Free Flow Of Data Research Articles

Regulatory Approaches of Cross-border Data Flow in the Big Data Era: China’s Choice

Cross-border data flow is characterized by multi-direction and rapid dynamic gridding in the big data era. Accordingly, these characteristics necessitate effective regulation for crossborder data flows. The US and the European Union (EU) follow their respective regulatory models for cross-border data flows by considering each one’s economic, political, and historical traditions. The “geographically based” policy of data flows, characterized as internal and external, is the basic position adopted by the EU on cross-border data flows. Although the US regulatory path favors (in principle) the free flow of data across borders, this country actually adopts data protectionism for data involving critical technologies and security areas. Given the political system differences among China, the EU, and the US, China can learn from the experiences of the US and the EU, actively seek value balance between data regulation and free flow, construct its own regulatory model, and establish a diversified data management system. Lastly, China should also actively participate in the international regulation competition on cross-border data flows, thereby giving the country a voice in the international arena.

Digital Economy Barriers to Trade Regulation Status, Challenges, and China's Response

At present, the WTO's multilateral trading system faces the acute challenge of adapting to the digital and commercial economies' rapid evolution. The recent regional trade agreements embody the corresponding achievements of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), Economic Partnership Agreement (EPA), and the United States Mexico Canada Agreement (USMCA) in facilitating the free flow of data and regulating digital barriers to trade. The General Data Protection Regulation (GDPR) has also developed several new norms for promoting free data flow and protecting personal data privacy. The new regional trade agreements fulfil the digital trade threshold, prohibit delocalization by the data center and establish organized frameworks for cross-border data flow and personal privacy protection. In the negotiations on trade services agreements, China should focus on implementing a new management structure, speeding up domestic legislation and legislative reforms, and establishing a legal framework that promotes the free flow of data, fair competition, and personal information among corporations.

Restoring trust into the NHS: promoting data protection as an ‘architecture of custody’ for the sharing of data in direct care

Abstract Aiming to provide better, more personalized care, by harnessing the power of digitalization, the National Health Service (NHS) has employed a strategy of sharing its patients’ information with the private sector, raising questions as to whether it can be trusted as a custodian of its patients’ data. The development of the Streams application by DeepMind, a subsidiary of Google Health UK, illustrates the dichotomy between, on the one hand, the need to use innovative technologies to provide effective direct care and, on the other hand, the obligation to protect patients’ rights and interests in their health data. This article focuses on an under-explored aspect of the Streams debate: the NHS’s processing of health data in direct care. It argues that the data protection framework is best viewed as an architecture of custody, where all participants in the framework have a custodial role to play and should collaborate to ensure the balance between the free flow of data and the data subjects’ rights and interests.

Digital Trade Issues in WTO Jurisprudence and the USMCA

ABSTRACT The USMCA is a landmark trade agreement for the digital ecosystem that will create a strong foundation for the expansion of trade, investment, and innovation. The USMCA sets a new global high standard protecting the free flow of data beyond what is covered in the WTO. The USMCA along with WTO standards help in harnessing digital trade for prosperity by enabling free access, a secure market, and low barriers to growth. However, the USMCA is likely to become the model for future free trade agreements between the U.S. and other countries.

Effects of data localization on digital trade: An agent-based modeling approach

Post the Snowden and Cambridge Analytica episodes, concerns have been raised by governments and regulators on protecting consumer data collected and transmitted by various digital firms. Driven by concerns of privacy, national security, surveillance, and cyber terrorism, governments around the world have been erecting barriers in cyberspace through data localization. The extent of data localization varies from free flow of data, to stringent restrictions requiring all data to be stored only within the territorial jurisdiction of the country. Though there are certain legitimate concerns regarding protection of personal data, scholars and liberal economists have long proclaimed that any restrictions on the Internet and associated digital trade will have serious economic consequences. Data localization affects digital trade between consumers and producers of digital services to varying degrees. In this paper, we use agent based modeling to study the properties and behaviours of consumers and producers under varying data localization regimes. An augmented gravity model of trade with iceberg coefficient is incorporated to reflect distance-related costs between producers and consumers. Varying data localization compliance costs are included to reflect the effect of non-tariff barriers of data restrictions. Our extensive simulations indicate that there is often clustering of consumers around local firms in highly restrictive data localization regimes, thus enabling local firms to effectively compete against global multinationals. However, results also indicate that while free cross-border data flow enables intense competition amongst producers, data localization restrictions often limit consumer choice due to its effect on price and quality of services.

