The Data Outbound Negative List of the Beijing Free Trade Zone

Summary

● A new scenario-based, field-level data outbound negative list has been issued, applicable to companies operating in the Beijing FTZ.
● This is the third set of special cross-border data transfer rules to be formulated in a Chinese pilot FTZ.
● For companies in the Beijing FTZ, the process of completing a Beijing Negative List filing could be as short as five working days.
● Companies outside the zone will also find the new list to be an important reference standard.



On August 30, 2024, the Beijing Municipal Cyberspace Administration (the "Beijing CAC"), the Beijing Municipal Bureau of Commerce, the Beijing Municipal Government Services and Data Management Bureau jointly released the first scenario-based, field-level data outbound negative list of the China (Beijing) Pilot Free Trade Zone (the "Beijing FTZ"), the China (Beijing) Pilot Free Trade Zone, List for the Administration of the Cross-Border Transfer of Data (Negative List) (2024 Edition) (中国（北京）自由贸易试验区数据出境管理清单（负面清单）（2024版）), referred to here as the "Beijing Negative List".

The Beijing Negative List covers data in five industrial sectors: automotive (noting that the current edition specifically excludes its application to automatic driving companies), pharmaceutical, civil aviation, retail & modern services, and artificial intelligence training. Those sectors are key industries with rapidly increasing data export demands. According to the official policy interpretation, the Beijing Negative List will be dynamically updated and extended to cover data in more industrial sectors in the future.

Aligning with the general cross-border data transfer ("CBDT") regime set out in the Provisions for Facilitating and Regulating the Cross-Border Flow of Data (促进和规范数据跨境流动规定) (the "New CBDT Rules"), the Beijing Negative List relaxes the triggering thresholds of ex-ante CBDT requirements (i.e. general CAC filings)— (1) conducting the security assessment of the Cyberspace Administration of China ("CAC") and; (2) concluding and filing the CAC's Standard Contractual Clauses or obtaining personal information protection certification. Data that are not listed can be exported provided that such data transfer activities have been filed on the Beijing Facilitating Cross-border Flow of Data Service Platform (北京市数据跨境流动便利化服务平台) operated by the Beijing CAC.

On September 11, 2024, Bayer passed the first negative list filing in the Beijing FTZ. According to public records, the entire filing process took only five working days. Compared to completing the general CAC filings or conducting a general data outbound filing in the Lin-Gang Special Area of the China (Shanghai) Pilot Free Trade Zone, the duration of completing the Beijing Negative List filing appears to be significantly shorter.

“In addition to regulating CBDT activities, the Beijing Negative List also clarifies the scope of important data, by proposing uniformed important data identification rules in the Beijing FTZ”

Whose data processing activities are governedby theBeijing Negative List?
According to the Implementing Guidelines for the China (Beijing) Pilot Free Trade Zone, List for the Administration of the Cross-Border Transfer of Data (Negative List) (2024 Edition) (First Edition) (中国（北京）自由贸易试验区数据出境管理清单（负面清单）实施指南（第一版）), the Beijing Negative List is applicable to companies who are registered and conduct CBDT activities in the Beijing FTZ.

How does the Beijing Negative List apply?
A company which finds its pro forma applicability to the Beijing Negative List, generally need to complete a two-step formality:

Step 1 Application to use Beijing Negative List: Companies need to submit their application to use the Beijing Negative List to the administration of the free trade group to which they belong, subject to the company's location in the Beijing FTZ. Companies are obliged to upload a series of supporting documents, including an application form containing basic information of the company and description of any investigations (especially investigations regarding cybersecurity and data protection) by competent administrative authorities and the implemented remedial actions (if any) within the past two years, etc. Once the application is received, the free trade group will launch a review and approval procedure, and inform the applicant of the outcome within five working days.

Step 2 Beijing Negative List Filing: If its application to use the Beijing Negative List is approved, the company will be permitted to file its CBDT activities with the free trade group. The free trade group will then provide an initial opinion on whether the outbound data is within the scope of the Beijing Negative List, without prejudice to confirmation of such opinion by the managing institution of the Beijing FTZ.

Once the outbound data is confirmed to be within the scope of the Beijing Negative List, the free trade group will instruct the company to conduct a general CAC filing. By contrast, if the outbound data is determined to be outside the scope of the Beijing Negative List, the filed data can then be transferred overseas.

