Microsoft Word - 8-SSEM2757排版.docx BCP Social Sciences & Humanities SSMI 2022 Volume 17 (2022) 40 Comparative Study on Legal Regulations of Cross-border Transfers of Personal Information Ruiyang Jin School of Public Affairs, Southwest Jiaotong University, Chengdu, China 1987910026@qq.com Abstract. The free and rapid cross-border transfer of personal information is one of the main contributors to the prosperity of digital economy. However, China has relatively strict restrictions on the cross-border transfers of personal information. Although such provisions are conducive to safeguarding the interest of the individuals and the nation, they have adverse impact on giving full play to the commercial value of personal information in the era of digital economy. Additionally, China's insufficient participation in the formulation of international rules counts against to the construction of China's data discourse power. Therefore, the Chinese legislation is immature and needs to be perfected. This article analyzes the advanced legislative experience abroad, including the GDPR rules, the CBPR rules, and the Personal Information Protection Law of Japan. Taking actual situations of China into consideration, this article then puts forward four suggestions, including issuing practical standard contracts as soon as possible, promoting the construction of industry self- discipline mechanism, carrying out supplementary legislation in key areas, and participating on our own initiative in mapping out international rules.These suggestions are expected to benefit the perfection of China's legislation on the cross-border transfers of personal information as well as the enhancement of China's international data discourse power. Keywords: Personal Information Protection Law of the People’s Republic of China; GDPR; CBPR; cross-border transfers of personal information. 1. Introduction The digital economy is of great significance to China, so is the legislation on cross-border transfers of personal information. According to the White Paper on the Development of China's Digital Economy issued by China Academy of Information and Communications Technology (CAICT) in 2021, the scale of China's digital economy reached 39.2 trillion yuan in 2020, accounting for 38.6% of GDP, effectively supporting China's economic growth as well as prevention and control of COVID-19 epidemic. The cross-border transfers of personal information is the core demand of successful digital trade. The thrive of international trade in goods, services and intellectual property rights all need a clear legal system for the cross-border transfers of personal information. In order to perfect the relevant legislation in China, early domestic research mainly focus on the definition of personal information, the difference between personal information and personal data, individual’s rights regarding personal information and the necessity of the national supervision on the cross-border transfers of personal information. Recent domestic research mainly focus on the original intention of legislation, domestic storage of personal information and the balance of the interests of the individuals, the enterprise and the nation. This article will first elaborate the current legal system of cross-border transfers of personal information, then analyze the advanced legislative experience of the EU, the US and Japan, finally list four suggestions from the perspective of comparative law to benefit the perfection of Chinese legislation. 2. The Legal System of Cross-border Transfers of Personal Information in China China's key provisions on the cross-border transfers of personal information can be found in the Personal Information Protection Law of the People's Republic of China. The six provisions in Chapter BCP Social Sciences & Humanities SSMI 2022 Volume 17 (2022) 41 3 specify the requirements for personal information processors to provide personal information to foreign parties. Next, the author will elucidate these provisions in detail. 2.1 Requirements for Providing Personal Information to Foreign Parties According to Article 38, there are two requirements for a personal information processor in China to meet before it can provide personal information to a foreign party legally. One requirement is that the processor can only transfer the information for business, and the other is to meet one of the following four conditions:The first condition is to pass the security assessment, which is organized by the national cyberspace administration. The second condition is to pass the personal information protection certification conducted by specialized institutions designated by the national cyberspace administration; The third condition is to conclude a contract with the foreign recipients. The contract here must be based on the standard contract developed by the national cyberspace administration, its enterprise-drafted counterpart will not be feasible; The last condition is a general provision, which requires personal information processors to meet other conditions stipulated by laws, administrative regulations or the national cyberspace administration. At the same time, the personal information processor shall also fulfill the obligation of notification to the individuals and obtain their separate consent according to Article 39. By and large, the requirements for the processors to provide personal information to foreign parties stipulated by Chinese laws are relatively strict. 2.2 Requirements for Domestic Storage of Personal Information Generally, the provisions do not require common personal information processors to store personal information in China, but according to Article 40, there are two exceptions for which the domestic storage is a must. One being the critical information infrastructure operator, and the other being the personal information processor that processes the personal information reaching or exceeding the threshold specified by the national cyberspace administration in terms of quantity. The author believes that this is more out of the consideration of national security. As for those who process a large amount of personal information, the author believes that it is also reasonable to require their information to be stored in China for the sake of both the nation and the individuals. However, aside from the quantity of information, the category of information should also be taken into account. For instance, personal information in medical field may indicate the health status of the individuals, it is obviously more sensitive than basic information such as names and contacts. 