China has finalized a broad new Cyber Security Law, its first
comprehensive data privacy and security regulation. It
addresses specific privacy rights previously adopted in the
European Union and elsewhere such as access, data retention, breach
notification, mobile privacy, online fraud and protection of
minors.
There is plenty in the new law to irritate international
businesses operating in China. It requires in general that
Chinese citizens' data be stored only in China, for
starters, possibly requiring global corporations to maintain
separate IT systems for Chinese data. Most of the privacy
enhancements benefiting citizens align with those required in the
European Union, but it is unclear how the Chinese will expect
compliance, particularly since, as with many Chinese laws, its
language is vague as to its scope, application and details.
This vagueness leaves interpretation to the State Council, the
chief administrative authority in China, headed by Premier
