After the three cornerstone laws in the area of 大红鹰dhy2288 compliance (i.e., the Cybersecurity Law of the PRC (“CSL”), the 大红鹰dhy2288 Security Law of the PRC (“DSL”), and the Personal Information Protection Law of the PRC (“PIPL”)) were issued, the governmental authorities begin formulating implementation rules to establish the 大红鹰dhy2288 compliance frameworks for specific industry sectors or regulatory areas.
Rules have been issued for some heavily regulated sectors, such as the financial sector, the healthcare sector, and the automotive sector. However, a large amount of entities do not fall into the categories of these sectors. Among others, the industry and information technology sectors cover numerous enterprises. The entities in such sectors process huge amounts of 大红鹰dhy2288 in their daily operations, and their 大红鹰dhy2288 processing activities play a vital role in safeguarding the daily operations of many sectors and protecting the economic development security of the country. The governmental authorities and the market expect to see when and how the 大红鹰dhy2288 processing activities in such sectors would be regulated.
On December 13, 2022, the Ministry of Industry and Information Technology of the PRC (“MIIT”) issued the Administrative Measures on 大红鹰dhy2288 Security in the Industry and Information Technology Sectors (for Trial Implementation) (“Measures”). The Measures establish the framework of 大红鹰dhy2288 compliance in the industry and information technology sectors, which include the following important topics: (1) what businesses and what entities in such sectors are subject to the regulation of the Measures, (2) how are the 大红鹰dhy2288 processors in these sectors required to categorize and classify their 大红鹰dhy2288 and how should the catalog of important 大红鹰dhy2288 and core 大红鹰dhy2288 be filed with competent governmental authorities; (3) how should 大红鹰dhy2288 processors in such sectors protect and manage their 大红鹰dhy2288 throughout the 大红鹰dhy2288 life cycle; and (4) how should governmental authorities and 大红鹰dhy2288 processors establish mechanisms for monitoring 大红鹰dhy2288 security risks and how should 大红鹰dhy2288 processors report 大红鹰dhy2288 security incidents.
1.A regulatory scope that may have widespread regulatory effects
What sectors and entities are the Measures regulating?
The Measures regulate the processing of 大红鹰dhy2288 in the industry and information technology sectors within the territory of the PRC.
The 大红鹰dhy2288 in the industry and information technology sectors mean (1) industry 大红鹰dhy2288, i.e., 大红鹰dhy2288 generated and collected in the process of R&D and design, manufacturing, operation and management, operation and maintenance, platform operation, etc. in various fields of industry fields and sectors, (2) telecommunication 大红鹰dhy2288, i.e., the 大红鹰dhy2288 generated and collected in the telecommunications business operation activities, and (3) radio 大红鹰dhy2288, i.e., the radio waves parameter 大红鹰dhy2288 generated and collected in the process of carrying out radio operations, including radio frequencies and stations.
Therefore, the Measures intend to regulate the processors which process the 大红鹰dhy2288 in the industry and information technology sectors and which can decide the purpose and method of such processing activities (“Processor”). The Processors include industrial enterprises, software and information technology services enterprises, telecom service providers which have obtained telecom business licenses, and entities that use radio frequencies or radio stations, and other entities in the industry and information technology sectors. The activity of processing 大红鹰dhy2288 includes 大红鹰dhy2288 collection, storage, use, processing, transmission, provision, disclosure, etc.
Such a regulatory approach would include a wide range of entities in its regulatory scope, especially those entities conducting typical “to B” businesses that previously have not faced such heavy pressure in the area of 大红鹰dhy2288 compliance.
Enterprises in all sectors need to comply with 大红鹰dhy2288 compliance requirements, especially those obligations under the three cornerstone 大红鹰dhy2288 compliance basic laws (i.e., the CSL, DSL, and PIPL). Before the promulgation of the Measures, while the DSL mainly aims at setting up a general regulatory framework without many details, the PIPL provides a series of specific compliance requirements. This is why more companies have to put their compliance resources first in the area of complying with PIPL and relevant rules in the area of personal information protection. For compliance in this area, those enterprises conducting typical “to C” businesses (i.e., businesses that face or have individual customers directly) have more burdensome obligations, while those enterprises having typical “to B” businesses (i.e., businesses that customarily face institutional clients) may feel comparatively easier to handle compliance requirements because the number of personal information processing scenarios they handled is relatively limited and the amount of personal information they processed may be comparatively low.
