A Complete Guideline on China’s New Cybersecurity Law

China’s new cybersecurity law came into effect from 1st of June 2017. The new law which was rubber-stamped by the country’s Parliament last year is part of wide-ranging efforts by Beijing to manage the internet within China’s borders. The law focuses on protecting personal information and individual privacy, and standardizes the collection and usage of personal information. As such, companies will now be required to introduce data protection measures, and sensitive data for instance, information on Chinese citizens or relating to national security must be stored on domestic servers.

The law has raised concerns among some foreign companies over greater data controls as well as increased risks of intellectual property theft. Vague terminology and absent official guidance on complying with the law have created uncertainty. While Chinese authority is saying the new cyber law is aimed preventing serious cyber attack threats and security concerns, many are arguing that it will make the operations of the foreign companies in China less secure and more expensive. Many of the accompanying rules that ought to clarify what foreign companies can and can’t do under the law remain vague, leaving businesses of all types in limbo.

Network Operations Security-
The Network Security Law introduces rules and requirements that will significantly impact individuals and entities utilizing the internet in the PRC. Critical network equipment and network security products will need to comply with mandatory national standards, and will be subject to security certification or inspection.

  • Appointment of dedicated cybersecurity personnel
  • Retention of network logs for at least six months
  • Reporting risks on network services and products to both users and authorities
  • Formulating contingency plans for network security incidents, and reporting such incidents to the authorities
  • Providing assistance and cooperation to public security bodies and state security bodies to safeguard national security and investigate crimes (the extent of which is not yet clear, especially in terms of the disclosure that will be required of private businesses).

CSL does require CII operators comply with the following, in addition to the requirements for all network operators:

Annual security assessment-
According to the new law, CII operators need to review the security of their networks and assess potential risk annually. The entire process can be conducted by the companies themselves or they can engage a third-party service providers.

Data localization-
The new law stipulates that the personal data of Chinese citizens should be kept within the territory of China. If the key information infrastructure operators who collect or process such data would like to transfer the data outside the country, they will need to undergo a security assessment and get approval from the National Cyberspace Administration and State Council. Unauthorized collection, disclosure and receipt of a citizen’s personal information now constitutes a criminal offense.

Network security requirements-
Businesses are obliged to employ network security safeguards, such as preparing and implementing contingency plans for mitigating network security incidents, reporting possible security risks, and assisting Chinese authorities in investigating and combating cyber crimes.

Online protection of minors-
The Chinese government aims to strengthen the protection of minors in the cyberspace by obliging entities that collect personal data from minors to (1) place a warning label on their websites; (2) obtain a consent for data collection from the minors or their guardians; and (3) set rules for minors’ personal data processing

Many foreign companies are becoming increasingly skeptical of China’s promises of economic reform. But it has been noted that most of the foreign companies based in China are already accustomed to tight internet and content controls. Many have existing internal policies for information technology and data management and privacy in China. So there is no major worry and apprehension for the foreign companies as long as they are maintaining the law.

Share with friends:

Chinese Business Lawyer Addressing Issues on Joint Venture in China

Doing a joint venture in China is not easy given the business conditions. Some China business lawyers take it up as a challenge while others leave the business midway. Making a China joint venture work is a tall task which if you can do once, you can get over anything. However, it fails many of the times as well.

What Differentiates a Successful Joint Venture from an Unsuccessful One?

The most important thing which makes a huge difference is recognizing and avoiding a blind spot. If the venture lacks cross-process discipline in planning and execution, it will fail. Even following the best practices can fail sometimes. The ratio between successful and unsuccessful ratios is 40-60% as disclosed by experienced Chinese business lawyers. To be able to succeed in a joint venture or JV the rule of the thumb is to have a sound plan and proper implementation of that plan with strong internal alignment, meticulous selection of partners, balanced and equitable organization and anticipation of contingencies combined with strong governance and decision making process.

The biggest reason behind the failure of a JV even after following best practices is that the foreign party often rush to complete the business. Even experienced managers commit this mistake of rushing with the process. In most cases the process does not involve discipline in end-to-end solution as well as between the stages. The 5 stages of development include:

  • Creating the business case and aligning it internally
  • Developing the business model
  • Negotiating terms
  • Operating the model and launch of business
  • Supervising operations

Moreover, majority of the joint ventures suffer from inadequate risk management planning. This is a loophole which creates hindrances in successful completion of the project and its ongoing operations. Different companies are taking different approaches to deal with the problem.

The rush to complete the process is due to getting the deal done quickly. There is actually no remedy to this, but still the companies should try to maintain a balance between demands and supply. An effective joint agreement should be drawn without any compromise. They must align their efforts with impact and value for the business.

This is agreed upon by lawyers. Majority of the parties face problems regarding the time and planning and these are the reasons why there is so much difficulty in reaching a fulfilled joint venture. To be precise, according to lawyers from Chinese law firms the joint ventures which took long to set up exists more than the ones which took less time to be established.

What is the Reason behind Such a Result

Joint ventures are extremely complex. The first question that confuses people is who is going to be in charge of hiring? Is it the Chinese company or the foreign partner? The answer is Chinese company because obviously they know the market better than the foreigner. But what stops the Chinese company from practicing nepotism and where does the profit go? Now that you have realized the importance of having a say in hiring, you will still not want to hire, but do you want veto rights? Do you really have the right to decline and are there any restrictions on hiring the number of employees? Can you fire employees? Well, certainly your position will be different on seniors than juniors.

There are several such issues and limiting control over business. These are just a couple of issues that arise every time in doing business in the form of joint ventures. You have to think of all these before you can really establish a deal with the Chinese parties. If you are capable of addressing majority of these issues at some point then you will have fewer arguments, disputes after the establishment of the JV. So, from next time onwards do not be impatient during the delay of drafting a JV deal between Chinese company and foreign company. The more time it takes, the less are the chances of the business falling apart.

Share with friends: