where foreign insurers could operate (see China’s first Schedule of Commitments to the GATS, 1994, and our analysis of China and its GATS insurance commitments).

The past decade has been no exception. When the Shanghai FTZ was founded in 2013, one of the opening up measures included providing special market access for foreign-invested specialized health and medical insurance institutions (as a testament to this pilot’s success, such market access has now been extended to cover most of China). Shortly thereafter in 2014, the CIRC issued 2 notices on supporting the development of the Shanghai FTA, which included 11 measures in the insurance sector.[1] A notable development, Shanghai was also the site for the WFOE insurance holding company in China, Allianz insurance, four years earlier than initially planned. As recently as August 2020, Tesla registered with AMR for its own insurance brokerage in Shanghai to support insurance policies for Tesla owners.

Within Shanghai, the city’s Lingang area will be the site for important policies to encourage insurance investment going forward. Under the Lingang Measures, Shanghai will support foreign funds to set up holding or wholly owned life insurance companies (in addition to securities, fund management, and futures companies), as well as form joint ventures. In 2020, new policies regarding Lingang New Area (Several Measures for Comprehensively Promoting the Financial Opening and Innovative Development of Lingang Special Area of China (Shanghai) Pilot Free Trade Zone/全面推进中国(上海)自由贸易试验区临港新片区金融开放与创新发展的若干措施) take this development a step further. Paragraph 4, specifically, indicates additional support for market access for foreign insurers, with the government “[s]upporting the establishment of foreign-controlled or wholly foreign-owned personal insurance companies.” Moreover, a February 2020 circular encourages insurance asset management companies to set up specialized asset management subsidiaries in Shanghai (para 10), and opens the door to pilot the permitting of insurance funds to invest in gold, oil and other commodities on a trial basis in Shanghai. It also encourages, generally, insurance institutions to invest in science and innovation investment funds in the Lingang area (para 1) (Yinfa [2020] No. 46).

Most recently, Shanghai has announced ambitious development plans for its Hongkou district, intending to replicate “China’s Wall Street” along the North Bund waterfront to drive economic growth in the aftermath of COVID-19 (the “Hongkou Plan”). The development includes plans to attract 100 major companies, particularly in the finance sector, to the North Bund’s Hongkou area. This follows an earlier March announcement that Shanghai authorities would strive to bring 40 new regional headquarters for multinationals into the city and further open up controlled sectors, including insurance, as a part of its post-COVID recovery plans.

Comparison with Shenzhen

Despite Beijing and Shanghai’s support for reforming and opening up their financial services and insurance sectors, neither of these cities’s commitments match the level of detail available in Shenzhen commitments. Nor do they appear to share the same promise as the GBA, and particularly Shenzhen, for insurers’ current and future market access.

Many of the most promising elements in Shanghai’s Lingang Measures and the Hongkou Plan remain non-specific. The provisions of Yinfa [2020] No. 46 are encouraging, especially for insurance institutions planning on investing in commodities or science and innovation. However they have not yet been put into action and more details are needed to properly weigh the effects of measure. The same can be said for the other measures within the Hongkou Plan, which are even more general.

For its part, Beijing has similarly sent encouraging signals that it intends to pilot market access schemes that are beneficial to foreign insurers, but concrete policies have yet to be put into place. The role given to airport districts for financial reform, in particular, is one to watch.

Comparing the three cities, we can now see that while each has sent strong signals in favor of piloting greater market access benefits for foreign insurers, Shenzhen leads the pack and may go the furthest distance in implementation. Through the GBA IC, the Shenzhen and GBA authorities are already implementing the Financial Support Opinions, Shenzhen Opinions, and SIRC Announcement policies to bring greater market access to foreign insurers, especially for insurers based in Hong Kong. Although Shanghai’s expected Lingang pilots encouraging commodity, science, and innovation investments by insurers may end up being more preferable to insurance institutions with a strong interest in these sectors, Shenzhen still offers the most insurance-specific measures. Thus while the GBA IC is currently limited to post-sales services, placed in its proper context, it becomes clear that this is a greater priority for Shenzhen than for other cities and will be the first of many market access pilots to come.

Foreign Exchange

Among the three cities, Shenzhen’s foreign exchange measures are the most encouraging. This section examines and compares the foreign exchange policies of Shenzhen, Shanghai, and Beijing in turn.

