A Deep Dive into TC260’s Proposed Guide for GBA Cross-border Data Transfer

The current cross-border data regimes in Mainland China is established pursuant to the Personal Information Protection Law (“PIPL”) (click here to read our interpretation of the PIPL). There are three routes for personal information processors^[1] to cross-border flow of personal information(“PI”), namely:

• Passing a governmental security assessment, that is required for (i) critical information infrastructure operators that export important data and PI; (ii) organisations that export important data;and (iii) organisations that process PI reaching one of the three threshold amounts^[2] specified by the Cyberspace Administration of China (“CAC”) (Click here to read our comments on the governmental assessment);
• Attaining a PI protection certification (“PIPL Certification”) by an institution accredited by the CAC (Click here and here to read our comments on the PIPL Certification regime); or
• Entering into the standard contractual clauses (“SCCs”) with the overseas PI importers (Click here to read our comments on the SCCs).

On 28 September 2023, the CAC released the draft “Regulation for Administering and Promoting Cross-border Data Flow”, which proposes substantial changes to the current cross-border data transfer regimes, but the draft regulation did not mention the data flow in the GBA (Click here to read our comments on the draft regulation).

In Hong Kong, Article 33 of the “Personal Data (Privacy) Ordinance” (“PDPO”) expressly prohibits the transfer of personal data to places outside Hong Kong except in circumstances specified in the PDPO^[3]. Considering the high demand for data free flow by Hong Kong enterprises, this clause has not been implemented yet, so there is currently no mandatory restriction on the cross-border transfer of personal data in Hong Kong. Still, the Office of the Privacy Commissioner for Personal Data of Hong Kong encourages the compliance with Article 33. It has issued two non-compulsory guidelines in 2014 and 2022^[4] to prepare for the implementation of Article 33, which include Recommended Model Contractual Clauses for Cross-border Transfers of Personal Data.

KEY PROVISIONS AND OBSERVATIONS

I. Legal Effect and Application

What is the legal effect of the Draft Guide?

The Draft Guide by TC260 is an unofficial, optional network security guide, not yet in effect. TC260 is not an official legislative body in Mainland China^[1]. According to the “Management Measures for Network Security Standard Practice Guides (Interim)”, the Network Security Standard Practice Guide aims to disseminate network security standards and knowledge, providing standardised guides. The Draft Guide serves as a basis for GBA Certification under the Memorandum and a compliance reference for PI Processors, without mandatory enforcement power.

Like PI protection certification guidelines under the PIPL Certification regime, the Draft Guide could be a precursor to future regulations and may evolve into a more effective document by TC260 or a higher authority when appropriate.

Is the GBA Certification the only way for cross-border data transfer in the GBA?

No. As the CAC issued the GBA SCCs based on the Memorandum on 13 December 2023, PI Processors in the GBA (the “GBA PI Processors”) can also choose to sign the GBA SCCs for cross-boundary data flow in the region. Therefore, the GBA Certification mechanism will not be the sole option for the GBA PI Processors.

The Draft Guide applies to the GBA PI Processors conducting cross-border PI processing via the GBA Certification. However, as the Memorandum’s full text is not public, several questions still need clarification:

• Does the GBA Certification mechanism form part of the PIPL Certification regime?
• Under the GBA Certification mechanism, what are the specific requirements for signing legal documents, filing with authorities, and how does it differ from current PIPL Certification regime and SCCs?
• As PI transferred under the GBA Certification mechanism cannot leave the GBA, does it imply the GBA Certification mechanism will be much simpler than the existing PIPL Certification regime?

Does the Draft Guide apply to data flows from both Mainland and Hong Kong?

The Draft Guide appears to aim at regulating data flow in both directions between Mainland and Hong Kong. This aligns with the Draft Guide’s logic, for example:

• The Draft Guide includes Hong Kong’s PI Processors within the GBA and discusses the PDPO. It introduces terms like “personal data”, “data subject”, and “data user”, which apply when Hong Kong data flows. If it were only regulating Mainland data flowing into Hong Kong, there would be no need to involve Hong Kong law.
• The Draft Guide does not categorize Hong Kong's PI Processors as overseas recipients. Instead, it groups them with Mainland GBA PI Processors, proposing uniform cross-border PI provision and receipt requirements. This suggests the Draft Guide's intent to regulate bidirectional data flow.

However, as per the “Chief Executive’s 2023 Policy Address” and the Hong Kong Government’s Secretary for the ITIB’s reply to the Legislative Council on 15 November 2023, the Memorandum was signed to enable the secure cross-border flow of Mainland data within the GBA. It does not address the flow of Hong Kong data into the Mainland.

The Hong Kong PDPO's data export provisions have not been implemented, so there are no compulsory limits on transferring Hong Kong data outside Hong Kong, only adherence to global protection standards and practices. If the Draft Guide regulates Hong Kong data flow into the Mainland, it could increase Hong Kong PI Processors' compliance burden. We will discuss the added compliance obligations for Hong Kong PI Processors in the “Specific Provisions” section as below.

Moreover, to apply the Draft Guide's requirements on bidirectional data flow between Mainland and Hong Kong, Mainland and Hong Kong authorities need to at least enact higher-level laws, set up GBA Certification institutions, and establish procedural rules.

Who is a GBA PI Processor under the Draft Guide?

The Draft Guide defines the GBA PI Processors as those registered (for organizations) or located (for individuals) in Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen, Zhaoqing of Guangdong Province, and Hong Kong.

