China: Further opening-up of data exports for Fintechs and other financial services players?

On 7 December 2023, Mainland China’s State Council released the ‘Overall Plan for Fully Integrating International High Standard Economic and Trade Rules and Promoting the High-Level Institutional Opening of the China (Shanghai) Pilot Free Trade Zone’. A mouth-full of a title for some much-sought after reforms! What are the immediate takeaways?

Data export provisions specific to FIs

Article 2 of the Plan provides that financial institutions are allowed to export data required for daily operations “under the framework of the national data cross-border transfer security management system”. Encouraging but not necessarily breaking new ground.

The same article though also stipulates that the regulatory authorities have additional authority to make regulatory measures based on “national security and the principles of prudence”, while ensuring the security of important data and personal information. 

This would suggest that, in the case of regulated fintechs and other FIs, the local branches of the People’s Bank of China, the National Administration for Financial Regulation and the China Securities Regulatory Commission, in supervising their respective business segments in Shanghai’s regulatory testbed, will be empowered to release relaxations on cross-border data sharing executed to the high standards expected by international players. 

On the one hand, this seems extremely positive for FIs and their IT service providers based in the FTZ area which includes Shanghai’s main financial district of Lujiazui. However, on the other hand, there will be uncertainty until more guidance is given by these authorities as to what amounts to a national security risk and therefore a potential blocker to liberalisation of these organisations’ data exports.

Relatedly, Article 24 allows all companies (FIs, fintechs, tech service providers and others) to export data out of business need if they “meet the national cross-border data transfer security management requirements”. 

Article 25 also supports the Shanghai FTZ to lead in formulating important data catalogues based on data classification systems and to guide organisations to conduct self-assessment of data export risks. 

Again, progressive signs that the administrative leads of the FTZ are encouraged to move forward in rulemaking, but the proof will be in what safeguards are released in practice.

What to expect

The Plan is generally positive in that it signals China’s intention to ease regulatory restrictions and to facilitate cross-border business for FIs in the Shanghai landmark free trade zone. The Plan would also relieve the tech service providers working with these FIs of some of the regulatory burden when assisting in completion of data export formalities. 

This echoes Chinese legislators’ various recent moves, e.g. the draft Provisions on Regulating and Promoting Cross-Border Data Flows, the Greater Bay Area’s data flow initiative and the State Council's Opinions on Boosting Foreign Investment. 

Despite these positive rules, however, at this stage the Plan is high-level, with no particular implementation details in place – including, importantly, no immediately obvious relaxations on the current formalities that FIs must complete to export personal and non-personal data. 

Further data exports reforms are effectively left in the hands of industry regulators, which industry will no doubt continue to lobby. 

We will keep watching so watch this space for more to come!