Security Assessments For Cross-Border Personal Information Transfers

The Cyberspace Administration of China (CAC) on June 13 published the draft Measures on Security Assessment of Personal Information (PI) Cross-Border Transfers (draft "Measures") for comments due by July 13, apparently replacing the CAC's April 2017 draft Measures on Security Assessment of PI and Important Data Cross-Border Transfers (2017 Draft). The procedural requirements for security assessments prior to cross-border transfer, including repetitive pre-transfer security assessments, would be onerous and unnecessarily costly, and adding to concern about the risk of compromise of proprietary information. The need for security assessments will put pressure on foreign investors to locate data processing operations in China, the additional cost of which may disincentivize foreign investment, particularly among new market entrants. However, it appears that actual compliance with cross-border privacy protection obligations does not appear to be more onerous than under the