The FCPA blog writes… 18 May 2021
Imminent changes to the legal landscape in China likely will further complicate investigations and litigation involving information stored in China.
China recently released second drafts of its Data Security Law (DSL) and its Personal Information Protection Law (PIPL) for public comment (see analysis here). Among other provisions, the two laws would impose a new requirement that, if a judicial or enforcement agency outside of China requests data stored in China — either personal data or non-personal data — companies must first obtain the approval of the Chinese government before transferring the data, or face potential penalties, such as fines.
Once enacted, the DSL and PIPL will add to a patchwork of laws and regulations that affect data transfers out of China, including, for example, the revised State Secrets Law in 2010 and the International Criminal Judicial Assistance Law (ICJAL) in 2018 (which we wrote about for the FCPA Blog here and here). A chart comparing the enforcement-related transfer restrictions in the draft DSL, the draft PIPL, and the ICJAL is available upon request.
Outside of the investigation and litigation context, the DSL and PIPL, together with China’s Cybersecurity Law, will establish a complex data protection and cybersecurity regulatory framework governing cross-border transfers of personal and non-personal data.
The proposed provisions in the DSL and PIPL would supplement existing laws in a number of ways:
(1) the DSL and PIPL together cover a broad scope of data
(2) the DSL and PIPL apply to all requests from judicial and enforcement agencies outside of China, without distinguishing among requests (unlike the ICJAL, which applies only to criminal matters), and
(3) these laws impose penalties for violations (unlike the ICJAL, which has no penalties for non-compliance).
Read their full blog post at https://fcpablog.com/2021/05/18/chinas-proposed-data-security-and-personal-information-protection-laws-will-impact-investigations/