Fueling the European Digital Economy: A Regulatory Assessment of B2B Data Sharing

Data sharing activities among private players are an important drive for digitaldriven innovation, but they are still rare in the European Union. In its general effort to promote a European data economy, the Commission developed a policy aimed at incentivizing B2B data sharing. The article intends to unpack this policy and to verify whether its corresponding framework effectively enables B2B data sharing. To address this issue, the article identifies and discusses those factors that favor or hinder B2B data sharing practices in the European Union, including current practices, guidelines and regulation (or lack thereof). To complete the analysis, the article also investigates the conditions under which competition law can affect B2B data sharing. Finally, the author weighs all the issues and factors that have been raised, and discusses the measures to be adopted in order to properly incentivize B2B data sharing. Data sharing, B2B, EU data economy, digital single market, free flow of data, data access, GDPR, Regulation 2018/1807, portability, interoperability

Pitching trade against privacy: reconciling EU governance of personal data flows with external trade

Key Points: * Global data flows underpinning cross-border digital trade have moved centre stage in international trade negotiations. New trade law disciplines on the free flow of data are included in a number of international trade deals. * The European Union (EU) has a key role to play in the global governance of the protection of personal data. The EU’s strict data protection regime has sometimes been framed as a digital trade barrier. * This article juxtaposes the EU’s governance of fundamental rights to privacy and data protection with external trade policy on cross-border data flows. * The process of aligning EU’s normative approach to personal data protection with its external trade policy has been, until very recently, riddled with contradictions. * The article concludes with an assessment of the EU’s recent horizontal strategy on cross-border data flows and personal data protection in trade and investment agreements, which aims to align EU external policy.

Efficient key Management System using Channel Response in Wireless Sensor Network

There are challenges abound for key management in wireless sensor networks. The importance of key management gets highlighted when the network gets scaled up without the availability of enough resources and new kind of threats in the form of node capture emerge. The economic viability of such schemes are usually high as the increase in security is directly proportional to the computational complexity, thus attributing to the high cost. In the wireless sensor infrastructure, nodes get connected with each other in wireless medium and can enter and exit the network at their will. Such aspect of entering and exiting paves the way for malicious nodes too to enter in to the network, making the entire network vulnerable to several types of attacks. One of the prominent attack is network jamming where the transmission lines gets jammed blocking the free flow of data as well as corrupting it. Such attacks on node and data transmissions can be avoided by increasing the security afforded to the entire WSN. In this regard, a novel key generation algorithm has been proposed in this paper using channel response technique, where the data hops from one channel to another in its transit from the source node to the destination node securing it from attacks. The Leap and Stop algorithm has been applied for channel hopping thus ensuring that the data traverses only for a small duration in each channel before hopping to the other channel. The channel hopping technique minimizes the probability of attack since before an active channel could be successfully predicted by the attacker, it becomes inactive and another channel gets activated. This channel hopping process continues till data reaches the destination safely without getting corrupted. The proposed approach had been compared for its efficiency and performance with Secure Key Generation using Frequency Selective Channels (SKGFSC) protocol and the results had been shown therewith.

Prospect patents, data markets, and the commons in data-driven medicine: Openness and the political economy of intellectual property rights

Abstract Scholars who point to political influences and the regulatory function of patent courts in the USA have long questioned the courts’ subjective interpretation of what ‘things’ can be claimed as inventions. The present article sheds light on a different but related facet: the role of the courts in regulating knowledge production. I argue that the recent cases decided by the US Supreme Court and the Federal Circuit, which made diagnostics and software very difficult to patent and which attracted criticism for a wealth of different reasons, are fine case studies of the current debate over the proper role of the state in regulating the marketplace and knowledge production in the emerging information economy. The article explains that these patents are prospect patents that may be used by a monopolist to collect data that everybody else needs in order to compete effectively. As such, they raise familiar concerns about failure of coordination emerging as a result of a monopolist controlling a resource such as datasets that others need and cannot replicate. In effect, the courts regulated the market, primarily focusing on ensuring the free flow of data in the emerging marketplace very much in the spirit of the ‘free the data’ language in various policy initiatives, yet at the same time with an eye to boost downstream innovation. In doing so, these decisions essentially endorse practices of personal information processing which constitute a new type of public domain: a source of raw materials which are there for the taking and which have become most important inputs to commercial activity. From this vantage point of view, the legal interpretation of the private and the shared legitimizes a model of data extraction from individuals, the raw material of information capitalism, that will fuel the next generation of data-intensive therapeutics in the field of data-driven medicine.

Regulating the Dynamic Concept of Non-Personal Data in the EU:

The article explores the dynamic concept of non-personal data and the regulatory approaches within the EU legal framework. De lege lata, this article critically assesses the issues arising from Regulation (EU) 2018/1807 on the framework on the free flow of non-personal data, focusing on the definition of non-personal data and the data porting principle. While the legislator’s shift from ownership to control is endorsed, the relevance of a framework targeting solely non-personal data is questioned in light of data protection concerns. De lege ferenda, this article submits that a comprehensive approach should broadly consider overcoming binary data categorisations. For the purposes of the FFD Regulation’s evaluation, evidence-based reflections are suggested. Keywords: non-personal data; free flow of data; GDPR; data portability; data ownership

Restoring Trust into the NHS: Promoting Data Protection as an ‘Architecture of Custody’ for the Sharing of Data in Direct Care

Aiming to provide better, more personalised care, by harnessing the power of digitalisation, the National Health Service (NHS) has employed a strategy of sharing its patients’ information with the private sector, raising questions as to whether it can be trusted as a custodian of its patients’ data. The development of the Streams application by DeepMind, a subsidiary of Google Health UK, illustrates the dichotomy between, on the one hand, the need to use innovative technologies to provide effective direct care and, on the other hand, the obligation to protect patients’ rights and interests in their health data. This paper focuses on an under-explored aspect of the Streams debate: the NHS’s processing of health data in direct care. It argues that the data protection framework is best viewed as an architecture of custody, where all participants in the framework have a custodial role to play and should collaborate to ensure the balance between the free flow of data and the data subjects’ rights and interests. This paper has been written in collaboration with Dr Subhajit Basu (University of Leeds, UK).

Economic Rights Over Data: A Framework for Community Data Ownership

With digitalization increasingly pervading every aspect of the economy, data rights cannot be seen solely as about privacy or otherwise just in an individualistic framework. Valuable data is often aggregated, group or anonymized data, and thus we make a case for collective rights over the economic resource of data. The article proposes a framework for community data ownership as being necessary for economic justice. It means that a national community, city, village or neighbourhood community, as well as communities/groups of workers, traders and producers, collectively have primary economic rights over the data that they contribute to different digital platforms. Unless such new alternative frameworks are developed, the proliferation of free trade agreements as well as efforts at a WTO plurilateral on e-commerce—with their ‘global free flow of data’ doctrine—will lock the default of de facto data ownership rights being solely that of the collectors of data.

EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray?

This paper addresses data flows between the EU and the UK, focusing on the economic sphere. Data flows freely between the EU and the UK, and it has done since the emergence of the modern internet and digital economy. The free flow of data within the EU is enabled by harmonised data protection rules and common systems of regulatory enforcement. EU Member States also have shared arrangements for data flows with non-EU (i.e. third) countries. 75% of the UK’s international data flows are with the EU, and much UK economic activity is dependent on these flows. No-deal means no adequacy decision and significant disruption to EU-UK data flows. This would place immense compliance burdens on individual organisations, which would have to invest in legal and administrative fees to ensure EU-UK data transfers remained lawful. Increasing the cost of business slows the growth of many organisations and undermines innovation. Over the long term, it could also lead to the UK being less attractive to investors and thus generate negative knock-on effects for the UK economy. There has been intense political focus on the issue of trade in goods, particularly as regard the border with Ireland. By comparison, issues relating to data flows and trade in services more broadly have been neglected. Yet they may be as important for the economy, especially in future. This paper is based on over fifty interviews with EU and UK policymakers, regulators, lawyers, business leaders and analysts. It outlines the EU’s legal and policy approach to data protection, giving an overview of the GDPR and the EU data governance framework. It then gives an overview of EU-third country data relationships, including the EEA, adequacy decisions, partial adequacy and countries with no formal arrangement. Finally, it places the post-Brexit UK in this context, assessing whether or not the UK is likely to get an EU adequacy decision, and what it means for the economy if it does not. This paper asks: - What are EU-UK data flows and why are they important? - How does data flow between the EU and third countries? - Will the UK get an adequacy decision? - What does no-deal mean for data flows?

Towards a Robust Architecture for the Regulation of Data and Digital Trade

The digital transformation occurring worldwide poses significant challenges for a governance framework that evolved gradually and incrementally over centuries, shaped by lessons learned during the long era of industrialization and globalization in which much of today’s technology was still science fiction. At the heart of the governance challenge is “datafication” — the capture of truly astronomical amounts of information on the functioning of societies, economies and even the industrial processes of firms. Once transformed into data, information can be analyzed and used to modify the behaviours that generated the information in the first place for economic, political or geopolitical advantage. Given the multiple roles that data plays — as the medium of digital commercial transactions and digital trade, as a valuable capital asset, as part of the intangible infrastructure of the digital economy, and as the very fabric of a modern information society — the governance challenge is immense. Moreover, given the multitude and pervasiveness of data analytics applications, there is urgency in coming to grips with the regulation of data, since other governance challenges, ranging from climate change to income distribution, depend on safeguarding democratic processes and functional markets. Numerous efforts are under way to address aspects of the regulation of data. These efforts include the recently launched e-commerce negotiations of the World Trade Organization (WTO), other work programs under the WTO, and the initiatives of the Group of Twenty (G20) on the free flow of data based on trust. There is as well work in more specialized areas, such as competition policy and intellectual property (IP), taxation in the digital realm, and multi-stakeholder processes addressing the plethora of other digital governance issues ranging from privacy to cyber security. This paper suggests a conceptual framework for addressing the multi-dimensional policy dilemma that societies now face of reconciling the many competing policy priorities raised by digital transformation domestically and of preparing the ground for negotiations toward a robust and broadly acceptable governance regime internationally, fit for purpose for the age of data.

The Feasibility of the Right to Data Portability in GDPR and Its Application Prospects in China and South Korea

최근 인터넷과 새로운 IT기술의 급격한 발전으로 인해 사이버 공간에서는 미증유의 상황을 맞게 되었다. 이에 부응하여 유럽연합(EU)에서는 지난 2018년 5월 25일 “개인정보보호규정(GDPR, General Data Protection Regulations)”을 제정･시행하게 되었다. 이 개인정보보호규정(GDPR)은 데이터의 자유로운 유통을 증진하고 개인정보의 통제가능성을 높이는데 그 입법취지가 있다. ‘데이터 유통가능성’은 첫째는 개인정보를 수용하는 것이고, 둘째로는 개인정보를 전송하는 두 가지의 개념을 포함한다. 우선, “정보이동권”의 대상인 “데이터” 자체는 개인 특성, 명예 및 개인 정보를 포함하므로 개인적 특성 을 가리키는 개념이다. GDPR에 의하면 ‘정보이동권’이란 정보주체의 동의나 계약에 의하여 개인정보를 수집･보관하는 정보처리자에 대하여 정보주체가 그에 관한 정보를 보내주거나 다른 정보처리자에게 직접 전송할 것을 요구하는 것을 말한다. 정보이동권은 특별히 정보의 법적 원천과 정보의 물적 관련성, 기술적 실행가능성과 아울러 능력행사의 무해성 등에 관한 보완절차에 대한 내용도 포함되어 있다. 현재 EU국가는 물론이고 다른 국가들에서도 당해 국가들이 이러한 법제 시스템을 적용할 수 있는지, 그리고 어떠한 방식으로 적용할 수 있는지에 대해 적극적으로 연구하고 있다. 유럽에서는 구글. 페이스북, 애플, 아마존 등 미국의 IT기업들이 플랫폼을 장악하고 정보의 유통시장을 지배하는 것에 대한 경계심이 고조되었다. 그 결과 정보이동권 규정은 이러한 미국 IT기업들이 장악하고 있는 정보의 유통시장을 되찾으려고 하는 의도로 제정된 것으로 보인다. 중국과 한국에서는 이러한 시스템이 비록 그대로 도입하는 데에는 적정하지 않다 하더라도 전화번호 전환시스템 등과 같은 분야에서는 적용될 여지가 있다. 향후 이러한 법제시스템이 국내에 도입된다면 정보유통 분야에서 효율성이 극대화될 것으로 기대한다.In recent years, with the rapid development of new generation information technologies(IT) on a global scale, the development of cyberspace has risen to an unprecedented stage. The European Union introduced the “right to data portability” system in the “General Data Protection Regulations”, which came into effect on May 25, 2018. Aiming at enhancing the individuals control of data and promoting the free flow of data, the right to data portability itself involves largely two perceptions: right to receive personal data and right to transmit personal data. First of all, the “data” itself, as the object of “right to data portability”, implicates personal characteristics, honors and privacy, which makes it possible to say that it possesses personality attributes . When it comes to the implementation process, this right specifically involves the legal source of data, the subject relevance of data, technical feasibility and the harmlessness of power exercise. At the same time, although this right has been sought after in the introduction process, it has also caused doubts from all parties, especially its rationality and feasibility is still mired in great controversy. In Europe US IT companies, such as Google, Facebook, Apple and Amazon have become increasingly vigilant about dominating the platform and dominating the information distribution market. As a result, it seems that the rules on the information movement have been designed to regain the distribution market of information that these US IT companies have dominated. Moreover, in addition to the EU region, other countries are actively exploring whether they can and how to refer to this system. All in all, the application prospect of this data migration right remains to be seen. As far as China and South Korea are concerned, in spite that this system is not suitable for indiscriminate introduction, it can still be applied in appropriate areas, such as the above mentioned telephone number transfer system. As long as the system can be localized, its effectiveness is likely to get maximized.

China's new regulatory regime tailored for the sharing economy: The case of Uber under Chinese local government regulation in comparison to the EU, US, and the UK

Although Uber's arrival in China has resulted in disruptive competition for incumbent taxi companies, it offers an attractive alternative in China's supply-demand-imbalanced urban passenger transport system. China's regulatory regime for Uber has evolved in three stages: from the regulatory vacuum prior to 2015 to its official legalization in 2015–2016, and the enactment of numerous local regulations in 2016, with specific and more demanding requirements for Uber. This policy is a part of the Chinese approach to the gradual liberalization of the urban passenger transport market. Policymakers should consider ‘fair competition’ as the guiding principle to balance the interests of sharing firms and incumbent service providers, as well as between different sharing firms. The core value of this principle lies in the benefits it provides for consumers and the way it engenders a pro-competitive market environment. The labor protection arrangements for sharing firms’ laborers should be more flexible and diversified. In order to recognize whether an Uber-Driver is an employee or independent contractor, a new standard taking into account a range of factors should be established through collective negotiations between the participants of the sharing economy, and dialogues between members of the judiciary, academics, and the policymakers. Further, consumer protection law and personal data protection provisions should apply when sharing firms misuse their distinctive algorithmic management model to compete unfairly to the detriment of consumers and other users. Ex ante regulatory measures designed to protect the personal data of users should be introduced for deployment in the context of the sharing economy. When enforcing these rules, a balance should be struck ensuring free data flow that is essential to sharing firms’ innovation and competition, and the need to ensure the level of data security required to underpin a well-functioning sharing society.

International Data Flows and Privacy: The Conflict and Its Resolution

The free flow of data across borders underpins today's globalized economy. But the flow of personal data outside the jurisdiction of national regulators also raises concerns about the protection of privacy. Addressing these legitimate concerns without undermining international integration is a challenge. This paper describes and assesses three types of responses to this challenge: unilateral development of national or regional regulation, such as the European Union's Data Protection Directive and forthcoming General Data Protection Regulation; international negotiation of trade disciplines, most recently in the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP); and international cooperation involving regulators, most significantly in the EU-U.S. Privacy Shield Agreement. The paper argues that unilateral restrictions on data flows are costly and can hurt exports, especially of data-processing and other data-based services; international trade rules that limit only the importers' freedom to regulate cannot address the challenge posed by privacy; and regulatory cooperation that aims at harmonization and mutual recognition is not likely to succeed, given the desirable divergence in national privacy regulation. The way forward is to design trade rules (as the CPTPP seeks to do) that reflect the bargain central to successful international cooperation (as in the EU-US Privacy Shield): regulators in data destination countries would assume legal obligations to protect the privacy of foreign citizens in return for obligations on data source countries not to restrict the flow of data. Existing multilateral rules can help ensure that any such arrangements do not discriminate against and are open to participation by other countries.

DIGITAL BORDER CONTROLS

The article examines to what extent territory plays a role in internet regulation, especially whether an equivalent to physical border controls for cyberspace already exists in Germany, i.e. digital border controls. To that end, both the abstract relevance of the territorial principle and specific examples of legal commands that cause the free flow of data to be interrupted or modified along state boundaries are scrutinized.

