A close look at the HR exemption: labour rules and/or collective contracts?

In our recent blog post, we introduced the Provisions of Facilitating and Regulating Cross-border Data Flows (Provisions), which were released by Cyberspace Administration of China on 22 March 2024 and took effect on the same date. 

Intra-group transfer of employee data is a common data export scenario for multinational corporations (MNCs), which typically leverage global systems to manage employee data. As such, the HR management exemption introduced in the Provisions is a positive reform for MNCs. However, MNCs will need to satisfy several prerequisites to rely on this exemption to reduce the administrative burden of completing standard contracts or other procedural requirements to legitimise data exports.

Labour rules

To transfer employee data abroad with the benefit of the Provisions, one of the prerequisites is that MNCs have put in place labour rules formulated in accordance with the law. While the specific procedural steps are not outlined in the Provisions, it is generally understood that companies should engage in collective consultation from an employment law standpoint.

Under the Employment Contract Law (ECL), if an employer intends to formulate, modify or determine any labour rule or significant matters directly relating to the vital interests of its employees, the employer is required to discuss the new labour rule with the employee representative congress or, in its absence, all employees, and finalise the new rule through consultation with the labour union or employee representatives (or, in the absence of both representative bodies, in practice, all employees). Although a company isn't obligated to adopt every suggestion made by its employees, it should carefully consider repeated feedback, as this could indicate the need for revisions. Once finalised, the new labour rules must be communicated to all employees to ensure everyone is aware of the final version of the new rule. 

In scenarios where an MNC lacks a formal employee representative congress or labour union, direct engagement with employees is crucial for gathering their views on new labour rules. Since the ECL's enactment in 2008, many MNCs have successfully implemented internal policies through such consultation processes. Likewise, when establishing internal rules concerning the handling of personal information for HR management — particularly regarding the transfer of such data — MNCs are advised to adhere to their usual consultative practices to ensure compliance and maintain transparency.

Collective contracts

The second key requirement is securing a collective contract that complies with the law. A collective contract, as defined by current legislation, is a formal written agreement reached through collective bargaining between an employer and its workforce. This contract details mutually agreed terms on various employment matters, such as salaries, work schedules, leave and benefits. Typically, non-manufacturing MNCs and those without a labour union rarely establish collective contracts with their employees.

For collective contracts to be legitimate and binding for both employers and employees, it’s crucial to follow the procedural steps outlined in the Collective Contracts Provisions and any related local regulations. These steps generally involve:

• Request for collective bargaining: Once either party receives a request in writing to commence collective consultation, it must respond in writing to such request within a prescribed time period, and may only turn down such request with justification.
• Appointment of representatives: Each party must have at least three representatives – one being designated as chief rep – to attend the collective consultation. 
• Collective bargaining: After each side’s representatives have completed their preparatory work, which includes proposing the topics for collective bargaining, both sides attend the consultation meeting to discuss the contents of the collective contract. 
• Approval by employees: Once a draft of the collective contract is signed by the two chief representatives, it must be submitted to all employees or the employee representative congress for discussion and approval. 
• Final review of labour authorities: Once the final version of the collective contract is approved and executed by both parties, it must then be submitted to the local labour administration for examination and filing.

Pursuant to the Collective Contracts Provisions, the maximum limit of a collective contract is three years. Renewal requires similar collective bargaining. 

The battle between “and” and “or”

There's a question that arises under the Provisions: do businesses really need to establish both a labour rule and a collective contract to qualify for the HR exemption? This issue is open to interpretation.

Some commentators lean on the literal use of the word "and" in the Provisions to suggest that it signifies the need for both elements to be in place to take advantage of the exemption. However, from a practical standpoint, having both a labour rule and a collective contract can be burdensome for businesses, especially since the process of finalising a collective contract is quite complex. 

Interestingly, in reputable Chinese dictionaries, you can find that "and" sometimes implies a comparison or even suggests "or" in some contexts! So, pending official clarification, to implement a more manageable approach, companies might choose either a labour rule or a collective contract to comply with the HR exemption. 

It is important to note that the Personal Information Protection Law provides for labour rules and collective contracts, for the purposes of HR management, as one of the processing conditions other than consent to help businesses to collect and process personal information with more flexibility (see our alert). If you consider relying on a labour rule or collective contract to collect personal data or facilitate data transfer, or for both purposes, you should make it clear in the document.

Genuine need

The last limb for the HR exemption is that there is a “genuine need” to export the employee data. While what is “genuine need” is yet to be officially clarified, it is generally considered a low threshold to meet. We recommend businesses to provide justification in their labour rules or collective contracts when seeking reliance on the HR exemption.

Only employee data?

The HR exemption seems to be narrowly tailored to the personal data of current employees only. This raises the important question of whether businesses can apply the HR exemption to other individuals like interns, temporary staff, consultants, and prospective employees whose onboarding process is not yet complete? Furthermore, companies must think about how to handle the personal data of employees' spouses or other family members.

If Chinese legislators intended for the exemption to be of such restricted application, clearly MNCs will need to find alternative exemptions, localise non-exempt HR workstreams or go back to completing standard contracts or other export mechanisms. 

While the HR exemption might unfortunately not be the saviour that HR teams hoped for, our cross-disciplinary team is ready to guide MNCs through the consultation and data privacy aspects to maximise its application. Reach out if you need advice!