The Cyberspace Administration of China ("CAC") released a new draft of the long-halted Measures on Security Assessment on Personal Data Export (“Draft Measures”) on June 13, 2019, almost two years after the publication of the controversial draft cross-border data transfer rules. While excluding important data from the Draft Measures, likely in wake of the intrinsic difference between the two types of data, the draft again expands the security assessment obligation for export of personal data from Critical Information Infrastructure Operators (“CIIOs”) to ordinary network operators, and indiscriminately requires prior government assessment for data export of onshore and offshore entities. Both will likely spur strong reactions from companies heavily relying on cross-border data transfers for their daily operations, in particular MNCs, or offshore internet/data companies without domestic presences. Further, despite its enhancement of data subject rights, implementation and enforcement of such rights under the Draft Measures may be difficult and at the same time, pose much burden on domestic data controllers. More...
