《数据出境安全评估办法》英文版

编者按：

7月7日，中央网信办正式发布《数据出境安全评估办法》【数据出境安全评估办法】。

昨天本公号发表了第一篇解读文章：【《数据出境安全评估办法》正式发布，倒计时开始！】今天和大家分享的是《数据出境安全评估办法》的英文翻译。翻译人为世辉律师事务所的王新锐律师团队。

本公众号关于基于业务目的数据跨境流动的系列文章，见正文后的附录。

Measures for Security Assessment for Outbound Data Transfer

Presented by Shihui Partners

Translated by Jing Lu, Raymond Wang and Jeanette Wang

Reviewed by Ian Read

Article 1

In order to regulate outbound data transfer, protect personal information rights and interests, safeguard national security and social and public interests, and promote the security and free flow of outbound data, the Measures for Security Assessment for Outbound Data Transfer (the “Measures”) are enacted in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China and other laws and administrative regulations of the People’s Republic of China (together, the “Regulations”).

Article 2

The Measures apply to the security assessment of Important Data and personal information collected and generated during operation within the territory of the People’s Republic of China and transferred abroad by a data handler. Where laws and administrative regulations provide otherwise, such provisions shall prevail.

Article 3

Security assessment for outbound data transfer shall adhere to the combination of a prior assessment and on-going supervision, as well as the combination of risk self-assessment and security assessment, so as to prevent security risks to outbound data transfer and ensure the orderly free-flow of data in accordance with the law.

Article 4

Where a data handler transfers data abroad under any of the following circumstances, it shall, through the local Cyberspace Administration at the provincial level, apply to the State Cyberspace Administration for security assessment for the outbound data transfer:

(1)a data handler who transfers Important Data abroad;

(2)a critical information infrastructure operator, or a data handler processing the personal information of more than 1 million individuals, who, in either case, transfers personal information abroad;

(3)a data handler who has, since January 1 of the previous year cumulatively transferred abroad the personal information of more than 100,000 individuals, or the sensitive personal information of more than 10,000 individuals, or

(4)other circumstances where the security assessment for the outbound data transfer is required by the State Cyberspace Administration.

Article 5

Prior to applying for the security assessment for the outbound data transfer, a data handler shall, in advance, conduct a self-assessment on the risks of the outbound data transfer, and the self-assessment shall focus on the following matters:

(1)the legality, legitimacy and necessity of the purpose, scope and methods of the outbound data transfer, and the processing of the data by the foreign recipient;

(2)the scale, scope, type and sensitivity of the outbound data transfer, and the risks to national security, the public interest or to the legitimate rights and interests of individuals or organizations, caused by the outbound data transfer;

(3)the duties and obligations which the foreign recipient commits to perform, and whether the foreign recipient’s organizational and technical measures and capabilities in terms of performing the duties and obligations can guarantee the security of the outbound data transfer;

(4)the risks of the data being tampered with, destroyed, divulged, lost, transferred, illegally obtained or illegally used during and after the outbound data transfer, and whether there is a smooth channel for safeguarding personal information rights and interests;

(5)whether the responsibilities and obligations for data security protection are fully agreed in relevant contracts for the outbound data transfer, or other legally binding documents to be concluded with the foreign recipient (hereinafter collectively referred to as the “Legal Documents”); and

(6)other matters that may affect the security of the outbound data transfer.

Article 6

To apply for security assessment for the outbound data transfer, the following materials shall be submitted:

(1)an application letter;

(2)a self-assessment report on the risks of the outbound data transfer;

(3)the Legal Documents to be concluded between the data handler and the foreign recipient; and

(4)other materials necessary for security assessment.

Article 7

The Cyberspace Administration at the provincial level shall conduct a completeness check of application materials within 5 working days upon receipt thereof. Where the application materials are complete, they shall be submitted to the State Cyberspace Administration; where the application materials are incomplete, they shall be returned to the data handler and the data handler shall be informed (on a one-time basis) of all supplementary materials still required.

The State Cyberspace Administration shall, within 7 working days after receipt of the application materials, determine whether to accept the application and will inform the data handler of the same in writing.

