美国公司如何接近中国的数据、隐私和网络安全制度（英）-美中贸易全国委员会-2022.4-22页_560kb

Summary of "How American Companies are Approaching China's Data, Privacy, and Cybersecurity Regimes"

Core Content

This report, published by the US-China Business Council (USCBC) in April 2022, examines the challenges faced by American companies in navigating China's evolving data, privacy, and cybersecurity regimes. It highlights the increasing complexity and restrictions imposed by Chinese laws and regulations, which contrast sharply with international standards and create compliance burdens for foreign firms.

Main Challenges

1. Data Localization and Cross-Border Restrictions

• Data Localization: Companies are required to store personal information and important data locally, disrupting global operations.
• Cross-Border Data Transfer: Security reviews and restrictions on data transfers significantly increase operational costs and limit the ability to use global IT solutions.
• Impact on Innovation: Restrictions prevent companies from offering advanced products and services, such as remote medical device management, due to concerns over data flow disruptions.

2. Regulatory Ambiguity

• Unclear Definitions: Key terms like "important data" and "personal information" lack clear definitions.
• Ambiguous Enforcement: There is no consistent enforcement framework, leading to uncertainty and compliance challenges.
• Voluntary Standards as Mandatory: Voluntary regulations are often treated as mandatory, increasing the complexity of compliance.

3. Inconsistent Enforcement

• Regional and Industry Variations: Enforcement varies across regions and industries, making it difficult for companies to understand and comply with requirements.
• Operational Pressures: Companies are pressured to comply despite the lack of clear guidance on how to do so.

4. Sector-Specific Challenges

• Automotive Sector: Faces broad definitions of "important data" that include data from the supply chain, such as geographic and traffic information.
• Healthcare Industry: Struggles with data collection and transmission restrictions, particularly in clinical trials.
• Financial Services: Subject to strict data localization requirements that predate the Cybersecurity Law (CSL).

Key Concerns with Chinese Laws

• Cybersecurity Law (CSL): Imposes data localization and security reviews on critical information infrastructure (CII) operators.
• Data Security Law (DSL): Expands data localization and introduces a data security review system for cross-border transfers.
• Personal Information Protection Law (PIPL): Requires strict consent mechanisms and imposes conditional restrictions on cross-border data transfers.

Impact on Business Operations

• Cost Increases: Companies must invest in duplicative systems, data centers, and staffing to comply with data localization.
• Operational Disruptions: Restrictions on cross-border data flows hinder product troubleshooting, R&D, and compliance in global markets.
• Competitiveness Concerns: These regulations may reduce the competitiveness of foreign firms in China, especially compared to domestic counterparts.

Future Outlook

• Potential for Data Islands: If implemented rigidly, these policies could create data islands, forcing companies to localize technology and operations.
• Need for Clarity: Businesses await clearer definitions and consistent enforcement mechanisms to manage compliance effectively.
• Global Integration Risks: The restrictive nature of China's data policies may hinder its integration with the global economy.

Conclusion

The report underscores the growing challenges for American companies operating in China due to the restrictive and ambiguous nature of the country's data, privacy, and cybersecurity regimes. These challenges affect a wide range of industries and could have long-term implications for business operations, innovation, and competitiveness in the Chinese market.