Data Newsletter| Cybersecurity Law Revision Progresses With Expected Hike In Penalties

————Takeaways————

• In September, China concluded an administrative penalty case related to personal information protection, once again underscoring the importance of compliance with cross-border data transfer requirements and personal information protection impact assessments. The public security cyber department found that a company providing foundational datasets for AI training failed to conduct personal information protection impact assessment before processing sensitive biometric data such as facial information. The company was penalized and ordered to rectify the issue.
• The National People's Congress launched the third round of public consultation on the Draft Amendment to the Cybersecurity Law. The draft largely aligns with the version released by the Cyberspace Administration of China in March and proposes a significant increase in the maximum penalties for violations of cybersecurity obligations. If adopted, the maximum fine for enterprises could