Cybersecurity Law of the People's Republic of China

The Cybersecurity Law of the People's Republic of China, commonly referred to as the Chinese Cybersecurity Law, was enacted to increase data protection, data localization, and cybersecurity in the interest of national security.[1]

Cybersecurity Law of the People's Republic of China
Standing Committee of the National People's Congress
Territorial extentPeople's Republic of China but excludes China's Special Administrative Regions.
Enacted byStanding Committee of the National People's Congress
Enacted7 Nov 2016
Commenced1 Jun 2017
Status: In force

History

This law was enacted by the Standing Committee of the National People's Congress on November 7, 2016 and was implemented on June 1, 2017.[2] It requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company's network operations.[1]

The Ministry of Industry and Information Technology justified the law as the part of the country's Go Out policy.

Cybersecurity is recognized as a Basic Law. This puts the law on the top of the pyramid-structured legislation on cybersecurity. The law is an evolution of the previously existent cybersecurity rules and regulations from various levels and fields, assimilating them to create a structured law at the macro-level. The law also offers principal norms on certain issues that are not immediately urgent, but are of long-term importance. These norms will serve as a legal reference when new issues arise.[3]

Provision

The law created

  • The principle of cyberspace sovereignty[4]
  • Defined the security obligations of internet products and services providers
  • Detailed the internet service providers' security obligations
  • Further perfected the rules of personal information protection[5]
  • Established a security system for key information infrastructure[6]
  • Instituted rules for the transnational transmission of data at critical information infrastructure.[7]

The Cybersecurity Law is applicable to network operators and businesses in “critical sectors.”[1] By critical sectors, China roughly divides the domestic businesses into networking businesses that are involved in telecommunications, information services, energy transport, water, financial services, public services, and electronic government services.[8]

These definitions mean the law is applicable to all businesses in China that manage their own email or other data networks. Network operators are expected, among other things, to: clarify cybersecurity responsibilities within their organization, take technical measures to safeguard network operations and prevent data leaks and theft; and report any cybersecurity incidents to both users of the network and the relevant implementing department for that sector.[9]

The law is composed of supportive subdivisions of regulations that specify the purpose of it. For instance, the Core Infrastructure Initiative (CII) Security Protection Regulations and Measures for Security Assessment of Cross-border Transfer of Personal Information and Important Data. However, the law is yet to be called fixed, since China's government authorities are occupied with defining more contingent laws to better correspond the Cyber Security Law. By incorporating preexisting laws on VPN and data security into the Cyber Security Law, the Chinese government is reinforcing business law in China.[10]

The Cybersecurity Law also provides elaborate regulations and definitions on legal liability. For different types of illegal conduct, the Law sets a variety of punishments, such as fines, suspension for rectification, revocation of permits and business licenses, and others. The Law accordingly grant cybersecurity and administration authorities with rights and guidelines to carry out law enforcement on illegal acts.

Although the censorship affects the whole nation, it does not affect China's special administrative regions such as Hong Kong and Macau. This is because these regions enjoy a high degree of autonomy, as specified in local laws and the "One country, two systems" principle.

Effects

Along with the Great Firewall, restrictions raise concerning voices, especially among foreign companies.[11] Regarding the requirements for spot-checks and certifications, international law firms have warned that companies could be asked to provide source code, encryption, or other crucial information for review by the authorities, increasing the risk of this information being lost, passed on to local competitors, or used by the authorities themselves.[1] The Federal Bureau of Investigation warned that the law could force companies transmitting data through servers in China to submit to data surveillance measures.[12]

The law sparked complaints both internally and internationally due to its wording. Foreign companies and businesses in China expressed concerns that this law might impede future investments in China, because the law now requires them to "store their data on Chinese-law regulated local servers, and cooperate with Chinese national security agencies if asked to,"[13] which could potentially compromise business secrets and sensitive information.

To comply with the law, for instance, Apple announced that it would transfer the operation of iCloud in Mainland China to a government-sponsored data company named Guizhou-Cloud Big Data.[14] Meanwhile, online services, including Skype and WhatsApp, refused to store their data locally and were either banned from operating in China or restrained from further expansion.[15]

Article 9 of the cybersecurity law states that “network operators … must obey social norms and commercial ethics, be honest and credible, perform obligations to protect network security, accept supervision from the government and public, and bear social responsibility.”Although some arguments and doubts arise, such a vague provision is suspected to increase the government's guard to interpret and assert the need to intervene. Such interventions would include investigations which could disperse into government trade associations requesting spot-checks at the foreign firm. It does present the determination of the government of protecting the Security in Cyberspace, not to give up regulation of the giant companies.

Foreign firms are now placed between two choices: One, they could invest in new data servers in China to comply with data localization or incur new costs to hire a local server provider, such as Huawei, Tencent, or Alibaba, which have spent billions in recent years establishing domestic data centers as part of Beijing's 12th Five-Year Plan (2011-2015). The substantial investment by these Chinese technology firms in recent years is one of the reasons for which critics believe that the new law is partly designed to bolster the domestic Chinese data management and telecommunications industry against global competitors.