Interestingly, the Draft Guide does not include PI Processors in Macau or mention Macau law, despite its summary stating it applies to cross-border PI processing in the GBA. This might be because the Memorandum was only signed between Mainland China and Hong Kong. To prevent confusion, it is suggested that the official Draft Guide version should clarify its applicability to Macau and include relevant Macau content if applicable.

Furthermore, the term “PI Processors” in Hong Kong might refer to the “data users” as per the PDPO, given the Draft Guide’s potential regulation of Hong Kong data flow to the Mainland. This should also be clarified in the official version of the Draft Guide.

II. Key Provisions 

The Draft Guide outlines principles and specific requirements for cross-border PI protection in the GBA, covering data processing's life cycle, PI rights protection, and PI security. It draws from the PIPL and PDPO, but aims to offer stricter, more detailed requirements.

Basic Principles

Besides the common principles of the PIPL and the PDPO, the Draft Guide adds special principles for inter-regional rule linkage. For example, PI Processors should adhere to local laws according to the principle of territoriality; cross-border PI processing should comply with legally binding documents' provisions and commitments.

Specific Protection Requirements

The Draft Guide mostly reflects the PIPL requirements, except when it specifies that local laws should be followed. It also includes direct marketing rules based on the Mainland laws, e.g., the “Advertising Law” and the “Measures for the Supervision and Administration of Online Transactions”.

This approach intends to harmonise the level of data protection across the GBA. However, it lacks approval from higher-level laws and could hinder the transfer of Hong Kong data to the Mainland. Specifically:

• The Draft Guide imposes requirements from the PIPL on Hong Kong’s PI Processors, exceeding compliance obligations under the PDPO

  The PDPO does not align with all obligations of the PIPL and Draft Guide concerning data collection, disclosure, processing, transfer, and personal rights protection. Legal concepts in the PDPO also differ from the Mainland’s^[1]. Hence, Hong Kong PI Processors may face challenge to understand and implement the Draft Guide’s requirements, which the TC260 is not authorised to impose on them.

• The Draft Guide, while advocating local law adherence, lacks clarity on precedence when conflicts arise between its own requirements and those local laws, leading to confusion.

  PI Processors in Hong Kong should be able to voluntarily adopt only those parts of the Draft Guide that do not conflict with local laws, while the local laws shall prevail when there is any conflict. This approach can allow those who voluntarily participate in the GBA Certification mechanism to protect PI as per Chinese law standards, while minimizing conflicts with local laws and regulations.

  Given the Mainland’s stricter data export restrictions compared with Hong Kong, using PIPL-based GBA Certification for Hong Kong data entering the Mainland could hinder data flow.

  Moreover, Draft Guide stipulates more detailed requirements on PI security for PI Processors, compared with the current effective requirements from the PIPL and PIPL Certification regime, including:

• Creating a cross-border PI catalogue: identify and form a catalogue of the PI involved in cross-border processing, and update it timely.
• Implementing access control: establish a minimum access policy for authorized personnel to access or read only necessary PI required by their duties.
• Accepting authority supervision: commit to ongoing supervision by certification authorities, including providing written evidence of having taken necessary actions.
• Establishing confidentiality agreements: limit PI processing permissions and sign confidentiality agreements with relevant personnel.
• Obtaining approval for major operations: implement internal approval processes for significant PI operations like batch modification, copying, and downloading.

Specifically, it states that onward data transfer should remain in the GBA. The PI Processor shall take measures such as contract agreement, commitment to certification authorities, filing with competent authorities, regular audit of recipient logs, annual self-assessment of data export security risks, etc., to prevent the recipient from transferring the received PI to a third party outside the GBA.

Both the Draft Guide and the GBA SCCs limit the recipient’s ability to transfer PI outside the GBA. This might be to prevent Hong Kong from being used by the exporters to circumvent Mainland data export regime. This implies that the GBA Certification mechanism might be simpler than the current PIPL Certification regime.

In this regard, we recommend that the Draft Guide should clarify the principle of voluntariness and allow Hong Kong PI Processors to voluntarily choose whether to transfer PI to the Mainland through the GBA Certification mechanism.

CONCLUSIONS

We propose the following amendments

• The GBA Certification should be optional for the GBA PI Processors, aligning with voluntary certification principles and optimizing the foreign investment environment.

• The Draft Guide should clarify if it applies to Macao in the official version. If so, it should include Macao relevant content in the applicable scope and rules.

Takeaways for GBA PI Processors

For Mainland GBA PI Processors:

• If onward transfer outside the GBA is necessary, one route of the data cross-border transfer regimes under the PIPL needs to be adopted; otherwise, Mainland GBA PI Processors may choose the GBA SCCs or the GBA Certification to export PI to Hong Kong.

• The GBA Certification will restrict data flow outside the GBA. It is unclear in status, legal effect, and implementation rules, and its convenience compared to mechanisms like SCCs is uncertain.
• Mainland PI Processors should closely monitor any regulatory development on potential exemptions of the data export compliance obligations.

For Hong Kong PI Processors:

• The Draft Guide could limit Hong Kong PI Processors from transferring data to the Mainland given Hong Kong’s absence of mandatory data export restrictions.
• Hong Kong PI Processors should monitor relevant legislation (such as the amendments and implementation of PDPO) closely.
• Hong Kong PI Processors can join and give feedback on the early and pilot data cross-boundary projects between Hong Kong and Guangdong Province when appropriate.