Shulou(Shulou.com)11/24 Report--

Thanks to CTOnews.com netizens for the clues of rain and snow on the way and the west window! CTOnews.com Sept. 28, CTOnews.com learned from China that the State Internet Information Office issued a notice on regulating and promoting the cross-border flow of data (draft for soliciting opinions) for public consultation.

It is suggested that if the data generated in international trade, academic cooperation, transnational manufacturing, marketing and other activities do not contain personal information or important data, there is no need to declare data exit safety assessment, enter into personal information exit standard contracts, and pass personal information protection certification. If it is not informed by the relevant departments or regions or publicly released as important data, the data processor does not need to declare the data as important data for exit safety assessment. Personal information collected and generated in China is not provided abroad, and there is no need to declare data for exit security assessment, to conclude a standard contract for personal information exit, and to pass personal information protection certification.

It is also mentioned that those who are expected to provide personal information of less than 10,000 people abroad within one year do not need to declare data exit security assessment, conclude personal information exit standard contracts, and pass personal information protection certification. However, if personal information is provided abroad on the basis of individual consent, the consent of the subject of personal information shall be obtained. If the personal information of more than 10,000 people and less than 1 million people is expected to be provided abroad within one year, and the personal information exit standard contract is concluded with the overseas receiver and put on record with the network and letter department at the provincial level or passed the personal information protection certification, the data exit security assessment may not be declared; if the personal information of more than 1 million people is provided abroad, the data exit safety assessment shall be declared. However, if personal information is provided abroad on the basis of individual consent, the consent of the subject of personal information shall be obtained.

In order to ensure the security of national data, protect the rights and interests of personal information, and further standardize and promote the orderly and free flow of data in accordance with the law, according to the relevant laws, the State Internet Information Office drafted the regulations on standardizing and promoting the Cross-Border flow of data (draft for soliciting opinions), which is now open to the public for comments. The public can provide feedback through the following channels and ways:

1. Log on to the legal Information Network of the Chinese Government of the Ministry of Justice of the people's Republic of China (www.moj.gov.cn, www.chinalaw.gov.cn), and enter the "Collection of Legislative opinions" section of the main menu on the home page to express your opinions.

two。 Send comments to: shujuju@cac.gov.cn via email.

3. Send your comments by letter to the Network data Administration of the State Internet Information Office, 15 Fucheng Road, Haidian District, Beijing, zip code: 100048, and mark on the envelope "regulations on standardizing and promoting the Cross-Border flow of data for soliciting opinions".

The deadline for feedback is October 15, 2023.

National Internet Information Office

September 28, 2023

Regulations on standardizing and promoting the cross-border flow of data (draft for soliciting opinions)

In order to ensure the security of national data, protect the rights and interests of personal information, and further standardize and promote the orderly and free flow of data in accordance with the relevant laws, the following provisions are made for the implementation of data exit provisions such as the measures for the Safety Assessment of data exit and the Standard contract measures for personal Information exit.

I. if the data generated in international trade, academic cooperation, transnational manufacturing and marketing activities leave the country and do not contain personal information or important data, there is no need to declare data exit safety assessment, conclude personal information exit standard contracts, and pass personal information protection certification.

2. If the data is not informed by the relevant departments or regions or publicly released as important data, the data processor does not need to declare the data as important data for exit safety assessment.

Third, personal information not collected in China shall be provided abroad, and there is no need to declare data for exit safety assessment, conclude standard contracts for personal information exit, and pass personal information protection and certification.

4. Under any of the following circumstances, it is not necessary to declare data for exit safety assessment, to conclude a standard contract for personal information exit, or to pass personal information protection certification:

(1) personal information must be provided abroad in order to conclude and perform a contract for an individual as a party, such as cross-border shopping, cross-border remittance, air ticket and hotel reservation, visa processing, etc.

(2) to implement human resources management in accordance with the labor rules and regulations formulated according to law and the collective contracts signed according to law, and it is necessary to provide personal information of internal employees abroad.

(3) it is necessary to provide personal information abroad in order to protect the life and health and property safety of natural persons in case of emergency.

5. if the personal information of less than 10,000 people is expected to be provided abroad within one year, there is no need to declare data for exit safety assessment, conclude a standard contract for personal information exit, or pass personal information protection certification. However, if personal information is provided abroad on the basis of individual consent, the consent of the subject of personal information shall be obtained.

6. if the personal information of more than 10,000 people and less than 1 million people is expected to be provided abroad within one year, and the standard contract for the exit of personal information is concluded with the overseas receiver and put on record with the network and letter department at the provincial level or passed the personal information protection and certification, the data may not be declared for exit security assessment; if the personal information of more than 1 million people is provided abroad, the data exit safety assessment shall be declared. However, if personal information is provided abroad on the basis of individual consent, the consent of the subject of personal information shall be obtained.

7. The free trade pilot zone may, on its own, formulate a data list (hereinafter referred to as the negative list) that needs to be included in the data exit security assessment, personal information exit standard contract, personal information protection, certification and management scope of the free trade zone. after being approved by the provincial network security and information committee, it shall be submitted to the national network information department for the record.

The exit of negative off-list data may not be declared for safety assessment, conclude a standard contract for the exit of personal information, and pass the certification of personal information protection.

8. Where state organs and operators of key information infrastructure provide personal information and important data abroad, the provisions of relevant laws, administrative regulations and departmental rules shall be followed.

The provision of sensitive information and sensitive personal information involving the party, government, army and secret-related units abroad shall be carried out in accordance with the provisions of relevant laws, administrative regulations and departmental rules.

9. Data processors who provide important data and personal information abroad shall abide by the provisions of laws and administrative regulations, perform the obligations of data security protection, and ensure the security of data exit; if a data exit security incident occurs or the risk of data exit security is found to be increased, remedial measures shall be taken and timely reported to the network information department.

10. All local Internet information departments shall strengthen the guidance and supervision of data processors' data exit activities, strengthen supervision before and after the event, and if they find that there are greater risks or security incidents in data exit activities, data processors shall be required to carry out rectification and reform to eliminate hidden dangers; if they refuse to correct or cause serious consequences, they shall be ordered to stop data exit activities in accordance with the law to ensure data security.

11. If the relevant provisions such as the measures for the Safety Assessment of data exit and the measures for the Standard contract for the exit of personal Information are inconsistent with these provisions, these provisions shall be followed.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.