Cyber Protection of Personal Information in a Multi-Layered System

• Author: Zhou Yuexin
• Pages: 160-169

7 CLU_CYBER.DOC (DO NOT DELETE) 2019-12-20 12:20 PM

160 TSINGHUA CHINA LAW REVIEW [Vol. 12:159

CYBER PROTECTION OF PERSONAL INFORMATION IN A

MULTI-LAYERED SYSTEM

Zhou Yuexin

I. INTRODUCTION

In the past two years, to ensure the cyber data security and the

legitimate rights of citizens, China has issued a series of regulatory

documents to set the benchmark of data use. With the global focus

on legislation of cyber data protection, the regulatory process

manifested China’s attempt to establish its own cyber data protection

system.

This note will briefly introduce the development and status quo of

cyber data protection in China. Part I introduces the regulatory

development on cyber data protection driven by the three regulations.

Part II, in the following, concludes the regulatory trend manifested

by the three documents and discusses the multi-layered system

established by them, including the reason to establish this system and

how it works, and the tension between innovation and privacy

protection underlying this system. This note concludes that there are

problems when carrying out this system. Suggestions will also be

given to address the problems.

II. THE REGULATORY TREND IN CYBER PROTECTION OF PERSONAL

INFORMATION

On May 1, 2018, Information Security Technology-Personal

Information Security Specification (hereinafter referred to as the

“Specification”) issued by the Standardization Administration of

China entered into force.1 On April 19, 2019, China’s Ministry of

Public Security released the final version of Guideline for Internet

Personal Information Security Protection (hereinafter referred to as

the “Guideline”) as a restatement and confirmation of the Standard.

On May 28, 2019, Draft Measures on Administration of Data

Security (hereinafter referred to as the “Measures”) were issued by

the Cyberspace Administration of China, along with a public

1 Xinxi Anquan Jishu Geren Xinxi Anquan Guifan ( 信息安 全技 术 个人信息安全规范)

[Information Security Technology - Personal Information Security Specification] (promulgated by the

Standardization Administration, Dec. 29, 2017, effective May.1 2018).