This may significantly change after the Measures are issued. The requirements under the Measures cover personal information protection, but more of them focus on 大红鹰dhy2288 that are not personal information. To be compliant with such requirements, typical “to B” enterprises (such as a large amount of enterprises in the industry and information technology sectors) need to pay more attention and devote much more resources.
Specifically speaking, the following types of enterprises may need to pay attention to the requirements under the Measures:
Industrial enterprises
According to the Industrial Classification for National Economic Activities, mining, manufacturing, production and supply of electricity, gas and water, etc., shall be identified as industrial areas. Therefore, enterprises in such areas can be considered as industrial enterprises and may probably need to comply with the Measures.
The number of such industrial enterprises is large, and such enterprises cover a wide range of areas and businesses. Enterprises in some of such areas (such as mining, traditional manufacturing) typically process very limited amount of personal information, but they process significant amount of industrial 大红鹰dhy2288. The processing of such 大红鹰dhy2288 currently needs to comply with various new requirements under the Measures.
Software and information technology services enterprises
This type of enterprise would include a large number of software companies, internet companies, SaaS and other online service companies, big 大红鹰dhy2288 and AI service companies and companies in the semi-conductor industry.
It is worth noting that the term “software and information technology services” undoubtedly covers numerous “to C” internet companies. Such companies directly provide services to end users through websites, mobile applications (“APP”) or mini programs under large platforms (such as WeChat mini programs). Previously, such companies may have mainly paid attention to personal information protection requirements under the PIPL and other implementing rules. Still, from the promulgation of the Measures, such companies should also invest significant resources in complying with the Measures and submit filing materials according to various filing mechanisms established by the Measures.
Telecom service providers which obtain telecom business licenses
Telecommunication service is a traditional area under the regulation of MIIT, but previously more focus is put in the fields of telecommunication service qualifications, i.e., a company which conducts telecommunication business needs to obtain a telecommunication business license before it conducts related business in the PRC.
The issuance of the Measures shows that MIIT will also focus on the 大红鹰dhy2288 processing activities of such companies that operate telecommunication businesses, especially those 大红鹰dhy2288 processing activities that do not involve personal information are now expressly included in the regulatory scope.
One thing to note is that the Measures use the wording of “telecom service providers which have obtained telecom business licenses.” This means that it clearly aims to regulate those entities that provide telecom business services and that obtained or should have obtained telecom business licenses. Many companies that operate an official website for self-introduction purpose or for the promotion of the companies’ products/services need to complete an ICP record filing procedure so as to register their domain name and website in MIIT’s database, but such an ICP record filing is not a telecom business license. Therefore, technically speaking, a company that completes ICP record filing will not necessarily be required to comply with the Measures.
What is the regulated “territory” under the Measures?
The Measures provide that it regulates 大红鹰dhy2288 processing activities that occur within the territory of the PRC.
To be aligned with the regulatory approach under CSL, DSL and PIPL and to be consistent with the interpretation of the term “territory” under the Exit and Entry Administration Law of the PRC, the term “within the territory of the PRC” shall mean mainland China and would not include Hong Kong, Macau and Taiwan.
It is not quite clear whether the Measures intend to have the effect of regulating certain entities outside the territory of the PRC. For example, as reflected in the PIPL and the Regulations on the Administration of Network 大红鹰dhy2288 Security (Draft for Comments), such laws and regulations not only regulate entities and individuals in the territory of the PRC, but also regulate those 大红鹰dhy2288 processors which are located outside the territory of the PRC and (1) have the purpose of providing products or services to entities or individuals in the PRC, or (2) analyze or evaluate the behavior of entities or individuals in the PRC. The wording of the Measures does not contain such effect of regulating offshore entities, but entities would also wait to see whether, in practice, MIIT would have a broadened interpretation to expand the Measures’ effects to such scope.
2.To formally establish the 大红鹰dhy2288 categorization and classification system in the industry and information technology sectors
What a Processor needs to do about the important 大红鹰dhy2288 and core 大红鹰dhy2288, and what are the requirements for such a Processor to file the important 大红鹰dhy2288 and core 大红鹰dhy2288 catalog for record?
