How does Data Transfer work under PIPL?  

Article by Tsaaro

7 min read

How does Data Transfer work under PIPL?  

Introduction 

When it comes to cross-border data transfers, the PIPL and GDPR are similar in several ways, but there are still some variances in the specifics. For companies to transmit personal data to a third country or an international body, both laws provide for a transfer method, albeit the PIPL offers fewer options. The PIPL also imposes various cross-border data transfer restrictions based on the status of organizations – specifically, whether the organization transferring personal information overseas is considered to be an operator of critical information infrastructure – and the volume of personal information processed by organizations.  

Personal information is defined as electronic (or other recorded) data that relates to a recognized or identifiable natural person, excluding information that has been anonymized. According to the PIPL, an “organization or individual that independently chooses the objectives and means for processing of personal information” is referred to as a personal information processing entity (Article 73). This appears to be the data controller idea under the EU General Data Protection Regulation’s Chinese legal counterpart.  

Generally speaking, a processing entity that intends to transfer personal data to organizations outside of China must I inform individuals about the transfers and obtain separate consent (Article 39), (ii) take the necessary steps to ensure that the overseas recipients can provide the same level of protection as required by the PIPL (Article 38), and (iii) conduct a personal information protection impact assessment (Article 55).  

Cross-Border Transfer  

For a cross-border data transfer, Article 39 expressly requires companies to seek separate consent, and the language itself does not include any exceptions. Additionally, it’s not obvious if separate consent would still be necessary if it wasn’t the legal justification for processing at the time of collection. For instance, if a corporation processes publicly available information based on Article 13.6, which does not need authorization at the moment of collection, it would be impossible for businesses to get separate consent from data subjects. On this subject, more regulatory advice could be provided in the future. In additionally to the above-mentioned generally applicable standards, Article 38 provides three transfer options for businesses intending to transmit personal information outside of China. The three transfer methods provided by PIPL are certification, standard contractual provisions, and security assessment. The attributes of the operators determine how these mechanisms can be used.  

If they intend to send personal information outside of China, operators of critical information infrastructure and those handling a “significant volume” of personal information must go through a security assessment conducted by the Cyberspace Administration of China. The proposed Measures for the Security Evaluation of Cross-Border Data Transfer, which is covered below, outline the proposed procedure for the security assessment. Non-CIIOs that fall short of the criteria outlined in these Draft Measures do not need to undergo a security assessment but must select one of the legal transfer channels listed below:  

  1. Obtaining accreditation in personal information protection from professional organizations in compliance with the CAC’s standards.  
  2. Establishing a contract based on SCCs with the data receiver outside of China.  

Article 38 does have a “catch-all” clause that bases a transfer on the fulfillment of additional requirements set out by laws and regulations, but as of yet, it is unknown what those other requirements would be.  

 

SECURITY ASSESSMENT  

CIIOs is the initial class of enterprises under security evaluation. According to Article 40, CIIOs must save all “citizens’ personal information and critical data” created or gathered during domestic activities in China. Unless otherwise mandated by law, designated agencies must complete a security assessment when transnational data transfers are required for operational reasons. Any international transmission of personal data by CIIOs will be the subject of a security evaluation.  

Other than CIOs, a Chinese processing organization should request the CAC for a security assessment under Article 4 of the Draft Measures if it:  

  1. Processes the personal data of over a million people.  
  2. Has collectively sent more than 100,000 individuals’ personal information or more than 10,000 individuals’ sensitive personal information.  

Following the PIPL, “sensitive personal information” refers to “personal information that, once leaked or used unlawfully, may easily infringe the dignity of a natural person or cause harm to personal safety and property security, such as biometric identification information, religious beliefs, specially-designated status, medical health information, financial accounts, information on individuals’ whereabouts, as well as personal information of minors under the age of 14.” (Article 28).  

 

MECHANISM OF SECURITY ASSESSMENT  

When requesting a security assessment for a cross-border data transfer, data processing firms are required to present the following documentation under Article 6 of the Draft Measures:  

  1. A request forms.  
  2. Self-evaluation report.  
  3. The contract that will be signed between the overseas receiver and the data processing organization, or other legally enforceable papers.  
  4. Additional resources needed for the security evaluation.  

 

Loopholes of the PIPL  

Even after the publication of the Draft Measures, there are still many significant concerns surrounding the security assessments. For instance, the duration for computing cumulative transfers is not addressed in the Draft Measures. Furthermore, it is not clear whether group firms with several subsidiaries and affiliates are required to calculate the total number of people whose personal information has been processed or transmitted overseas, or if each subsidiary and affiliate must do so independently. Since the present Draft Measures haven’t been revised since December 2021, we had anticipated a final version to have been published by now. However, this hasn’t happened yet.  

