China Standard Contract for Exporting Personal Information

On June 30, the Cyberspace Administration of China (“CAC”) released the long-expected draft Regulations on Standard Contract for Personal Information Export (“Draft”). It incorporates a template for the Standard Contract for Personal Information Export (“Standard Contract”) and is available for public consultation until July 29, 2022.
The Draft is supplemental to Article 38 of the Personal Information Protection Law (the “PIPL”) which requires that a personal information processor must meet one of three conditions before transferring any personal information outside of China. The three conditions are: (i) pass the security assessment organized by the CAC; (ii) obtain the personal information protection certification from a qualified agency in accordance with the regulations of the CAC; and (iii) sign the standard contract formulated by the CAC with the overseas recipient. It is notable that the Specification for Security Certification of Personal Information Cross-Border Processing Activities (“Certification Specification”) issued on June 24 by China’s national standard authority sets out the procedures and requirements for obtaining a certification under item (ii) above, and the Draft provides the Standard Contract under item (iii) above. Although there are still some issues pending, the issuance of the Standard Contract and the Certification Specification signals that the framework for the management of cross-border transfers of personal information is basically in place.
The Draft clarifies how companies can transfer personal information out of China by signing a Standard Contract with an overseas recipient and provides a Standard Contract template. Below are several key points of the Draft for your attention.
I、Application Scope
Only those companies that meet all the following criteria are eligible to use the Standard Contract:
the personal information processor is NOT a critical information infrastructure operator (“CIIO”);
the processing volume of the personal information is less than one million people;
the company has transferred out of China the personal information of less than 100,000 people since January 1st of the previous year; and
the company has transferred out of China the sensitive personal information of less than 10,000 people since January 1st of the previous year.
This echoes the proposal under the draft Data Export Security Assessment Measures which required companies that triggered any of the above thresholds to go through a government assessment procedure.
II、Alterability
The Draft stipulates the material aspects that must be covered in the standard contract and a Standard Contract template was attached. The Draft further provides that any contracts related to the export of personal information that are signed between the personal information processor and the overseas recipient must not conflict with the Standard Contract. However, the Standard Contract leaves space in appendix II for personal information processors to supplement additional clauses agreed to by the overseas recipients regarding the cross-border transfer, provided that appendix II is not contradictory to the main body of the Standard Contract.
Unlike the SCC under the General Data Protection Regulation which provides four modules (i.e., controller to controller, controller to processor, processor to controller and processor to processor), the Standard Contract has only one version. It remains uncertain whether an entrusted party (i.e., a processor under the GDPR) should also sign a Standard Contract with the overseas recipient if it transfers personal information out of China. If, in this case, the Standard Contract needs to be signed, which party signs the contract: the entrusted party or the personal information processor who instructed the entrusted party to transfer the data outside of China?
III、PIPIA
The Draft requires personal information processors to conduct a Personal Information Protection Impact Assessment (“PIPIA”) before they transfer personal information out of China and specifies the contents that the PIPIA needs to focus on. In addition to the general requirements for a PIPIA already provided under Articles 55 and Article 56 of the PIPL, the Draft also requires an evaluation of the personal information protection policy and the legislation of the destination jurisdiction, and the impact of these on the enforceability of the Standard Contract by the overseas recipient.
IV、Obligations of the Transferer and the Overseas Recipient
The Draft includes several obligations and warranties on both the transferor and the overseas recipient. The transferor is generally required to ensure that the amount of exported personal information is the minimum necessary, monitor the performance of the overseas recipient, and ensure the exercise of the individual rights of the personal information subjects. The overseas recipient will be governed by Chinese laws relating to personal information protection, including requirements under the PIPL in relation to processing activities such as cooperating with government inquires, and responding to personal information inquiries and breach notifications.
V、Filing Requirements
Personal information processors must file an executed Standard Contract along with a PIPIA report with the local provincial-level CAC within 10 working days of the Standard Contract taking effect. This filing requirement was first introduced by this Draft.
Impact and Observation
This Draft provides a clearer picture on how to handle the cross-border transfer of personal information and is a sign that companies should start mapping their cross-border data flow as soon as possible and prepare for actions required for such transfers.
If the Draft is eventually promulgated as it is, companies (especially foreign companies and MNCs whose business involves the transfer of personal data out of China and falls into the application scope of the Draft), need to evaluate the compliance risks for such transfers, carry out a PIPIA, and sign a Standard Contract with the overseas recipients. They should file the executed Standard Contract and the PIPIA report with the provincial level CAC, or they can choose certification to satisfy the conditions for cross-border transfers required under the PIPL.
For companies that do not fall within the scope of this Draft, such as CIIOs or companies processing the personal information of more than one million people or have transferred the personal information of more than 100,000 people (or the sensitive personal information of 10,000 people) out of China, they may need to comply with stricter cross-border data transfer requirements (e.g., government security assessments) in accordance with the PIPL and other relevant data laws.