Reed Smith LLP

The Recorder

Cross-Border Data Transfers: CSL vs. GDPR

Helping in-house counsel with GDPR exposure to prepare for the data-transfer requirements of China’s Cybersecurity Law (CSL)

Subscribe
Home Perspectives Cross-Border Data Transfers: CSL vs. GDPR
As multinational companies wrap up compliance preps for the EU’s General Data Protection Regulation (GDPR), China’s Cybersecurity Law (CSL) takes center stage presenting new challenges. Although CSL took effect on June 1, 2017, the compliance deadline for the most controversial cross-border data transfer requirement is deferred until Dec. 31, 2018. Companies deemed “network operators” are required to conduct a security assessment if they transfer personal information or important data collected or generated in China to a foreign party. While CSL’s security assessment regime remains under development and the draft bears superficial resemblance to GDPR, the Chinese legislative and enforcement styles create confusion, and sometimes false hopes, for western companies. This article sheds light for in-house counsel with GDPR exposure on how to prepare for CSL’s data transfer requirement.
Hands behind a digital globe

The Data Transfer Requirements under CSL and GDPR

Article 37 of CSL initially requires that operators of critical information infrastructure (CII) store personal information and important data collected or generated in China within the territory of China, and conduct a security assessment if such data needs to be provided to a foreign party. Article 2 of the draft Measures later issued by the Cyberspace Administration of China (CAC) expanded the assessment requirement from CII operators to “network operators.”

CII operators refer to companies in critical sectors such as radio, television, energy, transportation, water conservancy, finance, and others that “will result in serious damage to state security, the national economy and the people’s livelihood and public interest if it is destroyed, loses function or encounters data leakage.” The much broader category, “network operators,” refers to “owners, operators, and service providers of computer networks.”

Download the PDF below to learn more!