Comparing with the first draft of the Guidelines, the second draft has not made any big changes in its structure or content other than filling in the blanks left in the Measures by elaborating certain important concepts as well as detailing the security assessment procedures.  Based on the basic rules of security assessments for data export as constructed by the Measures, the second draft of the Guidelines has clarified the scope of application of security assessments for data export and made the security assessment system more feasible and practicable.  The second draft of the Guidelines has the following four highlights:

The second draft of the Guidelines has provided further definitions of "domestic operation" and "data export" and specified the circumstances in which disputes might occur in the data export practice, which makes the scope of application of data export clearer.  For example, as far as the definition of "data export" is concerned, on one hand, the second draft of the Guidelines includes the following three circumstances into the scope of "data export": 

(1) where personal information and important data is provided to an entity which is in the territory of China but not subject to the jurisdiction of China or not registered in China; 

(2) where the data is not transferred to or stored in places outside China but is accessed and viewed by overseas institutions, organizations and individuals (except for public information and webpage visits); 

(3) where a network operator within its group exports its internal data which involves personal information and important data collected and generated in the course of its operation in China. 

On the other hand, the second draft of the Guidelines excludes the following circumstances from the scope of "data export": 

(1) where the personal information and important data that is not collected or generated in the course of operation in China is exported via China without any variation or processing; 

(2) where the personal information and important data that is not collected or generated in the course of operation in China but stored or process in China is exported without involving any additional personal information or important data collected and generated in the course of operation in China.

The second draft of the Guidelines requires that, prior to obtaining consent from personal information subjects whose personal information will be exported, a network operator must expressly notify the personal information subjects of the purpose, data type, receiver’s conditions, the possible risk exposure of such data export, the contact person and contact information of such operator etc.  When there is a change in the privacy policy of the network operator or change of the receiver of exported data, or there is a major change in the purpose, scope, type, quantity or risk exposure of the data export, consent must be re-obtained from the personal information subjects. 

In addition, the second draft of the Guidelines expressly points out that the following circumstances shall be deemed as having obtained the consent from the personal information subjects in data export: (1) making international calls and roaming calls, sending international e-mails, conducting international instant communication, carrying out cross-border transactions via Internet, and other affirmative personal acts; and (2) exporting the personal information that has been legally disclosed to the public.

The second draft of the Guidelines has clarified that in the case of multiple parties being involved in data export (e.g., when using cloud services or subcontracting services), the security assessment responsibilities shall be identified according to the party which initiates the data export.  For example, if a cloud service user on its own initiative requests a cloud service provider to export data, the cloud service user shall assume the responsibilities to conduct the security self-assessment, and the cloud service provider shall cooperate with the cloud service user to carry out the assessment.  If the cloud service provider on its own initiative proposes to export data, the cloud service provider shall assume the corresponding responsibilities, and the cloud service user shall cooperate with the cloud service provider to carry out the security self-assessment.  With these rules, it will avoid the situation in which the cloud service user and the cloud service provider both make excuses to weasel out of their respective assessment responsibilities or repeatedly conduct security assessments.

In addition to having respectively clarified the process of self-assessment and competent department assessment, the second draft of the Guidelines has enumerated the conditions upon which security self-assessments and competent department assessments will be initiated, and the circumstances in which self-assessment reports shall be submitted to the state cyberspace administration and/or the industrial competent departments.  It is worth noting that the Measures has also enumerated the circumstances in which network operators shall apply to the industrial competent or supervisory departments to organize security assessments.  Compared with the Measures, the second draft of the Guidelines has added two more conditions upon which competent department assessments will be initiated: (1) a large amount of users have so complained or reported; or (2) national industry associations have so recommended.  These two conditions may increase the feasibility for competent departments to initiate security assessments in response to the feedbacks of the public.

P.S