Companies operating in China have been desperate for
clarifications since the promulgation of the important but
ambiguous PRC Cybersecurity Law in 2017 introduced China's
first national-level legal framework on personal information and
data protection. Some of these clarifications arrived in 2019 with
new regulations, but with several new and onerous requirements.
Stepped up enforcement in 2019 also provided some clarity, focusing
on the illegal collection and sale of personal information, but
with more limited penalties than can be seen under e.g. the GDPR.
But heavier penalties may be coming.
Introduction
Starting in 2017, the groundbreaking PRC Cybersecurity Law
("CSL") established the first general framework for PI
and data protection and security in China, but many details were
lacking, and companies operating in China struggled to comply,
particularly when it came to cross-border data transfers,
commercialization of data, and alternate data channels such as
