Cybersecurity

Beijing promotes free flow of ordinary data for foreign-invested enterprises

China proposes to allow businesses to transfer certain types of data overseas without restrictions; IBM's former IT services arm Kyndryl plans to split its China business over data security rules and tech restrictions; and Shenzhen's government introduces initiatives to raise funding for local tech companies amidst U.S. tech restrictions

Practice guidelines are issued specifying labeling of AI content

Processing of sensitive personal information may require written consent of the individual

China's cybersecurity laws are heavily enforced for businesses of all sizes; Chinese Gotion receives CFIUS approval to build an EV battery facility in Illinois; and Former SEC Chair proposes large public companies disclose their exposure to China

Guidelines are given for informing individuals of automated decision processing of their personal information

Lawfulness of personal information processing is the focus of an compliance audit.

China meets executives of international firms in order to reassure them over data security regulations; CSRC seeks regulatory opinion for the frist time for overseas listing; and Chinese automobile parts included in U.S. import detention over Xinjiang concerns

New draft measures on personal information protection compliance audits have been released for public comment. Jianwei (Jerry) Fang and Chuchen (Julie) Hou of Zhong Lun Law Firm analyze the legislative basis and specific requirements of the new draft, and provide some practical recommendations for PI processors who are planning for an upcoming compliance audit.