China: Shanghai’s FTZ aims to pioneer data reforms – the new year gift business looked for?

After reports at the end of 2023 of enterprises struggling to legitimatise cross-border data transfers under the mechanisms set out in China’s Personal Information Protection Law, the Chinese government has seemed keen to woo enterprises buried under paperwork. 

In China’s financial capital, in particular, the last couple of months have seen the release of several plans that emphasise, among other things, opening up data exports:

• The Shanghai Free Trade Zone plan (FTZ Plan) envisages easing regulatory restrictions on data transfers by financial institutions. 
• The implementation measures of the FTZ Plan (FTZ Implementation Measures), published by the Shanghai Municipal Government on 6 February, flesh out some of the details.
• The Implementation Plan for the Comprehensive Reform Pilot of Pudong New District (2023-2027) (Pudong Implementation Plan), published by the State Council on 22 January, echoes the FTZ Plan and lays out data restriction lift plans for enterprises in Pudong.
• The Measures for the Classification and Grading Management of Cross-border Data Flow in the Lingang Special Area (Trial) (Trial Measures), published on 19 January, focus on rules for Shanghai’s newest hotstop for foreign investment. 

What do the FTZ Implementation Measures say?

The FTZ Implementation Measures reinstate that financial institutions in the Shanghai Free Trade Zone (Shanghai FTZ) must comply with China’s data export security management framework in their cross-border data transfer arrangements. 

However, while the measures emphasise the support of the administration committees of the Shanghai FTZ and the Lingang Special Area of Shanghai FTZ (Lingang Special Area) in establishing a safe and convenient data transfer mechanism, the measures do not offer much more than what was already seen in the FTZ Plan. For example, the promise of an “important data” directory is not elaborated on.

What about the Pudong Implementation Plan?

Article 2(3) of the Pudong Implementation Plan supports the exploration and establishment of a secure and convenient data export mechanism in the Lingang Special Area. The same article also encourages active exploration and optimisation of measures for managing cross-border data flow. Other data-related provisions in the Pudong Implementation Plan cover the digital economy, data security management, data credibility, etc.

Yet, despite these positive signals, the Pudong Implementation Plan is high-level and offers little guidance on how national-level restrictions will be lifted in practice. A press conference held on 26 January by the State Council Information Office about the Pudong Implementation Plan similarly did not disclose additional details.

Lingang stands out in newly released measures

Several days before publication of the Pudong Implementation Plan, the Trial Measures were released. Though the full text of the Trial Measures is yet to be publicly disclosed, below are some highlights reported by credible sources.

Basics about the Trial Measures

The Trial Measures divide cross-border data into three categories:

1. Core data: data whose export is prohibited.
2. Important data: a list is to be formulated and export of these data will be permitted after (a) an initial review of the export application by the Lingang Special Area Data Cross-border Service Centre and (b) completion of a data export security assessment at the Shanghai Cyberspace Administration of China. 
3. General data: a list is to be formulated. Export of this data type will be permitted provided that a (presumably one-off) filing with the Lingang Special Area Management Committee (the body in-charge of administering the Lingang Special Area) is completed and other relevant rules are complied with. 

How will the Trial Measures be implemented?

The principle of the Lingang data export mechanism is “from enterprise to industry, from case to list, and from positive to negative”. Our preliminary interpretation of this vision is as follows:

• The data export mechanism in Lingang may adopt a case-by-case review first, and gradually transit to a positive/negative list model applicable industry-wide.
• The list for general data is expected to expand going forward to meet the growing need for China-based enterprises to share data with overseas affiliates and counterparts. The Trial Measures also explicitly provide that, once formulated, the list of important data will replace that for general data. 

This seems to signal a transition from a positive list mechanism to a negative list one. Such transition model is not new – we have seen it previously with respect to, most notably, entry of foreign investment in China. 

What is being liberalised?

The exact relaxations of the Trial Measures will not be clear without reviewing their full text and seeing how the rules are implemented in practice. Our initial guess, however, is that:

• for important data, there will be a streamlined security assessment process, with limited types of data included in the list; 
• for general data, relaxations might amount to the free export of general data regardless of the amount to be exported, so long as the enterprise-level filing is conducted at the outset. 

If we follow the example of the national-level standard contract and security assessment regimes, the filing process for general data should not involve a long, substantive review, but the important data assessment will likely be longer and more complex.

Any sectors of focus?

Lingang has prioritised certain industries, i.e. financial management (including digital asset management), intelligently connected vehicles, high-end shipping, international trade, biopharmaceuticals, cultural exports. 

Public information indicates that experts and leading enterprises in a specific industry will be involved in formulating its respective lists. For instance, 14 automobile companies have formed a working group to press ahead with the preparation of lists in the auto sector. 

The first batch of lists are expected to be released this March. Presumably these will focus on the auto industry, given the working group that has been initially established, but this is unclear from the news so far.

What’s next?

The Pudong Implementation Plan will likely be materialised first in the Lingang Special Area. This would match the expectation, as set out in the Regulations on the Lingang Special Area of China (Shanghai) Pilot Free Trade Zone, of featuring Lingang as a “global data aggregation and circulation hub”. Watch this space.

The only way is Shanghai?

Seemingly not. Not to be outdone, on 8 February, the Tianjin Pilot Free Trade Zone (Tianjin FTZ) released the Standardised Specification for Classification and Grading of Enterprise Data in the China (Tianjin) Pilot Free Trade Zone. This specification applies to organisations in the Tianjin FTZ – an area that has emphasis on tech development – and provides helpful details in respect of data classification. It is to be seen if Shanghai follows its northern counterpart.

More importantly though, the Ministry of Commerce indicated on 5 February that the long-awaited draft provisions on cross-border data flows will soon be finalised! These national level provisions should further contribute to formulation of localised data regulatory regimes in Lingang, Shanghai and Tianjin and, crucially, provide exemptions to enterprises in all locations and sectors.

We will keep monitoring for future updates in respect of the data transfer regime. Stay tuned!