2.3 Countermeasures of China According to Article 42 and Article 43, China has the right adopt the principle of reciprocity for discriminatory measures taken by other countries and regions. Countermeasures will be taken when overseas organization or individual infringes upon the rights and interests of Chinese individuals, or endangers China's national security and public interests in terms of personal information protection. 3. Advanced Foreign Legislative Experience 3.1 GDPR Rules Led by the European Union In terms of personal information protection legislation, the EU is more inclined to protect individual rights. Therefore, the GDPR rules has very strict restrictions on the cross-border transfer of personal information. According to Article 45 of GDPR, the cross-border transfers of personal information can be based on adequacy decisions. Because the EU pays special attention to the protection of individuals’ rights, its review mechanism is really strict, leaving only a few countries in the world obtaining the adequacy decision of GDPR. Consequently, GDPR has supplementary provisions in favour of the smooth operation of cross-border transfers of personal information, including the conclusion of standard contract. The BCP Social Sciences & Humanities SSMI 2022 Volume 17 (2022) 42 European Data Protection Commission has already developed two sets of standard contracts, the main contents of which include: first, the contracts shall stipulate that the rights of the individuals should be protected; second, if individual rights are infringed during the process of the cross-border transfer, the transmitter and recipients are jointly and severally liable; third, the EU can exercise long arm jurisdiction according to the contracts. 3.2 CBPR Rules Led by the United States The United States is more inclined to promote the free and rapid flow of personal information. CBPR rules mainly feature industry self-discipline mechanism. Enterprises can provide personal information across borders after conducting their own internal assessment and passing the agency assessment. The privacy protection agency will intervene and hold the enterprise accountable only in the case of illegal cross-border transfers. As a result, the United States can take advantage of its scientific and technological advantages to let the personal information from all around the world to be concentrated in the United States. Although the protection of the individuals’ rights is relatively low, it can maximize the commercial value of personal information, which is in line with the overall interests of the United States. However, the relatively lenient restrictions in CBPR rules do not mean the complete freedom of cross-border transfers of personal information. The American legislation also has stricter restrictions on personal privacy and the cross-border transfers of personal information in the financial industry, high-tech industry and medical industry. 3.3 Personal Information Protection Law of Japan Japan's legislation on personal information protection reflects the coordination of individual interests, commercial interests and national interests. First, Japan has a white list mechanism, which is similar to the adequacy decisions in the GDPR rules. According to Personal Information Protection Law of Japan, as long as the recipients are on the white list, Japanese personal information processors are permitted to transfer information to them without the separate consents of the individuals. This has helped Japanese high-tech companies conduct cross-border transactions and created more economic benefits for Japan. For those countries that are not on the white list, if the personal information processor in Japan wants to transfer information to them, it is necessary for the processors to obtain the consent of the individuals. Of course, there are exceptions. If it is for the vital interests of the individuals or the national public interest, the processors are permitted by the law to transfer personal information directly to foreign recipients without obtaining the consents of individuals. 4. Existing Problems in China’s Current Legislation on Cross-border Transfers of Personal Information 4.1 The Restriction on Cross-border Transfers of Personal Information Is Too Strict China's restrictions on the cross-border transfers of personal information are more lenient than GDPR rules but are more stricter than CBPR rules and Personal Information Protection Law of Japan. On the whole, the Chinese legislation is still too strict. Whereas, the Chinese legislation can be quite strict under certain circumstances compared to its American an Japanese counterparts, making it difficult for the free flows of personal information. According to CBPR rules, the processors are entitled the right to transfer personal information to foreign parties without the consents of individuals after having conducted the internal assessment and passed the agency assessment. While the Chinese processors must fulfill the obligation of notification and get the individuals’ separate consents before conducting cross-border transfers even if they have already passed the personal information protection certification. BCP Social Sciences & Humanities SSMI 2022 Volume 17 (2022) 43 Moreover, the Personal Information Protection Law of Japan stipulates exceptions where processors are permitted to transfer information to foreign recipients without individuals’ consents, but there is no similar provisions in the chapter 3 of Personal Information Protection Law of People’ s Republic of China Overall, due to the strict regulations, China's high-tech companies may lose the opportunity to communicate with advanced foreign companies, and domestic consumers may be deprived of the opportunity to enjoy high-quality international services. 4.2 China’s Participation in the Formulation of International Rules is relatively low At present, the GDPR rules and the CBPR rules are most influential in the world when it comes to the International rules on personal information protection. The United Arab Emirates, Thailand, India and many other countries have introduced data protection laws with reference to GDPR. The United States, Japan, Canada, Mexico, Singapore, South Korea and Australia are all parties of CBPR rules. Moreover, Japan is also participating actively in the formulation of international rules. So far, Japan has opened multilateral negotiations on CPTPP rules, and signed the Japan-Europe Economic Partnership Agreement (EPA) with the EU. However, as a country with prosperous digital economy, China has not obtained an international data discourse power commensurate with its status in the field of personal information protection, nor has it established the mechanism of free transfers of information and mutual trust with its important trading partners. 