Shenzhen

Currency traders within the city limits of Shenzhen enjoy special foreign exchange privileges. Under the supervision of the People’s Bank of China and SAFE, Shenzhen is the first mainland city to progressively liberalize the conversion of foreign capital into the Yuan. Expanded from the city’s initial Qianhai district Free Trade Zone Yuan Convertibility Pilot to now extend across all of Shenzhen, this program moves the city away from the mainland’s approval-based system. This allows settlement of exchanges within minutes, rather than hours. This is in line with  the above-described Financial Support Opinions. The above-described 2019 Shenzhen Opinions also encourage Shenzhen’s role in internationalizing the Yuan.

According to the Financial Support Opinions, there are other plans beneficial to the introduction of foreign capital generally. This includes facilitating cross-border capital pooling and the establishment of a bank account system integrating the Yuan and foreign currencies.

Most recently, in June 2020, SAFE further approved a reform to allow eligible banking institutions in Shenzhen to support mobile foreign exchange transactions for cross-border currency conversions (facilitating payments both for Chinese workers abroad and foreigners in China).

Shanghai

Shanghai will also begin experimenting with pooling foreign capital.  Under the Several Measures for Comprehensively Promoting the Financial Opening and Innovative Development of Lin-gang Special Area of China (Shanghai) Pilot Free Trade Zone (the “Lingang Measures“, 全面推进中国(上海)自由贸易试验区临港新片区金融开放与创新发展的若干措施), unveiled on May 8th, 2020, the Lingang New Area of the Free Trade Zone will pilot a cross-border capital pool.

Shanghai will also support foreign funds seeking to invest in pension management and wealth management firms in Lingang. Note that one of the five basic objectives of the Shanghai FTZ, when it was founded in 2013, was “[to] deepen opening up and innovation of the financial sector.” Lingang will also host an integrated account system for local and foreign currencies. Previously, multinational companies operating in China needed to open separate Yuan (managed by the People’s Bank of China) and foreign exchange accounts (under the management of SAFE). This was a burden on capital collection and payment.

Beijing

Daxing Airport Free Trade District is one of the many recent examples of Beijing’s foreign-exchange initiatives, and indicates that Beijing intends to compete seriously to become a favorable destination for foreign capital. In April, the Beijing Department of SAFE released the Implementing Rules on Foreign Exchange Reform of Daxing Airport Free Trade District (Beijing)( 中国(河北)自由贸易试验区大兴机场片区(北京区域)外汇管理改革试点实施细则). About 9 new measures in the foreign exchange sector are planned to be implemented in the Daxing Airport Free Trade District (Beijing), including allowing the implementation of facilitating services for the payment of foreign exchange income from capital account; relaxation of the requirements that the contract currency, withdrawal currency, and repayment currency for cross-border financing must be consistent; and simplification of the registration, modification and cancellation procedures relating to direct investment.

Comparison

After examining each city’s regime, we can now see why Shenzhen’s foreign exchange reforms are the most encouraging. While each city offers promises of preferential forex pilots going forward, Shanghai and Beijing’s remain in the planning stages whereas some important foreign-exchange policies have already been successfully implemented in Shenzhen. Specifically, the completed Yuan convertibility pilot and SAFE’s approval of mobile forex support in Shenzhen both remove significant burdens for transactions requiring foreign exchange within the city limits.

However, Shanghai’s programs are not far behind. Its Lingang integrated local/foreign currency account system is a pilot to watch for, as is the expected Lingang capital pool.

Taxes

Shenzhen’s tax environment appears to be the most favourable for foreign insurers considering entering establishing a headquarters in mainland China.

As a GBA city, Shenzhen benefits from Guangdong’s preferential income tax policy for foreigners. The Ministry of Finance (MOF) and the State Administration of Taxation (SAT) issued Caishui [2019] No. 31 on March 14, 2019 (the “2019 GBA Circular”). The 2019 GBA Circular allows foreign talents working in GBA cities like Shenzhen to benefit from a tax rebate covering taxes in excess of 15% of their Individual Income Tax (“IIT”). The 2019 GBA Circular ends on December 31, 2023.

[Source: Department of Commerce of Guangdong Province, 2020 Invest Guangdong]

Measures for the other two cities are positive but non-specific. In Shanghai, there have been some generally favourable announcements applicable within the Lingang area, but they remain general in nature. Specifically, under No.6 (9) of the Lingang Measures, overseas high-end and urgently-needed talents working in Lingang will be allowed to benefit from certain IIT subsidies. A similar claim is made in the 2020 Shanghai Foreign Investment Guide (p. 59), which specifies that financial professionals are eligible for this subsidy, but otherwise does not provide particulars. Beijing, for its part, does not appear to have implemented or announced preferential IIT tax measures of this nature.