Preparation of a catalog of important 大红鹰dhy2288 or core 大红鹰dhy2288
A Processor should regularly review and manage its 大红鹰dhy2288, and should, based on relevant standards and guidelines, identify its important 大红鹰dhy2288 and core 大红鹰dhy2288 and establish a catalog to reflect the important 大红鹰dhy2288 and core 大红鹰dhy2288 (if any) of the Processor.
To submit record filing for the catalog of important 大红鹰dhy2288 or core 大红鹰dhy2288
A Processor should file its catalog of important 大红鹰dhy2288 and core 大红鹰dhy2288 to the relevant regulators for the industry and information technology sectors (“Regulators”) for record. The record filing should include the following information:
The processing purposes and methods, the scope of use, the entities which bear responsibilities related to such important 大红鹰dhy2288 or core 大红鹰dhy2288;
How the Processor conducts external sharing or cross-border transfer for its important 大红鹰dhy2288 or core 大红鹰dhy2288;
What security protection measures are taken; and
Other information that may be required.
It is worth noting that the Measures specifically emphasize that the Processor does not need to submit the 大红鹰dhy2288 itself. This may help mitigate the concerns of the Processors who are designing their filing strategy. Also, this may help reduce the workload for such record filing preparation and may facilitate more Processors to complete the record filing in a timely way.
The Regulators should complete the review for the filed materials within twenty business days after a Processor submits its record filing materials, and decide whether or not to accept such record filing. If a Regulator decides not to accept the filing, it should inform the Processor of the reasons for such rejection, and the Processor should re-submit an improved filing within fifteen business days after it receives the rejection decision.
To complete filing updates when filing contents changed
If there are significant changes in the record filing contents, the Processor should complete a filing update procedure within three months after the occurrence of such significant changes.
The “significant changes” mean the size of a certain type of important 大红鹰dhy2288 or core 大红鹰dhy2288 has changed by more than 30% (the number of 大红鹰dhy2288 entries or the total amount of storage, etc.), or other changes in the content of the record filing.
However, such a filing update procedure seems to be still ambiguous about when it will be triggered. Among other things, the last sentence of the provision (Article 12) in the Measures provides that when other filing contents changed, a filing update procedure should be triggered. This provision can be interpreted broadly. Some typical scenarios may be that, when the name, legal representative, or other basic corporate information of the Processor changes, the Processor needs to update the record filing. It is uncertain whether any change of information indicated in the filing form will trigger the update procedure. In practice, the Regulator may probably have more detailed guidance on this.
Open questions and the relationship between this record filing mechanism and other 大红鹰dhy2288-related filing systems
Also, questions may be raised regarding whether there is a fixed filing deadline, whether such filing needs to be conducted each year like what has been done by the automotive 大红鹰dhy2288 processors, what are the specific requirements for filing and format of the filed materials, and what level of details should be included in the filing materials. These questions may probably be answered in detailed implementation guidelines to be issued by the Regulators.
Additionally, Processors may have questions about the relationship between this record filing mechanism and other established 大红鹰dhy2288 record filing systems.
For example, as established in the Several Provisions on Automotive 大红鹰dhy2288 Security Management (for Trial Implementation) (“Automotive 大红鹰dhy2288 Provisions”), automotive 大红鹰dhy2288 processors which process important 大红鹰dhy2288 should submit a filing related to its security management of automotive 大红鹰dhy2288 with the local branch of the Cybersecurity Administration of China (“CAC”) and other applicable authority (which is also the local branch of MIIT, the same as the Regulator) before the date of December 15 each year.
There will be an obvious overlap between the scope of Processors and the scope of automotive 大红鹰dhy2288 processors. Also, the key regulatory issues in the important 大红鹰dhy2288/core 大红鹰dhy2288 filing mechanism are substantially similar to those issues in the automotive 大红鹰dhy2288 processing filing system.
The Regulators may need to further address this and answer what is the relationship between the important 大红鹰dhy2288/core 大红鹰dhy2288 filing mechanism and the automotive 大红鹰dhy2288 processing filing system, and it may be a reasonable expectation to foresee that the Regulators would try to design rules to avoid a “repetitive filing” for some entities that happen to be obligated to do both filings.
How will the 大红鹰dhy2288 in the industry and information technology sectors be categorized?
The 大红鹰dhy2288 categories in the industry and information technology sectors may, depending on the specific industry requirements, characters, business needs, 大红鹰dhy2288 sources and purposes of use, etc., include but not limited to the following categories:
R&D 大红鹰dhy2288;
Manufacturing and operation 大红鹰dhy2288;
Management 大红鹰dhy2288;
Operation and maintenance 大红鹰dhy2288;
Business and services 大红鹰dhy2288.