5. Suggestions on the Perfection of China’s Legislation on Cross-border Transfers of Personal Information 5.1 Issuing Practical Standard Contracts as Soon as Possible Issuing practical standard contracts can promote the cross-border transfers of personal information to a certain extent under the current legislation for it is low-cost but highly efficient. The freer flow of information will succeed in accumulating more wealth for China. According to current Chinese law, the processors can provide personal information to foreign recipients after concluding a contract. However, the standard contract has not been issued by the national cyberspace administration so far. Relevant authorities in Europe have already issued two sets of standard contracts according to the provisions of GDPR. These two sets of contracts confirm the requirements for the protection of individuals’ rights, clarify the allocation of responsibilities, and stipulate the long arm jurisdiction of the EU. Taking the actual situation of our country into consideration, competent authorities in China can refer to the contract terms provided by the EU and issue a practical standard contract as soon as possible. 5.2 Promoting the Construction of Industry Self-discipline Mechanism CBPR rules mainly rely on industry self-discipline to regulate the cross-border transfers of personal information. It has the merits of relieving the government of heavy regulatory burden and boosting the economic growth led by free flows of personal information at low cost and high efficiency. The Chinese legislator can refer to the management standards of information security stipulated in CBPR rules to encourage and guide Chinese enterprises to conduct internal evaluation first, and then apply for certification conducted by the specialized institutions, so as to improve the efficiency and realize the commercial value of the information on the premise of protecting individuals’ rights. BCP Social Sciences & Humanities SSMI 2022 Volume 17 (2022) 44 5.3 Carrying Out Supplementary Legislation in Key Areas CBPR rules generally allow the free cross-border transfers of personal information, but the United States has made special and strict restrictions on some key areas such as finance and medicine in order to protect the individuals’ rights. Article 38 of Personal Information Protection Law of the People’s Republic of China leaves room for supplementary legislation in key areas. For example, the chapter 4 of the Regulations on the Network Protection of Minors (Exposure Draft) shows the targeted protection of minors. In some key areas, such targeted protection is more conducive to safeguarding the individual interests , because it not only consider the quantity of personal information, but also consider the sensitivity and significance of different categories of personal information. 5.4 Participating on Our Own Initiative in Mapping Out International Rules The Belt and Road Initiative has injected new vitality and vigor into the prosperity of international cooperation and trade. General Secretary Xi points out that the interconnection is of crucial significance to the success of the Belt and Road Initiative. In the era of digital economy, interconnection not only refers to the connection of infrastructure, but also refers to the cross-border transfers of information and data. The appropriate international rules should be set up to promote the free flow of personal information across the members of the Belt and Road Initiative. As the initiator of the project, it is China’s responsibility to actively lead the formulation of relevant international rules. The author believes that we should not only tap into the merits of GDPR and CBPR rules, but also consider the actual situation of each member comprehensively to map out the appropriate rules which serve the interests of the members as far as possible. 6. Epilogue The legal system of cross-border transfers of personal information has a significant impact on the healthy development of digital economy. During the COVID-19 epidemic, China's large scale and fast growing digital economy has maintained strong growth and steady development. It has become the most dynamic and innovative economic form in our country. The 14th Five-year Plan period(2021-2025) is the critical time for the development of China's digital economy. The appropriate legal system which is in line with the actual situations of China can promote the prosperity of digital economy. In order to perfect the strict legislation in China, we should refer to advanced foreign legislative experience, issue practical standard contracts as soon as possible, promote the construction of industry self-discipline mechanism and carry out supplementary legislation in key areas. Furthermore, we should participate on our own initiative in mapping out international rules to enhance the international data discourse power of China. The author expects that in the future, free flows of information will be encouraged on the basis of ensuring national security and protecting personal interests to maximize the commercial value of personal information and meet the overall interests of the country. Acknowledgements This work is supported by “2021 College Student Innovation and Entrepreneurship Training Program” under the project “Research on Legal Protection of the Rights of Digital Vulnerable Groups.” Project number:202110613066 BCP Social Sciences & Humanities SSMI 2022 Volume 17 (2022) 45 References [1] Wang Liming. Highlights and Innovations of Personal Information Protection Law. Journal of Chongqing University of Posts and Telecommunications (Social Science Edition). Vol. 33(2021) No. 166(06), p. 1- 13. [2] Zhang Linghan. Three Dimensions of the Personal Information Cross-Border Flow System. China Law Review. (2021) No. 5, p. 37-47. [3] Lin Wei. Law and Approaches to Regulate Cross-border Flow of Personal Information from the Perspective of Comparative Law: Also on the Chinese Personal Information Protection Law (Draft). Social Sciences in Shenzhen. (2021), No. 4(04), p. 99-109. [4] Information on: www.caict.ac.cn/kxyj/qwfb/bps/202104/P020210424737615413306.pdf