China’s Data and Privacy Regime for the Civil Aviation Sector is Under Design: An Initial Exploration of Regulatory Blueprint (Part II)

The Smart Civil Aviation Development Leadership Team of Civil Aviation Administration of China (CAAC) released the updated versions of Measures for the Management of Civil Aviation Data (Draft for Comments) and Management Measures for Civil Aviation Data Sharing (Draft for Comments) on 4 June 2024 (hereinafter referred to as Management Measures (Draft for Comments) and Sharing Measures (Draft for Comments)), and solicited public opinions again, after the first solicitation in mid-March 2024. These measures aim to enhance civil aviation data management by standardising processes, ensuring data security, and promoting interconnectivity and data sharing. As a result, the industry can unlock the full potential value of data and improve governance capacity and service levels. This represents significant progress in utilising data elements within China’s civil aviation sector.

This two-part articledelves into the background, key requirements, and potential impacts of these two documents for stakeholders across the civil aviation industry. The goal is to assist both domestic and international civil aviation enterprises in preparing for their data operations and compliance initiatives.

If you would like to subscribe for our newsletters and be notified of our events on China cybersecurity and data protection, please contact James Gong at [email protected].

* Below you will find the second instalment of the series. You can read the first part of this series here.

4. Rules and Requirements for Civil Aviation Data Sharing

I. Types of Sharing

The Management Measures (Draft for Comments) defines two methods of data sharing: industry-level data sharing via sharing platforms and point-to-point data sharing based on bilateral agreements. Industry-level data sharing relies on specialised data sharing and service platforms, which manage the unified shared catalogue and a task list for data collection. This concept originates from the Smart Civil Aviation Construction Roadmap, which proposed the construction of an industry-level cloud platform and establishing a public data service portal covering the entire industry's production, operations, and service support businesses. The goal is to achieve data resource sharing and exchange across entities, networks, and business areas.

The Sharing Measures (Draft for Comments) specifically apply to data sharing activities conducted via various levels of data sharing and service platforms. These measures target the industry-level data sharing method based on sharing platforms outlined in the Management Measures (Draft for Comments).

Notably, the Sharing Measures (Draft for Comments) clearly defines the “sharing type” attribute in the Resources Catalogue, categorising it into three types: Unconditional Sharing, Conditional Sharing, and Non-sharing.

II. Roles and Responsibilities of Data Platform Sharing

The Sharing Measures (Draft for Comments) classify data processing entities into data providers, users, managers, and platforms, aligning with the Management Measures (Draft for Comments). The responsibilities are as follows:

• Data Provider: The provider is responsible for ensuring the completeness, accuracy, timeliness, and availability of the collected data and accept data quality assessments;
• Data User: The user applies for data sharing according to the shared data resources catalogue, strictly adhering to approved application scenarios, and must not expand the usage scope, change the usage purpose, or alter the usage method without authorisation;
• Data Manager: The manager is responsible for compiling the Civil Aviation Shared Data Resources Catalogue, aggregating data, and conducting supervision and inspection.
• Data Platform: The platform is responsible for establishing and enhancing data security management systems, and implementing technical measures such as data security protection, security services, and security monitoring to ensure the operation and data security of the platform.

The specific identity of the data platform, its role in data sharing and exchange, and its responsibilities in cases of violations, remains undefined in theSharing Measures (Draft for Comments) and the Management Measures (Draft for Comments). The two Measures only stipulate that relevant civil aviation enterprises and institutions, according to their duties, should build a cluster of civil aviation data centres composed of the Civil Aviation Big Data Centre and sub-field data centres. The cluster is responsible for constructing and operating industry and sub-field data sharing and service platforms, undertaking the aggregation, sharing, and application development of industry data, and ensuring platform data services and data security.

On this basis, the Information Centre of the CAAC will compile the shared data resource directory specifications, draft management systems and operational standards for the industry data sharing and service platform, and coordinate the formulation of data sharing technical and interface specifications. They will also carry out data aggregation and integration applications. Consequently, the civil aviation industry data sharing and service platform will serve as the overall service portal and hub for industry data sharing, providing cross-unit, cross-field, and cross-regional data sharing and exchange services for the civil aviation industry. It will also facilitate unified data sharing and exchange business interfaces between civil aviation and various departments of the State Council, local governments, and other industries.

In light of its responsibilities, the Big Data Development Division of the Information Centre of the CAAC is responsible for planning, constructing, managing, and efficiently utilising civil aviation big data. It coordinates the development of industry clouds, security systems, and security assurance related to civil aviation big data. Furthermore, it oversees tasks related to the aggregation, integration, governance, sharing, mining, application, and external cooperation services of civil aviation data, contributing to establishing a smart civil aviation system.

