China further relaxed data export control, in the Beijing Free Trade Zone

China has further relaxed restrictions on data exports within the Beijing Free Trade Zone(FTZ). “ShuJuHeGui, a Chinese self-media outlet, summarized the new rule very well:

On August 30, three departments, including the Beijing Cyberspace Administration, released the "Negative List Management Measures for Data Exports in the Free Trade Zone" and the "Negative List (2024 Edition)." They also released the "Beijing Cross-Border Data Flow Facilitation Service Guide" and launched the Beijing Cross-Border Data Flow Facilitation Service Platform.

The "Regulations on Promoting and Regulating Data Cross-Border Flow"(“Regulations”) issued by China in March this year authorize the free trade zones to establish their own negative lists for data exports within their regions, allowing data outside the negative list to flow freely. Data exports not listed in the negative list are exempt from pre-approval procedures for companies within the free trade zone.

Article 6 of the Regulations: Under the national data classification and grading protection system framework, free trade zones can formulate their own lists of data that require safety assessment for export, standard contracts for personal information export, and personal information protection certification (referred to as the negative list). After approval by the provincial-level cybersecurity and informatization committee, the list should be filed with national cybersecurity and data management departments.

Data processors within the free trade zone can export data not listed in the negative list without declaring a data export safety assessment, entering into a standard contract for personal information export, or obtaining personal information protection certification.

In May this year, Tianjin was the first to issue such a negative list for data exports, but it faced considerable criticism. The main criticisms were that the thresholds for personal information export were not relaxed compared to the Regulations, and it explicitly listed many “important data” types.

In contrast, Beijing’s negative list is more pro-business with several notable breakthroughs. It features four major highlights:

1. Provides a quantitative identification standard for important data across all industries.

2. Defines an essential data catalogue for specific sectors within the jurisdiction of Beijing FTZ.

3. Expands the threshold for exempting the export of personal information from pre-approval in pharmaceuticals, retail, civil aviation, and artificial intelligence, thereby maximizing the policy value of the "negative list."

4. Clarifies the filing process for data exports from within the negative list.

Quantitative Identification of Important Data

The unclear scope of important data has been a recurring issue. Recently, during the first dialogue on cross-border data flow between China and the EU, the EU focused on this issue, requesting further clarification on the boundaries and scope of "important data."

The "Unified Identification Reference Rules for Important Data" in the appendix of the "Administrative Measures for Data Exports in the Beijing Free Trade Zone (Trial)" can provide some quantitative identification references for enterprises in other regions. In summary, data is considered important if it reaches the following thresholds:

1. General personal information: over 10 million people.

2. Sensitive personal information: over 1 million people.

3. Specially sensitive personal information (such as financial accounts, medical information) or sensitive personal information controlled by CIIOs: over 100,000 people.

Important Data Catalog for Beijing FTZ

Article 21 of China’s Data Security Law authorizes local governments to define important data catalogues. The "Data Classification and Grading Reference Rules for China (Beijing) Free Trade Zone" lists 13 categories and 41 sub-sectors for important data identification.

The "Negative List for Data Exports (2024 Edition)" for the China (Beijing) Free Trade Zone specifies important data in five fields: automotive, pharmaceuticals, retail, civil aviation, and artificial intelligence. Data in these catalogues requires a security assessment for export.

Further Exemptions for Exports of Personal Information

The negative list further clarifies relaxed thresholds for specific scenarios in healthcare, civil aviation, retail and modern services, and AI.

For AI model training, algorithm development, and product testing involving sensitive personal information such as audio, images, and text (excluding video), enterprises under Beijing FTZ will benefit from more relaxed data export requirements.

For sensitive personal information, including:

1. Audio data, such as audio content data and and label data (province, ethnicity, gender).

2. Image data, including image content data and image label data as per GB/T 35273 2020 (Chinese national standard on personal information protection titled "Information Security Technology - Personal Information Security Specification”).

Change to the annual thresholds for the number of persons involved:

Sensitive personal information text data, including text content data and text label data.

Change to the annual thresholds for the number of persons:

Nevertheless, audio, image, and text data should still be processed according to the "Basic Requirements for the Safety of Generative Artificial Intelligence Services."

Due to the U.S. export control on high end AI chips, companies within China are unable to obtain sufficient GPUs to train their own LLMs. However, a workaround is to transfer pre-training data from within China to overseas, use overseas computing power for training, and then bring the model parameters back to China. However, this approach is obviously constrained by China's current strict and unclear data export regulations.

In the absence of rapid changes in national-level laws, introducing more lenient data export policies at the level of free trade zones would undoubtedly attract Chinese AI companies that need to transfer pre-training data abroad to conduct their data processing activities in these regions. In the long run, more data will be concentrated in these free trade zones, driving the development of related industries.

Negative List Export Process

It is important to note that data outside the negative list for related industries and scenarios can still not be exported without following the filing process to confirm that it does not fall within the negative list scope.