What are the three key takeaways of the Beijing Negative List?
The Beijing FTZ is the third pilot free trade zone ("FTZ") in China which has formulated its special CBDT rules, following Shanghai FTZ Lin-gang New Area in Q1 and Tianjin FTZ in Q2 2024. On March 22, 2024, the New CBDT Rules were published. Article 6 of the New CBDT Rules delegates regulators of FTZs to promulgate CBDT rules which specifically apply in their region.

• The Beijing Negative List is the first CAC-publishing FTZ negative list in China
  Different from that of the Shanghai FTZ Lin-gang New Area and the Tianjin FTZ, we observe that the Beijing Negative List is the first set of FTZ CBDT special rules (jointly) rendered by the municipal CAC. Notwithstanding that the Shanghai FTZ and the Tianjin FTZ took the initiative to promulgate FTZ-specific CBDT rules, the CBDT rules of the Shanghai FTZ Lin-gang New Area was solely published by the FTZ administration while that of the Tianjin FTZ was jointly published by the FTZ administration and municipal Commission of Commerce.
  
  The Beijing Negative List is mapped jointly by the CAC and other administrations. This appears to have convinced market players that there is likely to be a united regulatory opinion on CBDT activities which may prevent multi-enforcement by different regulatory bodies in the future.

• The Beijing Negative List is of great reference value to identify important data
  The scope of "important data" has continuously been a vague concept in Chinese data protection law due to lack of clear recognition standards. Though Article 2 of the New CBDT Rules has been interpreted by the market players as meaning that no important data is identified unless the data processor has been notified by the regulatory authorities, such interpretation could be too absolute and remove the data processor's obligation to pro-actively identify important data. As of the date of publishing the Beijing Negative List, there has been no compulsory important data identification standard nationwide that spans all industrial sectors. The Beijing Negative List, despite its specific applicability in the Beijing FTZ, has a prominent reference value in important data identification for market players outside the Beijing FTZ.
  
  According to the China (Beijing) Pilot Free-Trade Zone, Data Reference Rules by Category and Level (中国（北京）自由贸易试验区数据分类分级参考规则), there are uniform rules for identifying important data as follows:
  
  • Personal information volume threshold: Personal information of over 10 million individuals (excluding sensitive personal information); or sensitive personal information of over 1 million individuals; or personal information of over 100,000 individuals, containing certain sensitive personal information, e.g. personal bank account, personal insurance account, personal registered account, personal diagnostic and treatment data, etc. held by companies located in the Beijing FTZ;
  • CIIO threshold: Personal information of over 100,000 individuals held by a Critical Information Infrastructure Operator ("CIIO");
  • High-value sensitive data: High-value sensitive data collected and generated in the R&D and design process, production and manufacturing process and operating and management process, and related to the industrial sector's competitiveness and production safety by companies located in the Beijing FTZ;
  • Supply-chain-related data: Supply-chain-related data concerning national security of companies located in the Beijing FTZ;
  • Automatic control system data: Parameters, control, operation and test data of automatic control systems that relate to national security and human welfare held by companies located in the Beijing FTZ.

“Notably, the Beijing Negative List eases the volume triggering thresholds of CBDT activities taking place in the Beijing FTZ”

• For the data processor's convenience, the Beijing Negative List eases the volume triggering thresholds of general CAC filings
  Notably, the Beijing Negative List eases the volume triggering thresholds of CBDT activities taking place in the Beijing FTZ.
  
  The New CBDT Rules stipulated the thresholds of the CAC's Standard Contractual Clauses as the volume of outbound personal information (excluding sensitive personal information) reaches 100,000 but less than 1 million; or the volume of outbound sensitive personal information is less than 10,000 while the thresholds of the CAC's security assessment were specified as the volume of outbound personal information (excluding sensitive personal information) reaches 1 million; or the volume of outbound sensitive personal information reaches 10,000.
  
  The Beijing Negative List eases the above thresholds in most sectors, but the specific triggering threshold varies scenario by scenario. For instance, under the customer service scenario in the civil aviation sector, the thresholds are set out as follows:
  
  • Exemption to general CAC filings: The volume of outbound personal information (excluding sensitive personal information) is less than 500,000.
  • The CAC's Standard Contractual Clauses or the Personal Information protection Certification: The volume of outbound personal information (excluding sensitive personal information) reaches 500,000 but less than 5 million; or the volume of outbound sensitive personal information is less than 100,000.
  • The CAC's security assessment: The volume of outbound personal information (excluding sensitive personal information) reaches 5 million; or the volume of outbound sensitive personal information reaches 100,000.

“The identification rules of important data may vary by industry and by region”

"For applicable companies, the process of completing a Beijing Negative List filing could be as short as five working days"