Shenzhen also benefits from Guangdong province’s preferential foreign investment awards. On August 21, 2020, Guangdong issued the revised version of the Policies and Measures of Guangdong Province on Further Expanding Opening-up and Actively Attracting Foreign Direct Investment (Ten Policies and Measures for Foreign Investment). One enumerated incentive is an award (one-time) of 30% of a foreign investor’s financial contribution made when establishing a regional or national headquarters within Guangdong. Beijing and Shanghai do not offer such an award.

Administration

 The financial costs for WFOE formation will be similar across Shenzhen, Beijing, and Shanghai, although local requirements and processing standards may lead to slightly faster service depending on the city.

Across Beijing, Shenzhen, and Shanghai, some interactions with SAMR are moving online. In each of these cities, the Application Form for Foreign Funded Enterprises in China (在中国设立外资企业申请表) is being replaced by SAMR-administered online forms. For example, the Shanghai form (the “one window, one form”, exclusively in Chinese) is available on the Shanghai government’s website.[2] Similarly, Shenzhen has its own online portal, [3]as does Beijing.  This “one window, one form” policy is in line with a broader push by the Chinese government to improve the country’s business environment and lessen bureaucratic red tape. [4]

Once the greatest hurdle is cleared, namely of getting approval from CBIRC, each city provides relatively similar processing times:

 

Statutory time limit

(Working day)

Promised time limit

(Working day)
Shanghai 15 1
Shenzhen 7 1
Beijing 15 3

 

Note that when establishing a WFOE, an applicant must already have possession of an office address within the desired city at the time of application. Planning ahead on how to satisfy this administrative requirement will help avoid costly delays in company formation.

(Attribution: Matheus Natan)

Data

For data management and control, an important consideration for insurers entering China, the applicable laws are national. The Guidelines on the Information System Security Management of Insurance Companies(2011)/ 保险公司信息系统安全管理指引, together with the Cyber Security Law, apply with equal force in Beijing, Shanghai and Shenzhen.

As such data management rules should not be a factor in how a foreign insurer evaluates individual cities for its market-entry analysis.

Conclusion

For decades now, Beijing, Shanghai, and Shenzhen have attracted significant foreign investment in the financial and insurance sectors.

However, in light of Shenzhen’s recent pilots and reforms, in particular the GBA IC, it is now the most favourable destination for foreign insurers seeking to establish a WFOE in mainland China. In terms of market access, foreign exchange controls, and tax policies, the city has shown the greatest level of initiative and implemented the greatest number of preferential policies that benefit foreign insurance institutions.

Nevertheless, this does not mean that insurers already based in Beijing and Shanghai should relocate to Shenzhen. Both Beijing and Shanghai have clearly demonstrated that they intend on piloting their own reforms in these areas. Additionally, as China’s “Model City”, many pilots that succeed in Shenzhen are, eventually, well-received in other cities. Thus the above-described competitive advantages in Shenzhen may, relative to cities like Shanghai and Beijing, be temporary. That said, developing a dynamic and robust insurance sector is clearly a priority for Shenzhen, and its special support from both the state and provincial levels, combined with its proximity to well-established players in Hong Kong’s own insurance sector, allow it to act on that priority in exceptionally promising ways.

 

[1]Please refer to:

1)Notice of the CIRC on Supporting the Development of the China (Shanghai) Pilot Free Trade Zone/保监会支持中国（上海）自由贸易试验区建设的通知

2) Notice of the General Office of the CIRC on Further Simplifying Administrative Examination and Approval to Support the Development of the China (Shanghai) Pilot Free Trade Zone/中国保监会办公厅关于进一步简化行政审批支持中国(上海)自由贸易试验区发展的通知

3) Administrative Measures of the China (Shanghai) Pilot Free Trade Zone for the Record-Filing of Insurance Institutions and Senior Management Personnel/中国(上海)自由贸易试验区保险机构和高级管理人员备案管理办法

[2]Shanghai Municipal Government, “上海市开办企业 ‘以窗通‘网上服务”. Due to the presence of its free trade zone, Shanghai was able to pioneer online registration for companies doing business in areas not on the negative list before any other administrative area.

[3]Shenzhen Municipal Government, “深圳市开办企业 ‘一窗通‘网上服务”, online: <https://amr.sz.gov.cn/aicmerout/jsp/gcloud/giapout/industry/aicmer/processpage/step_prewin.jsp>.

