China's cybersecurity regulator on Thursday released a draft guideline on cross-border data transfers, which will prevent the flow of personal information overseas if it risks undermining national security and public interests, in the latest move to safeguard personal data security and the country's national cyberspace sovereignty.
Personal information, including ID, address and phone number collected in China by network operators should be assessed before being sent overseas, according to the draft rule released by the Cyberspace Administration of China (CAC) on Thursday.
Information which risks undermining national security, public interests or the security of personal information cannot be effectively guaranteed should be prevented from being sent overseas, the draft rule said.
Network operators need to report to the provincial-level cyberspace administrative department and apply for a security assessment before providing personal information collected in China to overseas receivers, it said.
Security assessment should be applied separately if the personal information will be provided to different receivers.
The purpose to draft the guideline is to protect personal information security, safeguard the country's national cyberspace sovereignty, national security, public interest as well as the legitimate interest of citizens, the CAC said in a statement on its website.
The assessment will focus on whether the data being sent overseas is legitimate, whether the data transfer protects the legal rights of the person who possesses the information and whether the network operators or overseas receivers have any history of internet security incidents, the draft said.
Internet operators need to set up a file on the cross-border data transfer and keep it for at least 5 years, including identify of overseas receivers and the sensitivity of those personal information. They need to report annually to provincial-level cyberspace departments.
The draft covers Chinese network operators and foreign entities that collect online personal information in China for business purpose.
The draft is soliciting public opinions until July 13.
