The Cyberspace Administration of China (CAC) and the Hong Kong SAR Government’s Innovation, Technology and Industry Bureau (ITIB) signed a memorandum of understanding (MoU) on 29 June 20231 agreeing to establish rules for data transfer within the Great Bay Area (GBA) under the data security framework of the People’s Republic of China (PRC) (Proposed GBA Mechanism).
This Proposed GBA Mechanism is considered to be China's new attempt to explore the establishment of a more streamlined mechanism for regional cross-border data flows, in response to the ambitious plans of the PRC to strengthen its data economy that include a novel data property rights framework, a revenue distribution mechanism for the exploitation of data, and fostering data circulation and trading systems.2
Background
In recent years, the PRC has introduced new laws and regulations that impose strict controls on the cross-border transfer of data (be it general business data or personal information). The MoU comes hot-on-the-heels of the implementation of the Chinese Standard Contract, which took effect on 1 June 2023 under the PRC data laws (Cybersecurity Law, Data Security Law and Personal Information Protection Law (PIPL) (see our previous Legal Update on China’s Standard Contracts for Exporting Personal Information Guidelines Have Been Released!)
More recently, on 25 June 2023, the local Beijing CAC office published a notice on the first company in Beijing (and for that matter, the PRC) to have satisfied the Standard Contract filing process for cross-border data transfers – marking the first time since enactment of the PIPL in November 2021 that personal data was transferred from Beijing to Hong Kong in full compliance with the cross-border transfer restrictions.
Observations
While the CAC has not disclosed the specific content of the MoU, its raison d'etre appears to be the enhancement of data flows between the PRC and Hong Kong. The ITIB, in a press release, has highlighted the significance of the Proposed GBA Mechanism:
- Facilitating data flow: the Proposed GBA Mechanism will promote the integrated and high-quality development of the GBA, lower compliance costs of companies, drive development of the digital economy, and help Hong Kong cement its status as a global data hub.
- Providing a convenient channel: the Proposed GBA Mechanism will facilitate data transfers (especially for sensitive personal information and important data) from the PRC to Hong Kong in a more convenient and less burdensome manner.
Given that details of the proposed arrangement have yet to be disclosed, there are still many questions that remain unanswered. For example, how will the proposed arrangements take place in light of the vastly different data protection regimes in Hong Kong and the PRC?
Will data transferred pursuant to a GBA arrangement be subject to any data transfer restrictions, given there are no enforceable restrictions in Hong Kong for the cross-border transfer of personal data?
How will a PRC transferor ensure that data in Hong Kong is afforded the same protections as data in the PRC, when penalties for failure to comply with the Personal Data (Privacy) Ordinance in Hong Kong are nowhere close in quantum to those under the PIPL (e.g., penalties of up to RMB 50 million or 5% of the data controller’s annual revenue)?
Will data transfer impact assessment (DTIAs) and/or Data Processing Agreements (DPAs) be required? Will they have to be in a prescribed format within the GBA without the need for all of the regulatory hoops of the PIPL and the other data laws?
Nevertheless, at this juncture, what is clear is that the MoU seeks to create a framework for the freer circulation of data within the GBA.
What’s Next？
Supporting measures for the MoU are reportedly being drafted to provide more guidance on PRC-HK cross-border data transfers.
The new arrangement is anticipated to help reduce the compliance costs of companies, particularly Hong Kong companies with a PRC presence.
More significantly, this MoU may potentially attract more companies with an eye to the PRC to Hong Kong, or back to Hong Kong, if the GBA arrangement positions Hong Kong favourably compared to other jurisdictions.
Companies should keep an eye out for developments, assess their China-related data flows, and consider potential cost-savings that may arise from PRC-HK cross-border data transfers pursuant to the framework envisaged by the MoU.
1 Original texts can be found here: http://www.cac.gov.cn/2023-06/30/c_1689687618127403.htm