Article 8

The security assessment for outbound data transfer shall focus on the evaluation of the possible risks to national security, public interests, or the legitimate rights and interests of individuals or organizations arising from the activity of outbound data transfer, including the following major points:

(1)the legality, legitimacy and necessity of the purpose, scope and method of the outbound data transfer;

(2)the impact of the data security protection policies and regulations as well as network security environment of the country or region where the foreign recipient is located, and the effect thereof on the security of the data to be transferred abroad; whether the data protection level of the foreign recipient meets the requirements under the laws, regulations and mandatory national standards of the People’s Republic of China;

(3)the scale, scope, types and sensitivity of the data to be transferred abroad, and risks that the data may be tampered with, destroyed, leaked, lost, transferred, illegally obtained or illegally used before or after the outbound data transfer;

(4)whether data security and personal information rights and interests can be fully and effectively guaranteed;

(5)whether the responsibilities and obligations for data security protection are fully agreed in the Legal Documents to be concluded by the data handler and the foreign recipient;

(6)compliance with the laws, regulations and agency rules of the People’s Republic of China; and

(7)other matters that the State Cyberspace Administration considers necessary to assess.

Article 9

A data handler shall expressly agree on the responsibilities and obligations for data security protection in the Legal Documents concluded with the foreign recipient, which shall, at least, include the following matters:

(1)the purpose, method and scope of the data to be transferred abroad, and the purpose and method for processing the data by the foreign recipient;

(2)the location and duration for the storage of the data located abroad, as well as how to process the data located abroad upon the expiry of the storage period, achievement of the agreed purpose, or termination of the Legal Documents;

(3)restrictions on the foreign recipient’s re-transfer of the data located abroad to another organization or individual;

(4)security measures which should be taken in case of a material change to the actual control or business scope of the foreign recipient, or in case of a change to the data security protection policies or regulations, or network security environment of the country or region where the foreign recipient is located, or in case that the data security cannot be guaranteed as a result of any other force majeure event;

(5)remedial measures, liability for breach of contract and dispute resolution mechanism in the event of a violation of data security protection obligations as agreed in the Legal Documents; and

(6)requirements on properly responding to a data security incident, as well as channels and method to safeguard individuals’ personal information rights, when the data located abroad is tampered with, destroyed, leaked, lost, transferred, illegally obtained or illegally used.

Article 10

After accepting an application, the State Cyberspace Administration shall organize relevant departments of the State Council, Cyberspace Administrations at the provincial level and specialized agencies to conduct a security assessment based upon application materials submitted by a data handler.

Article 11

Where the application materials submitted by a data handler are found to be non-compliant during the security assessment process, the State Cyberspace Administration may require the data handler to supplement or correct the non-compliant materials. If the data handler fails to supplement or correct the materials without justified reasons, the State Cyberspace Administration may terminate the security assessment.

A data handler shall be responsible for the authenticity of the materials submitted. If a data handler purposely submits false materials, it shall be deemed as a failure of the assessment, and the data handler shall be held liable according to the Regulations.

Article 12

The State Cyberspace Administration shall, within 45 working days from the date of issuing a written notice of acceptance to the data handler, complete the security assessment for the outbound data transfer; if the situation is complicated or supplementary or corrected materials are needed, the assessment may be extended, and the data handler shall be notified of the expected extension period.

The data handler shall be informed of the assessment results in writing.

Article 13

Where a data handler disagrees with the assessment results, it may, within 15 working days after receipt of the assessment results, apply to the State Cyberspace Administration for re-assessment, and the re-assessment results shall be final.

Article 14

The results of the security assessment for the outbound data transfer are valid for 2 years, commencing from the date of issuance of the assessment results. A data handler shall re-apply for assessment if any of the following circumstances occurs during the period of validity:

(1)the purpose, method, scope and type of data to be transferred abroad, or the purpose and method of data processing by a foreign recipient have changed, affecting the security of the data to be transferred abroad, or extending the period of storage of personal information and Important Data located abroad;

(2)the security of the data to be transferred abroad is affected due to changes in the data security protection policies or regulations, or the network security environment of the country or region where the foreign recipient is located, or any other force majeure event has occurred, or a change to the actual control of the data handler or the foreign recipient has occurred, or any Legal Document between the data handler and the foreign recipient has been amended or ceased to be valid, etc.; and

(3)any other circumstance affecting the security of the data to be transferred abroad.