The Draft Measures place a strong emphasis on the security evaluation for cross-border data transfers but do not contain any particular guidelines on the data localization requirements. In other words, it is unclear from the Draft Measures whether data localization is a need for cross-border data transfer for businesses that may also be subject to the requirements for data localization. It’s also not clear if businesses that must undergo security assessments run a higher risk of having the data localization rules imposed upon them.  

The CAC has not yet provided any more information on the two other transfer procedures as of the current date. Particularly, the CAC has not released any sample or standard contracts that would enable parties to comply with Article 38.3 of the PIPL.  

The Certification Specification does not serve as a certification plan outlining all the pertinent controls that a certification body may examine when a firm requests certification. Instead, it just gives a general overview of the standards that would probably be taken into account throughout the certification process. As a result, and in a misleading manner, the Certification Specification does not address several crucial concerns characteristic of certification of this kind, such as identifying accredited certification bodies or outlining how the certification process would be managed by such certification bodies. As a point of reference, Article 9 of the Draft Measures states that the security assessment will take into account whether the contract between the overseas recipient and the data processing entity “fully stipulate(s) the responsibilities and obligations of data security protection,” as explained by the CAC.  

Conclusion  

The Certification Specification is similar to the GDPR’s EU Binding Corporate Rules (“BCR”) in many ways. For example, both outline specific information that must be included in a contract that is enforceable and legally binding between the parties and is intended for usage by international corporations. There are some noticeable distinctions, though. Notably, the BCR requires the EU party with delegated responsibilities to submit to the jurisdiction of the EU courts or other competent authorities if a non-EU party violates the BCR, unlike the Chinese Certification Specification, which requires the overseas recipient to agree to accept the supervision of the Chinese certification body and “accept the jurisdiction of the relevant Chinese laws and regulations on personal information protection.” Take the first step towards a secure your organization’s data by scheduling a call with our privacy expert team at Tsaaro Solutions today.

104 thoughts on “How does Data Transfer work under PIPL?  ”

  1. What i don’t understood is actually how you are no longer actually a lot more neatly-appreciated than you might be now. You are so intelligent. You realize thus significantly in the case of this matter, made me in my opinion imagine it from a lot of numerous angles. Its like men and women are not involved except it¡¦s something to do with Woman gaga! Your own stuffs nice. All the time deal with it up!

  2. An impressive share! I have just forwarded this onto a colleague who was conducting a little research on this. And he actually ordered me dinner due to the fact that I discovered it for him… lol. So let me reword this…. Thanks for the meal!! But yeah, thanx for spending time to discuss this subject here on your internet site.

  3. Can I just say what a relief to discover a person that genuinely knows what they’re discussing on the internet. You certainly realize how to bring a problem to light and make it important. A lot more people must check this out and understand this side of your story. I can’t believe you aren’t more popular because you most certainly possess the gift.

  4. After going over a number of the blog posts on your website, I seriously like your technique of writing a blog. I bookmarked it to my bookmark webpage list and will be checking back soon. Take a look at my web site too and let me know what you think.

  5. I blog frequently and I really appreciate your information. This article has really peaked my interest. I’m going to book mark your website and keep checking for new information about once a week. I subscribed to your RSS feed as well.

  6. I’m amazed, I have to admit. Seldom do I encounter a blog that’s both educative and entertaining, and let me tell you, you have hit the nail on the head. The issue is something which not enough folks are speaking intelligently about. I am very happy that I came across this in my hunt for something concerning this.

  7. I’m impressed, I must say. Rarely do I come across a blog that’s equally educative and entertaining, and without a doubt, you’ve hit the nail on the head. The problem is something which too few folks are speaking intelligently about. I am very happy I found this during my hunt for something relating to this.

  8. That is a very good tip particularly to those new to the blogosphere. Simple but very precise information… Many thanks for sharing this one. A must read article.

  9. Howdy! This blog post could not be written any better! Reading through this post reminds me of my previous roommate! He continually kept talking about this. I am going to send this information to him. Pretty sure he will have a good read. I appreciate you for sharing!

  10. I would like to thank you for the efforts you have put in writing this blog. I’m hoping to see the same high-grade blog posts by you in the future as well. In truth, your creative writing abilities has motivated me to get my own, personal blog now 😉

  11. I blog quite often and I seriously thank you for your content. This article has really peaked my interest. I am going to bookmark your website and keep checking for new information about once per week. I subscribed to your Feed too.

  12. Aw, this was a really nice post. Spending some time and actual effort to generate a really good article… but what can I say… I hesitate a lot and don’t manage to get nearly anything done.

  13. Hi, I believe your blog could possibly be having browser compatibility problems. When I take a look at your web site in Safari, it looks fine however when opening in I.E., it has some overlapping issues. I just wanted to give you a quick heads up! Besides that, fantastic website.

  14. Hello there! I could have sworn I’ve been to this web site before but after browsing through many of the articles I realized it’s new to me. Anyhow, I’m definitely pleased I came across it and I’ll be book-marking it and checking back regularly.

