New Essay: Moving Data, Moving Target
China’s overhauled cross-border data transfer regime, and its uncertainties
The Stanford DigiChina Project’s latest publication is an in-depth examination of China’s evolving regulatory regime around cross-border data flows.
In “Moving Data, Moving Target,” Samm Sacks, Krystal Chen Zeng, and Graham Webster examine a turnabout in the past year in China’s regulation of outbound data flows. Long story short: The Chinese government appeared to recognize it had erected unworkable barriers to business and “eased restrictions affecting many businesses, while still underscoring the strength of the [Cyberspace Administration of China]’s authority over high-risk areas,” we write.
Still, the basic structure of the laws underlying revised 2024 Provisions, which replaced more stringent Measures from 2022, leaves several active questions, each applying to at least some firms doing business across China’s border:
Eight years after the Cybersecurity Law was finalized, the consequential category of “important data” can still be elusive.
Those operating with more than 1 million individuals’ worth of personal information are still subject to an uncertain security review system before data can be transferred abroad.
Free trade zones within China promise the potential for streamlined rules, but their extent and how to qualify for them remains a question.
The law still leaves the government room to determine whether a transfer is “necessary,” and there’s no clear standard for this.
All of these uncertainties are most likely to be illuminated through the actual practice of regulators and regulated entities. For now, we offer a snapshot in an evolving regime.
Read our full essay here.
Please don’t hesitate to share comments and feedback.
–Graham Webster, Editor-in-Chief, DigiChina
About DigiChina
Housed within the Program on Geopolitics, Technology, and Governance at Stanford University, DigiChina is a cross-organization, collaborative project to provide translations, factual context, and analysis on Chinese technology policy. More at digichina.stanford.edu.