Innovation, Variety & Fair Choice – New Rules for the Digital Economy: Expert Opinion for Finanzplatz München Initiative (FPMI)

(1) The digitization has unleashed enormous potential, reduced transaction costs, enhanced consumer welfare and inspired a new entrepreneurial culture. New technologies and business models lead to a far-reaching modernization of business. (2) Notwithstanding the dynamics of digitization, the economy is at a turning point: Its fundamental infrastructure is being transformed. Some platforms turn into gatekeepers of the market places of the digital economy. Due to network effects, economies of scale and superior access to data, the success of such platforms becomes self-reinforcing. In a plat-form economy competition is for the market – not on the market. Markets may be “tipped” and are organised and governed by one or two platforms only. (3) In such markets, “the winner takes it all”. The platform operator determines the success of suppliers and customers and steers the coordination of supply and demand according to its own parameters. This has elements of a centrally planned economy and suppresses the discoveries of a free market economy when customers and/or suppliers are dependent upon the platform. The prerequisites of innovation – different paths, diversity, capacities for openness – may no longer be given. (4) Real providers of goods and services may become dependent from suppliers of auxiliary services (the match-making platforms). They battle for access to the platform and for the best conditions with the platform operator, but no longer for the customer directly. The direct customer-supplier-interface gets lost. Competition is pushed to the periphery. That is a strange distortion of the functioning of markets. (5) Consumers may benefit from reduced transaction costs first, but soon may be caught in closed systems where consumer choice is reduced. When switching costs are high and multi-homing is not possible, consumers are bound to one platform and may be subject to manipulation of choices and conditions by the platform operator without transparency. Consumers take fewer decisions themselves and take these decisions on a less informed basis. (6) The platform economy works with data, algorithms and machine-learning. Markets are more and more integrated and connected. The use of data and the delegation of decisions to machines may create barriers to entry and technological lock-in effects. (7) Regulatory responses to the platform economy need to protect variety, innovation and fair choice for consumers. This requires an approach that ensures that markets remain able to perform their function in selecting winners and losers in a dynamic competitive race. Whilst regulation and enforcement need to be cautious with a view to potential “chilling effects”, it is also necessary to act quicker, more hands-on and more technology-sensitive than so far. (8) The EU needs to develop a framework for the governance of platforms. Such a frame-work needs to distinguish between open platforms, proprietary systems and gate-keeping platforms. The framework needs to provide rules for neutrality and interoperability, transparency and liability. (9) Competition law enforcement needs to take centre stage in the governance of the digital economy. Artificially narrow market definitions should be replaced by an improved look at the integration of markets. The focus should shift to innovation barriers and technological lock-in effects. Jurisdiction for merger control needs to be reformed so as to encompass shootout acquisitions of innovative rival firms that challenge the market power of platforms. The 2017-amendments of the German Act against Restraints of Competition are a good starting point for reforms. (10) Consumer awareness in the digital economy needs to be strengthened. In particular, awareness for the non-neutrality of search results and for the use of data, algorithms and machine-learning could be enhanced or fostered through transparency requirements. (11) The free flow of data is a prerequisite for innovation and variety in the digital economy. Interoperability and open standards need to be supported. An exclusive data right would be counterproductive at present and would create artificial barriers for innovation. Instead it is necessary to design a framework for access to essential data. Such a framework should ensure data portability (also for machine-generated rights) and establish a speedy ombudsman-system for granting access and determining remuneration. It may be necessary to provide for sector-specific rules, e.g. default rules for data sharing contracts and sector-specific disclosure rules (e.g. for automated driving).

Assessing China's Cybersecurity Law

In November 2016, China passed its first Cybersecurity Law, aiming to strengthen cyberspace governance through a number of initiatives, including Internet operator security protection, personal information protection, special protection of critical information infrastructure, local storage of data, and security evaluation for data export. This Article discusses the major concepts and principles of the Cybersecurity Law. It also discusses the tensions and controversies inherent in the law. All in all, the Cybersecurity Law exhibits distinctive Chinese characteristics. It is premised on the concept of cyberspace sovereignty and emphasizes security over free flow of data and freedom of speech. It provides a basic legal framework for cyberspace governance in China, to be supplemented by implementing regulations in years to come.