Notesale: Turn your study into money

Document Preview

Extracts from the notes are below, to see the PDF you'll receive please use the links above

---

Chinese Cybersecurity Law and MNCs- A stressful business
environment
“There is no national security without cyber security” quoting
Xi Xing Ping’s press conference statement on Cybersecurity
review (October 2020) is a worthy opening note of this paper
...
So it is for People’s
Republic of China
...

the regulation over it are becoming more stringent and
dominant
...

The new version of regulations are now impacting the Domestic
tech MNCs specifically in control over data through strict
compliance with their dictated provisions
...

The keywords on focused list from the standpoint of MNCs are
discussed hereunder:
Data processing protocols: The MNCs are now mandatorily
subjected to
• establish independent oversight bodies (PIPL 2021);
• minimize processing and control over PRC Citizen’s
data(defined under Article 4, PIPL) and important
national data
...
MNCs needs to stay updated of what’s
considered offensive in PRC as it might not be in USA;
• certification and licensing required for processing any
form of data (supported by the PRC Big Data Project)
under any PRC authorized Units (MPS, CAC, Qihoo etc
...
The DSL and PIPL is strict over
all data collected, processed, housed within PRC or overseas
resulting to MNCs being subjected to
• install active malware protection mechanisms for all data
processing as well as warehousing systems (DSL 2021) which is also good for the MNCs;
• not transfer sensitive data classified as 'anonymized' for
whatsoever reason and abide to ‘any data collected
within PRC remains within PRC ' (PIPL 2021)– this might
be a wall in emergency circumstances;
• follow strict data assessment and authorization from PRC
(DSL and PIPL 2021) – Even for judicial purposes(Article
35, DSL 2021), all data are coming under scan of
Cyberspace Administration of China and other PRC
government agencies reflecting data insecurity for the
MNCs through these data security provisions;
• localization of data owned/collected by the MNC in PRC
mainland and uninterrupted access to all data whenever
required (most of which are acquired during the data

assessment process) – MNCs loose its freedom of access
over the collected data
...
Under these, the tech MNCs are
provided to :
• to follow all the data compliance policies of PRC;
• store data log for at least 6 months (Article 21 of CCL);
• not sell or share data (data that must be anonymized) to
other foreign/restricted tech companies
...
(Article 41 of PIPL 2021)
This provision is relaxed in case of urgent security
concerns and R&D purpose, but only after strict security
assessments by the State Network Information
Departments and State Security Councils (DSL 2021);
• and lastly risk management mechanisms (as provided in
data security protocols) pre and post cross border
transfer of data (DSL 2021)
...
B: 'Data to be anonymized' are inclusive of PRC Citizen’s
personal information (PIPL), bio metric data of users,
information involving national security concerns, classified
military data under the PRC's non disclosure policy
...
In case of non
compliance
• the MNCs triggering such threat (depending upon
severity of act) may be fined upto RMB 50 million or 5%
of company’s revenue of the last financial year, and RMB
200,000 for the individual responsible for the same
...
This will be a huge loss for the
MNCs
...
Once in, one has nowhere to escape

---