On February 24, 2023, the Measures on Standard Contract for Cross-border Transfers of Personal Information (“Measures”) was released by the Cyberspace Administration of China (“CAC”) together with Standard Contract for Cross-border Transfers of Personal Information (“CN SCCs”) as attachment. The Measures will take effect on June 1, 2023.

Prior to the release of the long-awaited CN SCCs and the Measures, the Measures for the Security Assessment of Data Cross-border Transfer (“数据出境安全评估办法”, “Measures for the Security Assessment”) and the Practice Guideline for Cybersecurity Standards- Specification for Security Certification of Cross- Border Transfers of Personal Information V2.0 (“网络安全标准实践指南—个人信息跨境处理活动安全认证规范 V2.0”,  “Specification V2.0”) were respectively released by the CAC on July 7, 2022 and by the TC260[1] on December 16, 2022. Along with the release of the CN SCCs and the Measures, all three cross-border data transfer (“CBDT”) mechanisms set out under Article 38 of the Personal Information Protection Law (“PIPL”), namely the CAC security assessment, the Certification and the aforesaid CN SCCs, have been settled for implementation.

Prior to cross-border transfer of personal information (“PI”)[2], Personal Information Handler ("PI Handler”)[3] should choose an applicable CBDT mechanism among the CAC security assessment, the Certification and the CN SCCs. The following flowchart is hereby summarized in a concise manner for PI Handlers to quickly nail down the CBDT mechanism suitable for various scenarios in basically four steps[4][5]:

The main comparisons among the three CBDT mechanisms are as follows:

If a PI Handler chooses the CN SCCs as the CBDT mechanism, the following five steps can be taken for implementation:

Pursuant to Article 55 of the PIPL, PI Handlers shall carry out PIA in advance before cross-border transfer of PI. Article 7 of the Measures expressly provides that PIA report is mandatory for the CN SCCs record filing procedures. In other words, the CBDT PIA will have to be properly conducted beforehand by PI Handlers that adopt CN SCCs as the CBDT mechanism.

Given the template for CBDT PIA report under the CN SCCs mechanism has not been released by the regulatory authorities yet, PI Handlers can set out to address the PIA with reference to the legal requirements as specified in the PIPL, the Measures, the Measures for the Security Assessment and the Specification V2.0.

The key points of CBDT PIA therein include the following:

1) Legality, legitimacy and necessity of the purposes, scope, methods, etc. of the data processing by the PI Handler and the overseas recipient;

2) The scale, scope, categories and sensitivity of cross-border transferred data, and assessment of the risk to the legitimate rights and interests of personal information subjects that may be caused by cross-border PI transfer;

3) Whether the responsibilities and obligations promised and undertaken by overseas recipient, as well as the management and technical measures and capabilities to perform the responsibilities and obligations can ensure the security of the cross-border transferred PI;

4) The risk of PI being tampered with, destroyed, breached, lost, transferred, or illegally obtained or used during and after the cross-border transfer, and whether the channels for exercising personal information subjects’ rights and interests are unobstructed;

5) The influence of the PI protection related laws and regulations of the country or region where the overseas recipient is located on the performance of the CN SCCs;

6) Other matters that may affect the security of cross-border PI transfer.

Generally speaking, the CN SCCs and the GDPR SCCs are both applied as the safeguard for CBDT, aiming to achieve the equivalent protection level, with the same fundamental principles and implementing mechanisms. However, owing to the different provisions of the PIPL and the GDPR, the different understanding of national security and public interests between China and the European Union (“EU”), as well as the differences of regulation and enforcement system, the CN SCCs and the GDPR SCCs have some substantial differences, including but not limited to the following aspects: