During the Forum of European Researchers in China Dr Rogier Creemers, an expert in Chinese law, presented an analysis of China's data export regulations. The focus of the presentation was on the particular case where the regulation pertains to scientific data; researchers involved in data-driven projects can benefit significantly from this examination of the intricate legal framework that governs data export in China, essential for international research endeavors.
Fundamentals of Chinese Data Protection Law
China's data protection law revolves around two primary legislative areas: personal information protection and data security law. The former corresponds with privacy laws found in Europe, while the latter is geared towards safeguarding national interests and public welfare. This dual legal structure is fundamental for comprehending China's regulatory landscape, with direct implications for researchers working with data within the country.
Motivations for Stringent Data Regulations
During the presentation, Creemers elucidated the dual motivations behind these regulations: the imperative of security and the preservation of economic interests. Security concerns, particularly in response to global events such as the Snowden revelations, have resulted in tighter control over data in China. Simultaneously, the view of data as a strategic asset has significantly influenced China's regulatory approach to data export.
Thresholds for Large Data Handlers and Security Review Significance
A crucial aspect for research institutions to grasp is the specific criteria categorizing them as large data handlers. These criteria encompass entities that handle personal data of over 1 million individuals or export sensitive data of more than 10,000 people. Creemers provided an illustrative example to emphasize this point: a collaborative research effort between a Chinese hospital and a European institution, like a university hospital in Amsterdam. In cases where the Chinese hospital processes personal information of over 1 million individuals, it subjects the entire institution to rigorous data export reviews, irrespective of the scale of the particular research project. This underscores that the focus of the regulations extends to the entire institution's data handling capacity, rather than solely the dataset in question.
Legal Pathways for Data Export and Pertinent Exemptions
Creemers detailed three legal avenues for exporting data, each with its distinct provisions. The 'standard contract' pathway is pertinent for exporting personal information within specified thresholds. Furthermore, notable exemptions exist, particularly for personal data originating from outside China, which can be re-exported without triggering security review thresholds.
Critical Considerations in Data Exchange Between Institutions
The presentation emphasized the importance of vigilance in cases of data exchange between institutions. Specifically, if your Chinese host institution manages the personal information of over 1 million individuals and collaborates with a European institution, such as a university hospital in Amsterdam, it becomes imperative to ensure that your host institution does not inadvertently cross the export threshold. This requirement applies regardless of the scale of the research project.
Security Review Thresholds and Implications
Another pivotal point highlighted by Creemers pertains to security review thresholds. A security review becomes necessary if you have exported ordinary personal information of over 100,000 people or sensitive information of more than 10,000 individuals within the past year. Given that healthcare data often contains sensitive information, the scale of medical or clinical trials in the field of medicine can easily reach these numbers. Researchers and institutions engaged in healthcare-related projects need to be particularly attentive to these thresholds.