浏览中国的数据迷宫：法规如何影响美国公司

VIEWPOINTT h e A m e r i c a n C h a m b e r o f C o m m e rc e i n S h a n g h a i - V i e w p o i n t M a y 2 0 1 92019www.amcham-shanghai.orgNavigating China's Data Maze: How Regulations Affect U.S. Companieswww.amcham-shanghai.org2ABOUT VIEWPOINTSAmCham Shanghai’s Viewpoint series provide insights and recommendations from AmCham Shanghai member companies on important policy issues impacting foreign companies in China. These reports are based on extensive interviews and research by the AmCham Shanghai Government Relations team. The reports are used in AmCham Shanghai’s advocacy efforts with the Chinese and U.S. governments. ABOUT USThe American Chamber of Commerce in Shanghai (AmCham Shanghai), known as the “Voice of American Business” in China, is one of the largest American Chambers in the Asia Pacific region. Founded in 1915, AmCham Shanghai was the third American Chamber established outside the United States. As a non-profit, non-partisan business organization, AmCham Shanghai is committed to the principles of free trade, open markets, private enterprise, and the unrestricted flow of information. AmCham Shanghai’s mission is to enable the success of our members and strengthen U.S.-China commercial ties through our role as a not-for-profit service provider of high-quality business resources and support, policy advocacy, and relationship-building opportunities. Find us online at www.amcham-shanghai.org Authors: Daniel Rechtschaffen, Jessie Niu Design: Snap Printing AmCham Shanghai would like to thank all interviewees for their contributions to this report. May 2019VIEWPOINT3Executive SummaryIn February and March 2019 we interviewed cybersecurity, data, and IT professionals at 17 foreign companies about how they manage the data they collect, how well they understand China’s data regime, and how the country’s data regulations affect their business operations in China. These companies expressed that while they recognized the importance of stronger data governance and protection of personal information, they were concerned by the onerous localization requirements, ambiguous language, vagueness in legal requirements, inconsistent implementation, lack of input in drafting, and overly expensive security assessments of China’s Cybersecurity Law (CSL). Key IssuesOnerous Localization Requirements. Data localization requirements represented by far the biggest hurdle for most of our respondent companies. Companies already in compliance but continuing with cross-border transfers must also expend significant capital to anonymize the data before sending it abroad. Companies that purchase data from external sources must also spend time and money to ensure that it complies with the CSL.Ambiguous Language in Law. Companies are still unsure of what counts as “important data” and which companies will be classified as “Critical Information Infrastructure Operators.” Wording in the cross-border transfer rules is unclear and there are also industry-spe