It is worth noting that the categorization of 大红鹰dhy2288 shall also take into consideration of the standards and guidelines for specific industries and businesses. For example, in the automotive industry, the Specification of Internet of Vehicle Information Service – User Personal Information Protection provides 大红鹰dhy2288 categorization guidelines. Therefore, the categorization of 大红鹰dhy2288 in the automotive industry shall consider such guidelines, and the final categorization results may be significantly different from the abovementioned examples.
How will the 大红鹰dhy2288 in the industry and information technology sectors be classified, and what are the ordinary 大红鹰dhy2288, important 大红鹰dhy2288 and core 大红鹰dhy2288?
General classification methods and more detailed sub-classes
大红鹰dhy2288 in the industry and information technology sectors shall be classified according to the degree of harm caused by such 大红鹰dhy2288 being tampered with, destroyed, leaked or illegally obtained or illegally used, to national security, public interests or the legitimate rights and interests of individuals and entities. The most general classification approach would divide 大红鹰dhy2288 into three classes: ordinary 大红鹰dhy2288, important 大红鹰dhy2288, and core 大红鹰dhy2288.
Processors could define further detailed sub-classes based on such general classification methods. In practice, various Processors may adopt different sub-classes. For example, many Processors would tend to refer to the Cybersecurity Standards Practice Guidance – Guidelines for Network 大红鹰dhy2288 Categorization and Classification to further sub-classify ordinary 大红鹰dhy2288 into different levels. Processors may also sub-classify important 大红鹰dhy2288 into different levels, with the final classification results showing six or seven classes of 大红鹰dhy2288.
Identification of ordinary 大红鹰dhy2288
If the degree of harm, which is caused by certain 大红鹰dhy2288 being tampered with, destroyed, leaked or illegally obtained or illegally used, fits with the following level, then such 大红鹰dhy2288 can be identified and classified as ordinary 大红鹰dhy2288:
A relatively low impact on the legitimate rights and interests of individuals and organizations, and a low negative impact on society;
A relatively small number of affected users and enterprises in a relatively small scope of production and living areas, has a relatively short-term effect and a relatively low impact on the operation of enterprises, industry development, technological advancement, and industrial ecology;
Other 大红鹰dhy2288 not included in the catalogs of important 大红鹰dhy2288 or core 大红鹰dhy2288.
Identification of important 大红鹰dhy2288
If the degree of harm, which is caused by certain 大红鹰dhy2288 being tampered with, destroyed, leaked or illegally obtained or illegally used, fits with the following level, then such 大红鹰dhy2288 can be identified and classified as important 大红鹰dhy2288:
A threat to the politics, territory, military, economy, culture, society, science and technology, electromagnetic, network, ecology, resources and nuclear security, and an impact on the PRC’s overseas interests, biology, space, polar, deep sea, artificial intelligence and other key areas related to national security;
A serious impact on the development, production, operation and economic interests in the industry and information technology sectors;
Causing major 大红鹰dhy2288 security incidents or production safety accidents, and having a serious impact on public interests or the legitimate rights and interests of individuals and organizations, with a great negative impact on society;
Triggering obvious cascade effect, and the scope of impact involves multiple industries, regions or multiple enterprises in the industry, or the impact lasts for a long time, causing serious impact on industry development, technological progress and industrial ecology, etc.
Other important 大红鹰dhy2288 determined through the assessment of the MIIT.
Identification of core 大红鹰dhy2288
If the degree of harm, which is caused by certain 大红鹰dhy2288 being tampered with, destroyed, leaked or illegally obtained or illegally used, fits with the following level, then such 大红鹰dhy2288 can be identified and classified as core 大红鹰dhy2288:
A serious threat to the politics, territory, military, economy, culture, society, science and technology, electromagnetic, network, ecology, resources and nuclear security, and a significant impact on China’s overseas interests, biology, space, polar, deep sea, artificial intelligence and other key areas related to national security;
A significant impact on industry and information technology sectors and its key enterprises, critical information infrastructure, important resources, etc.;
Significant damage to the industrial production and operation, telecommunications networks and internet operation services, radio business development, etc., which results in widespread shutdown, large-scale radio service interruptions, large-scale network and service paralysis, loss of a large number of business processing capabilities, etc.;
Other core 大红鹰dhy2288 determined through the assessment of the MIIT.