III. Sub-catalogue—Formulation and Update Procedures of the Civil Aviation Shared Data Resource Catalogue

As a specialised sub-catalogue of the Resource Catalogue, the Civil Aviation Shared Data Resource Catalogue (hereinafter referred to as the Shared Catalogue) aligns its content with the Resource Catalogue, but with the addition of a “sharing method” column.

The formulation procedures for the resource catalogue are outlined in the Sharing Measures (Draft for Comments) as follows:

1. Demand Proposal: Administrative departments at all levels, enterprises and institutions of civil aviation must compile and propose their data needs and potential shared data resource catalogues, specifying the application scenarios of the data requirements and preliminarily identifying data sources.
2. Coordination: The proposed data demands and resource catalogues will be coordinated by the data management departments of regional civil aviation administrations and subsequently reported to the CAAC.
3. Catalogue Compilation: In collaboration with respective business departments or their authorised agencies, the CAAC's data management departments will compile the shared data resource catalogue and professional domain shared data resource catalogues, adhering to the civil aviation data classification and management requirements and the Resource Catalogue compilation standards.
4. Catalogue Publication: The compiled shared data resource catalogue will be uniformly published through the industry data sharing and service platform. Simultaneously, the civil aviation field-specific data centres will publish shared data resource catalogues for their respective fields.
5. Task List Compilation: The data management departments of regional civil aviation administrations, in conjunction with the same level business management departments, will compile data sharing collection task lists based on the professional domain shared data resource catalogues, specifying the responsibilities.
6. Update Mechanism: Administrative departments at all levels, civil aviation enterprises and institutions should establish an update mechanism for the shared data resource catalogue and timely report updates to the industry data sharing coordination management department.

The Resource Catalogue forms the basis for the Shared Catalogue. The Shared Catalogue, being a sub-catalogue of the Resource Catalogue, is a prerequisite for conducting industry-level data sharing. The primary difference between the two is that the data included in the Shared Catalogue is recognised as shareable.

However, it should be noted that, according to the Sharing Measures (Draft for Comments), various business departments of the CAAC and regional administrations within their jurisdictions have the authority to formulate their own shared catalogues. The Sharing Measures (Draft for Comments) needs to clarify the hierarchical relationship and conflict resolution between the catalogues of different departments and regions.

IV. Methods, Applications, and Termination of Data Platform Sharing

The Sharing Measures (Draft for Comments) proposes an industry-level sharing platform model for civil aviation data. Under this model, data sharing occurs primarily through the data sharing platform, where data users obtain data access permissions. For instances requiring data copying, consent from both the data manager and data provider is mandatory.

In terms of process, data users must submit sharing applications via the data sharing and service platform, specifying the scope and purpose of data usage. Unconditionally shared data is automatically authorised. For conditionally shared data, if the application falls within the sharing scope specified by the shared catalogue, the platform will automatically authorise and notify the relevant business data manager. If it exceeds the sharing scope, the data provider shall review and approve the application before sharing and notify the relevant business data manager.

Finally, data provided by the data provider in the Shared Catalogue shall not be arbitrarily suspended, terminated, or withdrawn from sharing. If sharing needs to be suspended, a ten working days’ notice is required; if it needs to be terminated or revoked, a two-month advance notice is necessary. In case a force majeure interrupts data sharing, the relevant data sharing and service platform shall be promptly notified. This regulation establishes a relatively stringent exit mechanism, imposing higher requirements on data providers.

5. Conclusion and Expectations

Since 2024, several industry regulatory authorities have issued or are actively promoting data security management measures and industry data classification and grading. The rapid advancement of big data technology has heightened the demand for data management and sharing in the civil aviation industry. Against this backdrop, the issuance of the Management Measures (Draft for Comments) and Sharing Measures (Draft for Comments) undoubtedly injects new momentum into the construction of the civil aviation big data development framework.

As a pioneer in data sharing, the civil aviation has aligned itself with current trends by issuing these measures based on top-level policies and guidance. However, we believe that while the drafts provide the basic requirements and principles for civil aviation data management and sharing at a high level, some implementation challenges remain. Clarification in the final versions, especially concerning the formulation and update requirements of the data resource catalogues, is essential.

Furthermore, given the role of these drafts in shaping data management policies for the construction of a smart civil aviation system, we anticipate more regulations and detailed rules. Measures such as the Measures for the Management of Civil Aviation Data Security and the Civil Aviation Data Classification and Grading Standards will likely follow. Therefore, we recommend that enterprises closely monitor relevant regulations and carry out internal data classification and grading in a timely manner to ensure compliance and data security.