China’s Evolving Landscape of Cybersecurity and Data Protection: Key Developments in 2024

In July 2024, China made significant strides in enhancing its regulatory framework surrounding cybersecurity and data protection. With a focus on data governance, personal information protection, and the management of geographic information for intelligent connected vehicles, these developments reflect the country’s commitment to standardizing data processing, promoting data flow, and ensuring the security of user rights. This article delves into the key highlights of these regulatory changes, legislative developments, enforcement actions, and industry initiatives that are shaping the future of data governance in China.

Key Highlights of Regulatory Changes

Data Governance

China’s provinces and cities, including Hunan and Guangzhou, have been proactive in releasing or proposing regulations aimed at improving data management. These regulations focus on standardizing data processing, promoting data sharing, and facilitating cross-border data flow. The Global Digital Economy Conference has also introduced norms for data rights confirmation and authorization processes, addressing the complexities surrounding data transfer rights.

Personal Information Protection

The Ministry of Public Security and the Cyberspace Administration of China (CAC) have implemented various regulations to bolster the protection of citizens’ personal information. Key measures include management protocols for network identity authentication, compliance audit standards for personal information protection, and guidelines for app information protection. Initiatives like the “Clear and Bright” campaign have been launched to inspect and rectify illegal personal information collection practices, enhancing compliance awareness across the board.

Intelligent Connected Vehicles

The Ministry of Natural Resources (MNR) and Shanghai have introduced regulations and standards for intelligent connected vehicles, emphasizing the importance of geographic information data security. These regulations mandate that geographic information data be stored domestically and outline provisions for standard data management. Shanghai has also released guidelines for data sharing systems related to intelligent connected vehicles, ensuring secure and compliant data sharing practices.

Legislative Developments

Several key legislative measures were introduced in July 2024, reflecting the government’s commitment to enhancing data protection and governance:

1. Network Identity Authentication Management Measures: Issued by the Ministry of Public Security and CAC, these measures aim to enhance personal information protection and promote digital economy services by specifying data protection obligations for public service and internet platforms.

2. Geographic Information Security Management: The MNR mandated local authorities to regulate surveying activities and improve the management of classified geographic information data, ensuring compliance with data storage and export regulations.

3. Personal Information Protection Compliance Audits: The National Information Security Standardisation Technical Committee (TC260) proposed a national standard for compliance audits, outlining principles for lawful and secure personal information processing.

4. Basic Geographic Information Standards: The MNR proposed mandatory standards for basic geographic information, focusing on reliability and standardization to promote data sharing and integration.

5. High-Quality Development of the Digital Economy: The State Council held an executive meeting to discuss strategies for integrating the digital economy with the real economy, emphasizing innovation and regional development.

6. AI Industry Standardization Guidelines: The Ministry of Industry and Information Technology (MIIT) issued guidelines to accelerate AI standardization efforts, aiming to establish a comprehensive standardization system for the AI industry.

7. Local Standards for Data Sharing Systems: Shanghai released guidelines for intelligent connected vehicle data sharing systems, emphasizing secure and efficient data management.

8. Compliance Guidelines for Mobile Applications: The Shanghai Internet Association provided guidelines for mobile app developers to ensure compliance with personal information protection laws.

9. Hunan Province Data Regulations: Hunan proposed regulations to standardize data processing and enhance data rights protection, focusing on data security supervision.

10. Guizhou Province Data Circulation Regulations: Guizhou passed regulations to promote data circulation and regulate data element registration services.

Enforcement Developments

The enforcement of data protection regulations has been a priority, with several actions taken against non-compliance:

1. APP Violations: The MIIT identified 17 apps and SDKs that violated user rights, highlighting issues such as unauthorized personal information collection.

2. Fines for Personal Information Breaches: A property management company in Guangxi was fined for failing to protect residents’ personal information, underscoring the importance of data security.

3. Judicial Summaries on Personal Information Crimes: The Supreme People’s Court published key judgments on cases involving the illegal acquisition and sale of personal information, emphasizing the need for proper information management.

4. Public Reporting Initiatives: The CAC reported millions of public complaints regarding illegal and harmful information, encouraging citizen participation in maintaining a safe online environment.

5. Special Actions for Minors: The CAC launched initiatives to rectify harmful online content targeted at minors, focusing on various digital platforms.

6. Inspections of Personal Information Collection: The Shanghai CAC conducted inspections on apps, uncovering numerous violations related to personal information collection practices.

Industry Developments

The regulatory landscape is also evolving through various industry initiatives aimed at fostering a robust data economy:

1. Cross-Border Digital Trade Cooperation: The Hangzhou Internet Court signed a cooperation agreement to support high-quality development in cross-border digital trade.

2. Data Property Rights and Revenue Distribution: The National Data Bureau is working on regulatory documents to clarify data property rights and improve data circulation.

3. Cross-Border Data Flow Mechanisms: The Central Finance Office emphasized the establishment of secure mechanisms for cross-border data flow to enhance the business environment.

4. Consultation Hotlines for Cross-Border Data Policies: The Shenzhen CAC launched a hotline to assist personal information processors in navigating cross-border data activities.

5. Digital Economy Arbitration Centre: The Beijing Arbitration Commission established a center to resolve data disputes and support the development of the data market.

6. Global Digital Economy Conference: The conference issued norms for data rights confirmation and authorization processes, promoting compliance in data circulation.

7. China Data Valley Initiative: Hangzhou released implementation opinions to promote data circulation and establish a “China Data Valley” by enhancing data infrastructure and resource supply.

8. Policies for Data Element Market Development: Ningbo proposed policies to boost the high-quality development of the data element market, aiming for significant economic growth by 2027.

Conclusion

As China continues to strengthen its cybersecurity and data protection framework, the developments in July 2024 signal a robust commitment to enhancing data governance, protecting personal information, and fostering a secure digital economy. The collaborative efforts between government agencies, local authorities, and industry stakeholders are paving the way for a more standardized and secure data environment, ensuring that user rights are safeguarded while promoting innovation and economic growth.

For those interested in staying updated on these developments, subscribing to newsletters and following relevant events is highly recommended. For inquiries, please contact James Gong at [email protected].