However, an international firm in China reported to PGI that the intention of the law is not to prohibit foreign businesses from operating in China, nor is it to boost Chinese competitiveness. In fact, with regards to a study by Matthias Bauer and Hosuk Lee-Makiyama in 2015, data localization causes minor damage to economic growth due to inefficiencies that arise from data transfer processes and the duplication of data between several jurisdictions. As a matter of fact, the requirement for data localization should instead be seen as a legal move by Beijing — bringing data under Chinese jurisdiction will make it easier to prosecute entities seen as violating China's internet laws.[1]

The president of AmCham South China, Harley Seyedin, claimed that foreign firms are facing “mass concerns” because the law has greatly increased operating costs and has had a big impact on how business is done in China. More specifically, he stated that the cyber security law continues to create “uncertainties within the investment community and it’s resulting in, at the minimum, postponement of some R&D investment.”[16]

The law was widely criticized by western social activists for limiting freedom of speech. For example, the law explicitly requires most online services operating in China to collect and verify the identity of their users, and, when required to, surrender such information to law enforcement. Activists claimed that this policy dissuades people from freely expressing their thoughts online.[17] However, the enforcement law in many countries have authorized the transfer of account date in the investigation under circumstance. It is only to question, if the companies have to require the real identity information of their users when then register, because the companies may transfer such identity information to law enforcement.

See also

References
  1. Wagner, Jack (2017-06-01). "China's Cybersecurity Law: What You Need to Know". The Diplomat. Archived from the original on 2018-12-12. Retrieved 2018-12-14.
  2. "网络安全法（草案）全文_中国人大网". www.npc.gov.cn. Archived from the original on 2016-10-29. Retrieved 2018-04-14.
  3. Lulu, Xia, and Zhao Leo (2018-08-21). "China's Cybersecurity Law: An Introduction for Foreign Businesspeople". China Briefing. Archived from the original on 2018-12-13. Retrieved 2018-12-14.CS1 maint: multiple names: authors list (link)
  4. 网易. "网络安全法明确了网络空间主权原则_网易新闻". news.163.com. Archived from the original on 2019-07-03. Retrieved 2018-04-14.
  5. "《网络安全法》正式施行 为个人信息加把"锁"". 中国网. Archived from the original on 2018-12-14. Retrieved 2018-04-14.
  6. 103411. "网络安全立法中的关键信息基础设施保护问题--理论-人民网". theory.people.com.cn. Archived from the original on 2018-04-15. Retrieved 2018-04-14.CS1 maint: numeric names: authors list (link)
  7. "专家解读《网络安全法》 具有六大突出亮点-新华网". www.xinhuanet.com. Archived from the original on 2018-04-15. Retrieved 2018-04-14.
  8. Gierow Johannes, Hauke (2015-04-22). "Cyber Security in China: Internet Security, Protectionism and Competitiveness: New Challenges to Western Businesses" (PDF). China Monitor, Merics: Mercator Institute for China Studies. Archived (PDF) from the original on 2018-12-16. Retrieved 2018-12-14.
  9. "Understanding China's Cybersecurity Law INFORMATION FOR NEW ZEALAND BUSINESSES" (PDF). Ministry of Foreign Affairs and Trade, and New Zealand Trade and Enterprise. Sep 2017. Archived (PDF) from the original on 2019-01-23. Retrieved 2018-12-14.
  10. Nick, Beckett (Nov 2017). "A Guide for Businesses to China's First Cyber Security Law". China Monitor, Merics: Mercator Institute for China Studies. Archived from the original on 2018-12-16. Retrieved 2018-12-14.
  11. Uchill, Joe (October 17, 2019). "China's upgraded cybersecurity law could take a toll". Axios. Archived from the original on March 29, 2020. Retrieved April 8, 2020.
  12. "Dangerous Partners: Big Tech and Beijing". Federal Bureau of Investigation. Archived from the original on 2020-04-02. Retrieved 2020-04-09.
  13. "中国施行《网络安全法》 外企为何担忧？". BBC 中文网. 2017-05-31. Archived from the original on 2018-05-11. Retrieved 2018-04-14.
  14. "Learn more about iCloud in China". Apple Support. Archived from the original on 2018-03-07. Retrieved 2018-04-14.
  15. "多家中国区应用商店下架Skype". 纽约时报中文网 (in Chinese). 2017-11-22. Archived from the original on 2018-04-13. Retrieved 2018-04-14.
  16. Hu, Huifeng (2018-03-01). "Cybersecurity law causing 'mass concerns' among foreign firms in China". South China Post. Archived from the original on 2018-11-07. Retrieved 2018-12-14.
  17. "中国《网络安全法》草案出炉 恐加强言论管制". BBC 中文网 (in Chinese). Archived from the original on 2018-05-08. Retrieved 2018-04-14.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.