[4]Dezan Shira & Associates, “Shanghai Business Registration: Online Platform for Foreign Invested Enterprises Launched” China Briefing, August 22, 2018, online: <www.china-briefing.com/news/shanghai-business-registration-online-platform-foreign-invested-enterprises-launched/>

 

Have questions about accessing China’s insurance market? Anjie is a Chambers ranked, Band 1 law firm for PRC Insurance law, and has the largest insurance practice in mainland China  

Feel free to send consultation requests to An Na (anna@anjielaw.com) or An Chencheng (anchencheng@anjielaw.com).

Authors: Zhan Hao, Song Ying, Yang Zhan

In June 2020, the Anti-Monopoly Bureau of the State Administration for Market Regulation (“SAMR”) published a new book, the 2019 Compilation of Antitrust Regulations and Guidelines, which contains four previously unpublished guidelines covering the automotive sector, intellectual property rights, leniency policy, and commitments by undertakings. The Guidelines on Leniency for Horizontal Monopoly Agreements (the “Leniency Guidelines”) detail SAMR’s leniency policies towards horizontal monopoly agreements (cartels) under China’s antitrust law system.

Monopoly agreements by competitors are generally highly secretive, and with the exception of extreme scenarios, the parties to such agreements lack an incentive to whistle-blow to the competition authorities. SAMR’s leniency policy is formulated to encourage such parties to voluntarily self-report and hand over substantive evidence, by granting them exemptions or fine reductions.

In China, Article 46 of the Anti-Monopoly Law (the “AML”) provides that, where an operator who is engaged in a monopoly agreement voluntarily reports said monopoly agreement and provides material evidence thereof to the authorities, that party could be eligible for a reduction or exemption from punishment. Inter alia, Articles 33 and 34 of the Interim Provisions on Prohibiting Monopoly Agreements (the “Interim Provisions”) promulgated by SAMR further clarify how reductions or exemptions from penalties apply, define “material evidence”, and set out factors used to “mark” an applicant for consideration by the authorities.

Preparations for the Leniency Guidelines by anti-monopoly authorities go back as far as 2015. In June 2015, the Office of the Anti-Monopoly Commission of the State Council (the “Office”) organized the three former antitrust enforcement agencies, i.e. the Ministry of Commerce, the National Development and Reform Commission (“NDRC”) and the previous State Administration for Industry and Commerce to Draft the Leniency Guidelines. In February 2016, the National Development and Reform Commission released the Draft Leniency Guidelines to solicit public comments. In February 2017, the Office revised the Draft Leniency Guidelines based on the opinions of the members and experts of the Anti-Monopoly Commission under the State Council. Due to the administrative re-structuring of the State Council, in August 2018, certain provisions of the Draft Leniency Guidelines were further amended. Upon approval of the Anti-Monopoly Commission under the State Council, the Leniency Guidelines were officially issued on January 4, 2019, and then published along with the other three guidelines in the above-mentioned book.

The current Leniency Guidelines provided relatively specific guidance to SAMR and market players regarding how SAMR’s leniency policy should be implemented. Specifically, it establishes a “marker” system with different fine reduction “levels”. It clarifies the requirements for obtaining leniency, reporting procedures, and practices for the submission of material evidence. It also provides guidance to enforcement agencies on leniency application reviews. Compared to the previous draft version, there are several changes in the application and review procedures, and specific requirements to which the operators should pay more attention if applying for leniency in an antitrust investigation. This article elaborates on the main highlights and implications of the Leniency Guidelines below. 

I. Application scope of the leniency policy

The leniency policy applies only to horizontal monopoly agreements concluded between competitors as defined under Article 13(1) of the AML. Vertical monopoly agreements and abuse of market dominance are not applicable. It also should be noted that not all the applicants under the leniency policy will be fully exempted from penalties. The Leniency Guidelines provides that if an operator organizes or forces other operators to participate in reaching or implementing monopoly agreements, or impedes other operators from terminating their illegal conduct, the authority will not grant an exemption but can instead allow a limited penalty reduction. Penalty reduction or exemption is generally applied against fines imposed on the parties to a monopoly agreement, but will not allow such parties to keep ill-gotten gains under their agreement.

II. When are operators entitled to apply for leniency?

The time limit for operators to apply for leniency is not very strict. Operators are entitled to apply for leniency (i) before the enforcement agency initiates a case or launches an investigation procedure under the AML, or (ii) after the enforcement agency initiates a case or launches an investigation procedure but before issuance of a prior notice on administrative penalty by the authorities.

