China's Draft Data Security Law Would Penalize Unauthorized Data Export To Overseas Law Enforcement Agencies

On April 26, the second draft of the Data Security Law was submitted to the Standing Committee of the National People's Congress for deliberation through May 28, 2021.¹ Compared to the first draft submitted in July last year,² the second draft would (i) call for improvements with respect to data classification and important data protection systems; and (ii) tighten restrictions on data export to overseas law enforcement agencies by imposing penalties for violations. This alert will focus on the second modification and its implications for multinational companies (MNC) with operations in China. 

In particular, Article 35 of the second draft would provide that "Where a judicial or law enforcement agency outside the People's Republic of China (PRC) requires access to data stored in the PRC, such data may not be provided without the approval of the competent authority of the PRC; if the PRC has concluded or participated in international treaties or agreements that