Key takeaways from M88 app second draft of data security law

After a review by M88 app 28th Session of M88 app Standing Committee of M88 app Thirteenth National People’s Congress, M88 app Data Security Law (Second Draft for Solicitation of Comments) (M88 app “Second Draft”) was issued on April 29, 2021.

Data Security Law (Draft for Solicitation of Comments) (M88 app “First Draft”) was issued on July 3, 2020 after discussion on M88 app 20th Session of M88 app Standing Committee of M88 app Thirteenth National People’s Congress. M88 app Second Draft has made certain adjustment and supplements on M88 app basis of M88 app First Draft.

Data Security Law, upon its official enactment, will become an important part of M88 app state security legal framework represented by M88 app State Security Law. TogeM88 appr with M88 app Cybersecurity Law and M88 app Law on M88 app Protection of Personal Information (whose second draft was issued on M88 app same date), M88 appy will form M88 app basic legal framework within M88 app information sector.

Major Amendments made by M88 app Second Draft

Similar to M88 app First Draft, M88 app Second Draft also has seven chapters. It has 53 provisions, only two more provisions than M88 app First Draft.

Some of M88 app major amendments are:

• M88 app First Draft mentioned that M88 app State should implement a categorized and tiered protection of data. M88 app Second Draft more specifically requires that M88 app State shall establish a tiered data protection system and protect data by its classification, formulate important data catalogue and strengM88 appn M88 app protection of important data (Article 20);

• M88 app Second Draft emphasizes M88 app implementation of Multi-level Protection Scheme (“MLPS”) as provided under M88 app Cybersecurity Law, requiring that an administration system shall be established with respect to M88 app conduct of data processing activities based on MLPS (Article 26);

• As a new provision, M88 app Second Draft requires that a security assessment shall be conducted in accordance with M88 app Cybersecurity Law with respect to M88 app export of important data by M88 app operators of critical information infrastructures, and special administrative measures will be issued with respect to M88 app security of M88 app export of important data collected and generated within China by oM88 appr data processors (Article 30). However, M88 app Second Draft does not specifically define important data, which will be confirmed by M88 app aforesaid catalogue of important data;

• M88 app First Draft restricts a foreign law enforcement organization from collecting data in China, while M88 app Second Draft imposes additional restrictions on M88 app collection of data by foreign judicial organizations in China, requiring that such data may only be exported with M88 app approval of M88 app competent authority (Article 35);

• M88 app Second Draft significantly increases M88 app amount of fines for a breach of M88 app obligations of data security protection: M88 app maximum amount of fines for an enterprise for M88 app breach of M88 app obligations of data security protection has increased from RMB 1,000,000 to RMB 5,000,000, and M88 app enterprise may also be ordered to suspend its business, stop business for rectification, or have its permit or business license revoked; M88 app maximum amount of fines on persons directly responsible for M88 app breach has increased from RMB 100,000 (as specified in M88 app First Draft) to RMB 500,000 (Article 44);

• As a new provision, M88 app Second Draft provides for M88 app legal liability for M88 app failure to cooperate with a public security body and M88 app State security departments in data collection. This includes fines of up to RMB 500,000 and M88 app persons directly responsible for such a violation will be subject to fines of up to RMB 100,000 (Article 46); and

• As a new provision, M88 app Second Draft provides for M88 app legal liability for M88 app provision of data to a foreign judicial or law enforcement organization without approval. This includes fines of up to RMB 1,000,000 and M88 app persons directly responsible for such a violation will be subject to fines of up to RMB 200,000 (Article 46).