Cyber-security legislation banning the collection and sale of users’ personal information will come into force across China on Thursday.
Chinese officials have insisted that the law will not restrict foreign companies from operating in the country.
Go deeper with GlobalData
All companies operating in China will have to store user data on servers inside the country to comply with the new legislation.
That means that any information relating to Chinese citizens or China’s national security must be held on Chinese servers.
Companies will have to submit to a review by regulators before transferring large amounts of personal data abroad.
Any company holding data that, if breached, could “harm people’s livelihoods” must go through a more thorough “national security review” to ensure they and their data systems are “secure and controllable”.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe terminology is so vague that even fast-food companies could hold data with the potential to harm people’s livelihoods, because they provide a service to millions of people.
Foreign companies under threat?
Despite assurances from Chinese officials, business representatives and analysts have warned that the legislation will give Chinese companies an unfair advantage over foreign ones.
“The law is both extremely vague and exceptionally wide in scope, potentially putting companies at risk of regulatory enforcement that is not related to cyber security,” Carly Ramsey, associate director at Control Risks, a risk-management consultancy told the Financial Times.
In a letter to the Cyberspace Administration of China (CAC) seen by Reuters, a group representing European business interests said that the legislation would lead to “great uncertainties and compliance risks”.
The European Union Chamber of Commerce in China told the CAC that the law was “fraught with weaknesses” and called for its introduction to be delayed to “allow sufficient discussion”.
Foreign companies will have to undergo a huge amount of restructuring in order to comply with the new laws, Xun Yang, a lawyer at Simmons & Simmons in Shanghai, told the Financial Times.
He said:
The message is clear that the government will encourage more domestic development of technology, and that it now sees privacy and cyber security as vital national concerns.
However, Scott Schober, a cyber security expert and author of Hacked Again told Verdict that the new legislation is still very vague.
“New cyber security laws taking effect in China remain unclear, leaving foreign companies that operate in that territory unsure of where they stand,” he explained.
He added that greater transparency is crucial.
“These new cybersecurity laws mandate that companies must store their data within China. Certain communications and finance business sectors would be scrutinized even further with additional security checks to be imposed. Anytime there is ambiguity in a law, it leaves wiggle room for interpretation which costs organizations in time and money due to inaction. The last thing that China needs are corporations sitting on the fence so hopefully they will provide further transparency for their new cyber laws,”
China dismisses criticism
However, the CAC insists that the cyber security law will go ahead as planned, despite the concerns voiced by members of the global business community.
“The purpose is to safeguard [China’s] national cyber-space sovereignty and national security… rather than to restrict foreign enterprises,” the CAC said in a statement on its website.
“It does not restrict foreign companies or their technology and products entering the Chinese market, neither does it limit the orderly, free flow of data in accordance with the law,” it added.