If it is necessary to continue the outbound data transfer after the expiration of the valid period, the data handler shall re-apply for assessment 60 working days before the expiration of the valid period.

Article 15

The relevant institutions and personnel participating in security assessment work shall keep information confidential in accordance with the law, including matters such as state secrets, personal privacy, personal information, trade secrets, confidential business information and other data they come to know in fulfilling their duties, and shall not divulge or illegally provide the same to others, or illegally use such data.

Article 16

Any organization or individual may report the case to the Cyberspace Administration at the provincial level or above if it finds that a data handler engaged in outbound data transfer in violation of the Measures.

Article 17

As for an outbound data transfer that has passed the security assessment, if the State Cyberspace Administration finds out that the actual data processing activities no longer meet the security management requirements in terms of the outbound data transfer, the State Cyberspace Administration shall notify the data handler in writing to terminate the outbound data transfer. If the data handler needs to continue the outbound data transfer, it shall make rectification as required, and re-apply for assessment after completing the rectification.

Article 18

Any violation of the Measures shall be punished in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, and other laws and regulations; if any act is held to constitute a criminal act, criminal liabilities shall be investigated in accordance with the laws and regulations of the People’s Republic of China.

Article 19

For the purpose of the Measures, the term “Important Data” refers to the data that, once tampered with, destroyed, leaked or illegally obtained or used, may endanger national security, economic operation, social stability, public health and security, etc.

Article 20

The Measures shall come into force on September 1, 2022. For the data transferred abroad prior to the effectiveness of the Measures, if it is found that such transfer is not in compliance with the Measures, rectification shall be completed within 6 months upon the effective date of the Measures.

本公号曾发表过的关于业务场景中数据跨境流动的文章如下：

数据保护官（DPO）社群主要成员是个人信息保护和数据安全一线工作者。他们主要来自于国内头部的互联网公司、安全公司、律所、会计师事务所、高校、研究机构等。在从事本职工作的同时，DPO社群成员还放眼全球思考数据安全和隐私保护的最新动态、进展、趋势。2018年5月，DPO社群举行了第一次线下沙龙。沙龙每月一期，集中讨论不同的议题。目前DPO社群已超过400人。关于DPO社群和沙龙更多的情况如下：

域外数据安全和个人信息保护领域的权威文件，DPO社群的全文翻译：

DPO线下沙龙的实录见：

关于美国出口管制制度，本公号发表过系列文章：

供应链安全文章：

传染病疫情防控与个人信息保护系列文章

关于数据与竞争政策的翻译和分析：

健康医疗大数据系列文章：

网联汽车数据和自动驾驶的系列文章：

网络空间的国际法适用问题系列文章：

关于保护网络和信息系统安全的相关文章包括：

《网络数据安全管理条例（征求意见稿）》系列文章：

《数据安全法》的相关文章包括：

赴美上市的网络、数据安全方面的两国监管乃至冲突方：

个性化广告或行为定向广告（behavioral targeting advertising）系列的文章：

关于我国的《个人信息保护法》的相关文章包括：

围绕着美国方面的个人信息保护立法，本公号发表了以下文章：

关于数据要素治理的相关文章包括：

人脸识别系列文章：

内容安全方面的文章如下：

关于中美与国家安全相关的审查机制的文章：

地缘政治与跨国科技公司运营之间的互动影响：

关于数据的安全、个人信息保护、不正当竞争等方面的重大案例：

关于欧盟技术主权相关举措的翻译和分析：

围绕着TIKTOK和WECHAT的总统令，本公号发表了以下文章：

关于个人数据和域外国家安全审查之间的关系，见：

关于健康医疗数据方面的文章有：

关于人工智能安全和监管，本公号发布过以下文章：

关于数据执法跨境调取的相关文章：

第29条工作组/EDPB关于GDPR的指导意见的翻译：

数字贸易专题系列：