  15. An impressive share! I’ve just forwarded this onto a colleague who has been doing a little research on this. And he in fact ordered me lunch simply because I found it for him… lol. So let me reword this…. Thank YOU for the meal!! But yeah, thanks for spending time to discuss this topic here on your web page.

  16. The very next time I read a blog, Hopefully it does not fail me just as much as this particular one. I mean, I know it was my choice to read through, however I actually thought you would probably have something interesting to talk about. All I hear is a bunch of complaining about something you could fix if you were not too busy searching for attention.

  17. Howdy! This blog post couldn’t be written much better! Looking at this post reminds me of my previous roommate! He continually kept talking about this. I will forward this article to him. Fairly certain he’s going to have a very good read. Thank you for sharing!

  18. Howdy! This post could not be written any better! Going through this article reminds me of my previous roommate! He continually kept preaching about this. I will forward this post to him. Fairly certain he’ll have a very good read. I appreciate you for sharing!

  19. I must thank you for the efforts you’ve put in writing this site. I really hope to view the same high-grade content by you later on as well. In truth, your creative writing abilities has encouraged me to get my own, personal site now 😉

  20. Good day! Do you know if they make any plugins to help with Search Engine Optimization?
    I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good
    gains. If you know of any please share. Kudos! I saw similar blog here: Eco product

  21. An outstanding share! I have just forwarded this onto a co-worker who was doing a little homework on this. And he actually bought me breakfast due to the fact that I discovered it for him… lol. So allow me to reword this…. Thanks for the meal!! But yeah, thanks for spending the time to talk about this issue here on your website.

  22. I’d like to thank you for the efforts you have put in penning this website. I really hope to see the same high-grade blog posts from you in the future as well. In truth, your creative writing abilities has motivated me to get my own, personal blog now 😉

  23. When I initially commented I appear to have clicked on the -Notify me when new comments are added- checkbox and now whenever a comment is added I get four emails with the exact same comment. Perhaps there is a means you are able to remove me from that service? Cheers.

  24. After exploring a handful of the blog articles on your website, I truly like your technique of writing a blog. I book-marked it to my bookmark website list and will be checking back soon. Please visit my web site too and let me know what you think.

  25. I’m amazed, I have to admit. Rarely do I encounter a blog that’s equally educative and interesting, and let me tell you, you have hit the nail on the head. The problem is something which too few men and women are speaking intelligently about. I am very happy I stumbled across this in my search for something regarding this.

  26. You have made some good points there. I checked on the internet for more information about the issue and found most people will go along with your views on this website.

  27. Can I simply just say what a comfort to find an individual who actually understands what they are talking about over the internet. You definitely know how to bring a problem to light and make it important. More people need to read this and understand this side of the story. I was surprised that you aren’t more popular given that you definitely have the gift.

  28. sugar Defender ingredients Adding Sugar Protector to my daily regimen was among the most effective choices I have actually produced my health and
    wellness. I beware regarding what I eat, yet this supplement includes an added layer of assistance.

    I really feel extra stable throughout the day, and my desires have lowered dramatically.
    It behaves to have something so easy that makes such a large difference!

  29. Hello, I do think your web site might be having internet browser compatibility issues. When I look at your site in Safari, it looks fine however, if opening in IE, it’s got some overlapping issues. I merely wanted to provide you with a quick heads up! Besides that, fantastic blog!

  30. You are so interesting! I don’t think I have read through anything like this before. So great to find another person with unique thoughts on this subject matter. Really.. thank you for starting this up. This web site is something that is needed on the internet, someone with a little originality.

  31. Hi there! This post couldn’t be written any better! Reading through this article reminds me of my previous roommate! He continually kept talking about this. I am going to send this post to him. Pretty sure he’s going to have a great read. Thanks for sharing!

  32. May I just say what a comfort to discover someone who truly knows what they are talking about over the internet. You definitely realize how to bring an issue to light and make it important. More people must look at this and understand this side of your story. I can’t believe you are not more popular because you definitely possess the gift.

  33. Nice post. I learn something totally new and challenging on blogs I stumbleupon everyday. It’s always interesting to read articles from other authors and use something from other web sites.

Leave a Reply

Your email address will not be published. Required fields are marked *

Shubham Bansal

INTRODUCTION: The Personal Data Protection Law No. 6698, known as Kişisel Verileri Koruma Kanunu (KVKK), is Türkiye’s landmark data protection …

Tsaaro Consulting

At the Singapore International Cyber Week 2024, The Cyber Security Agency (CSA) of Singapore released Guidelines on Securing Artificial Intelligence …

Tsaaro Consulting

The European Data Protection Board (EDPB) on 8th October 2024, issued draft Guidelines 1/2024 on processing of personal data based …

Tsaaro Consulting

Introduction   With data playing a pivotal role in business operations, ensuring data privacy compliance has become a key focus in …

Tsaaro Consulting

The FinTech industry has transformed the financial landscape, offering customers digital solutions that make banking, lending, insurance, and investing more …

Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them