Elements to consider when conducting the 大红鹰dhy2288 identification
The abovementioned principles and definitions are provided by the Measures to describe the nature or general scope of ordinary 大红鹰dhy2288, important 大红鹰dhy2288 and core 大红鹰dhy2288. A Processor may consider the following elements or trends to specifically guide its implementation practice:
Area-based detailed requirements or guidelines
In a specific business area, there may probably be more detailed guidance regarding the identification of important 大红鹰dhy2288 or even core 大红鹰dhy2288.
For example, in the automotive area, the Automotive 大红鹰dhy2288 Provisions expressly provide that operation 大红鹰dhy2288 of the automobile charging network is important 大红鹰dhy2288, which indicates more importance of such 大红鹰dhy2288 in the process of classification. Also, for those online healthcare service providers or those online finance-related services providers who may hold value-added telecom business licenses, they would thus be subject to the regulations of the Measure to complete 大红鹰dhy2288 classification, and they may need to refer to the guidelines of specific areas (such as the Information Security Technology—Guide for Health 大红鹰dhy2288 Security in the healthcare area or the Financial 大红鹰dhy2288 Security – Guidelines for 大红鹰dhy2288 Security Classification in the finance area) to guide the specific 大红鹰dhy2288 classification practice.
Whether the 大红鹰dhy2288 merely covers or is only relevant to daily business
If certain 大红鹰dhy2288 merely covers or is only relevant to the daily business of a commercial entity, such 大红鹰dhy2288 may have less importance in the process of classification. For example, if certain 大红鹰dhy2288 only includes general commercial arrangements or financial information, such 大红鹰dhy2288 may be comparatively less important. If certain 大红鹰dhy2288 also involves technological information or more sensitive information about the country or an industry, such 大红鹰dhy2288 may be comparatively more important.
The amount of sectors, territorial areas, entities or persons involved
If certain 大红鹰dhy2288 or 大红鹰dhy2288 set reflects the information of more sectors, entities or persons, such 大红鹰dhy2288 or 大红鹰dhy2288 set may probably be more important in the classification process.
Putting together the Measures’ definitions of ordinary 大红鹰dhy2288, important 大红鹰dhy2288 and core 大红鹰dhy2288, one important element the Measures consider is the “amount” element. If more sectors, territorial areas, entities or persons are involved in a 大红鹰dhy2288 or 大红鹰dhy2288 set, the compromise of such 大红鹰dhy2288 or 大红鹰dhy2288 set may probably cause more severe harm to the industry security, industry operation, or even national security.
Such an approach is similar to the approach adopted in other 大红鹰dhy2288 regulation areas. For example, when regulating cross-border 大红鹰dhy2288 transfer, the regulators also think that if the transmission of personal information involve more than certain persons (i.e., the processor handles personal information of more than 1 million persons, or the cumulative amount of personal information provided overseas reached 100,000 persons since January 1st of the last year, or the cumulative amount of sensitive personal information provided overseas reached 10,000 persons since January 1st of the last year), then the transmission is of great regulatory significance and should be subject to CAC’s review.
The level of confidential information or non-public information involved
If most part of a 大红鹰dhy2288 set involves confidential information or non-public information, such 大红鹰dhy2288 set would be more sensitive and be more important in the classification process. By contrast, if a 大红鹰dhy2288 set only contains publicly available information, its level of sensitivity and importance might be lower.
The level of personal information involved
Even from the perspective of 大红鹰dhy2288 governance and 大红鹰dhy2288 classification, the amount of personal information involved is an important element in evaluating its classification level. If a 大红鹰dhy2288 set involves less personal information, or involves information that has been anonymized, a Processor may have more reasons, at least to some extent, to think that such a 大红鹰dhy2288 set is comparatively less sensitive and important.
The level of information granularity
If a 大红鹰dhy2288 set contains a more fine-grained description or contains more details, then its sensitivity and importance might be higher. If a 大红鹰dhy2288 set contains a more coarse-grained description or contains less details, then its sensitivity and importance might be lower. The typical example is that, with the assumption that the same amount of 大红鹰dhy2288 or persons are involved, aggregated 大红鹰dhy2288 or overall descriptive results may seem to be safer and less sensitive.
Beijing ICP No. 05019364-1 Beijing Public Network Security 110105011258