III. Application report and “key evidence” required for the leniency application

When a party applies for a leniency, the following documents are required: the application report and “key evidence”. If the authority decides not to grant the leniency, it will not determine the illegal acts based on the relevant materials filed by parties for the purpose of leniency application.

  1. Application report

For the first applicant, the application report must include:

  • Basic information of the parties to the monopoly agreement, including but not limited to name, address, contact details, and representative.
  • Description and main content of the monopoly agreement, including but not limited to time and place that the agreement is reached or implemented, main content, specific participants, and what stage the operators reached in agreeing to and implementing the agreement.
  • Geographical scopeand market scale affected the agreement.
  • Duration of the agreement’s implementation.
  • Explanation of the evidence.
  • Whether the party has applied for a leniency in other jurisdictions.

For subsequent applicants, the application report shall cover participants of the monopoly agreement, products or service involved, time and place that the agreement is reached or implemented.

  1. Key evidence

The Leniency Guidelines clarify that, for the first applicant, key evidence refers to the materials that the enforcement agencies have not collected yet and would be sufficient to trigger initiation of an investigation, or (if they have already initiated the case or launched the investigation procedure) sufficient for agencies to find a monopoly agreement.

For subsequent applicants, key evidence refer to materials that the enforcement agencies have not collected and would be of significant or probative value in detecting a monopoly agreement. Most importantly, this includes how the agreement was reached and implemented, its main content, the timeline involved in reaching and implementating it, the products or services involved, and the relevant participants.

IV. Other requirements for leniency

In addition to the above requirements, the Leniency Guidelines also request the applicant to: (i) immediately terminate the illegal conduct (except for the cases where the authority requires applicants to continue the illegal conduct), (ii) cooperate with the authorities in a prompt, consistent, full, and reliably manner in the investigation, (iii) properly preserve and provide evidence and information, and to not conceal, destroy or transfer evidence or provide false material or information, (iv) not to disclose applications for leniency without the consent of the authorities, and (v) not to have any conduct that may affect the investigation.

V. Who can ask for a marker?

A marker system is applied in many jurisdictions worldwide. In the EU, the marker system “is designed to preserve and protect the applicant’s place in a leniency queue for a definite period of time.”[1]  The Leniency Guidelines establish a marker system in China as well and provide an exemption for the first applicant that meets its requirements; for each subsequent successful applicant, it provides a reduction in fines. Note that only the first immunity applicant can hold their marker’s priority without delivering all of the required evidence: if an operator initially submits a monopoly agreement information report the authorities and then provides related key evidence, the authority can decide to mark the time of the initial submission as that of applying for leniency, and request the applicant to supplement all related materials generally within 30 days, or 60 days for special cases. If the first applicant cannot supplement the related materials within the required period, it will lose its priority under the marker system; if so, the next successful applicant for a reduction in penalties can automatically become the first-in-time immunity applicant.

VI. How are applicants classed?

The Leniency Guidelines clarify the range of fine reductions available to undertakings for the first, second, or third place applicants: exemption from penalty or of reduction of fines by no less than 80% for the first, a 30%–50% reduction for the second applicant, 20%~30% for the third applicant, and no more than 20% for subsequent applicants. In general, the enforcement agency may grant leniency to up to three operators in an investigation. If a high-profile case is relatively complicated and involves more than three parties to agreements applying for leniency, the enforcement agency has the discretion to grant reductions in penalties to more than three applicants. Similarly, the confiscation of illegal gains may also be referred to exemption or reduction of fines on parties of monopoly agreements, subject to the authority’s discretion.

VII. Decision and publication of leniency

Subject to the Leniency Guidelines, the authorities are obliged to publish the leniency decision if they agree to grant an exemption or reduction of fines to the applicants. Without the consent of relevant parties, the application report and all other related materials submitted for leniency application shall not be published, and none of any other third parties are entitled to review. This provision may to some extent relieve companies’ practical concerns that the materials submitted for a leniency application may be used as evidence against them in future civil actions by other parties.

The leniency policy provides a very valuable and practical approach to help global antitrust enforcement agencies in the detection and termination of infringing monopoly agreements. The Leniency Guidelines propose a relatively reliable leniency system under the AML, which is of great significance for improving the effectiveness of antitrust enforcement, while providing a valuable source of guidance for Chinese market players to follow up on.