Shanghai Lingang New Area Releases Whitelists for Data Export, Facilitating Cross-Border Data Flows

The Lingang New Area in Shanghai has introduced trial general data lists aimed at simplifying data export procedures for companies in the automotive, biopharmaceuticals, and mutual fund sectors. These lists outline specific scenarios where businesses can export data out of China with reduced regulatory burdens, bypassing more stringent compliance requirements.

The Lingang New Area of the Shanghai Pilot Free Trade Zone (FTZ) has released the first batch of trial lists of general data for three sectors, facilitating cross-border data flows for companies operating in the area. This announcement closely follows the release of the Tianjin FTZ’s Negative List, which similarly seeks to facilitate cross-border data flows for companies operating in the FTZ by specifying the types of data that are restricted from being exported without certain approval procedures.

The first batch of general data lists has been provided for the fields of intelligent connected vehicles, biopharmaceuticals, and mutual funds, three sectors with a significant presence in the Lingang New Area. The general data lists are scenario-based, meaning they outline various situations in which data export is required and freely permitted. These include scenarios, such as multinational production and manufacturing of intelligent connected vehicles, medical clinical trials and R&D, and information sharing for fund market research.

Find Business Support

Deploy ERP or localize your global system to ensure compliance with China's data regulations.

Companies that are required to export data out of China for any of the purposes in the general data lists will be permitted to do so without having to undergo any of the additional compliance procedures normally required. However, the export of personal information will remain subject to certain restrictions on volume.

The general data lists will be implemented for a trial period of one year from their date of implementation, May 16, 2024.

In January 2024, the Lingang New Area announced a new system for data management and export in the area, which included the release of two data catalogs, one for “important” data and one for “general” data. This new system will help facilitate cross-border data transfer (CBDT) for key sectors in the area by delineating the types of data that are restricted or subject to additional compliance measures to be exported (through the important data lists) and data that can be more easily exported (through the general data lists).

In March, the area released the Measures for the Classification and Graded Management of Data Cross-border Flow in the China (Shanghai) Pilot Free Trade Zone Lingang Special Area (Trial) (the “Lingang CBDT Management Measures”), which outlined the rules and requirements for this new system, including how companies can use the general data lists.

These developments follow many months of efforts by the central Chinese government as well as local authorities to improve the business environment for foreign companies in particular, a core part of which has been resolving headaches surrounding data export.

Applicability of the general data lists

The general data lists only apply to companies and other organizations that are registered in and engaged in CBDT in the Lingang New Area in one of the specified fields. Specifically, these include:

• Companies, public institutions, associations, and organizations involved in the research, production, and sales of pharmaceuticals, medical devices, diagnostic reagents, biological products, and related services.
• Publicly raised securities investment fund management companies.
• Companies, public institutions, associations, and organizations engaged in automotive manufacturing, parts and software supply, distribution, after-sales services, mobility, and related services, conducting cross-border data flow activities in the intelligent and connected vehicle sector.

However, it does not apply to critical information infrastructure operators (CIIOs) in the fields of biopharmaceuticals, intelligent and connected vehicles, or mutual funds.

Rules and requirements for exporting data through the general data lists

Companies in the Lingang New Area are required to adhere to the Lingang CBDT Management Measures, specifically the section on the management of the general data lists.

In order to be allowed to export the data included on the general data lists, companies must first apply to the Lingang New Area Management Committee for registration and filing of data in the general data list. The data approved can then flow freely provided that relevant management requirements are met.

Find Business Support

We can help you navigate complex regulations and local business norms to make informed investment decisions in Asia.

Note that if a company wishes to export personal information out of China,  it must adhere to the regulations of the Personal Information Protection Law (PIPL) and relevant implementation measures, notably the Regulations to Promote and Standardize Cross-Border Data Flows. This means that in order to export personal information freely, it must have provided the personal information (excluding sensitive personal information) of less than 100,000 people overseas since January 1 of the current year.

Companies that exceed this threshold will be required to undergo one of the three compliance procedures for personal information export.

Other specific obligations when providing personal information overseas include notifying individuals of cross-border activities, obtaining individual consent, and conducting personal information protection impact assessments.

Finally, the general data lists include a caveat that states that any data that may harm or affect national interests, including (but not limited to) national political, territorial, military, economic, cultural, social, technological, or nuclear interests, are not included in the general data list management. This means these types of data will require additional approvals to be exported, although these have not yet been clarified.

Specific rules for biopharmaceuticals

In addition to the general rules, the general data list for biopharmaceuticals stipulates that the provision or granting of access to human genetic resource information to foreign organizations, individuals, or institutions established or controlled by them must not harm public health, national security, or social public interests.

In addition, for any data involving human genetic resources in the general data list, data processors must report to and submit information backups to the competent health authority of the State Council in advance. If there is potential for impact on public health, national security, or social public interests, a security review organized by the competent health authority of the State Council is required.

Specific requirements for mutual funds

In the field of mutual funds, the general data list specifies that certain types of data are not included in the general data list. This includes any data that affects or endangers national economic order and financial security, as well as data primarily used by large or very large financial institutions and key business nodes in financial transactions, which are generally disclosed to specific personnel and accessed or used only by those who need to know.

Specific requirements for intelligent and connected vehicles

The general data list for intelligent and connected vehicles stipulates additional requirements for the handling of the data on the list:

• Video and image data in the general data list must not contain personal information such as faces or license plates.
• Vehicle VIN numbers transmitted across borders to data recipients must not be able to directly or indirectly identify individuals.
• Data in the general data list must not be transmitted directly from vehicles to overseas recipients.
• The general data list follows the principle of minimal necessity, meaning that only data that is strictly required for the specific scenario or activity is included.

Scenarios and data included in the general data lists

The three general data lists together cover 11 specific scenarios which are separated into 64 data types. The mutual funds list includes two scenarios and 11 data categories, the intelligent and connected vehicles list has four scenarios and 23 data types, and the pharmaceuticals list includes five scenarios and 30 data types.

Below is a sample of the scenarios and data types outlined in the general data lists.

Note that the Lingang New Area Management Committee is tasked with continuously updating the general data lists and informing the data processor of the updates. This means that the data lists may be expanded upon in the future.

Moreover, the data lists note that if a scenario-based “important data” catalog is released for a given sector, the general data list in that sector will automatically become invalid.

Potential impact of the data lists on businesses in the Lingang New Area

As is the case with the Tianjin FTZ negative list, the general data lists for the Lingang New Area are a helpful tool in that they clarify the types of data that companies are generally permitted to export without many administrative hurdles. In the absence of any such lists previously, it was difficult for companies to assess which data is considered “important” and therefore subject to stricter compliance requirements.

At the same time, the Lingang New Area’s mechanism for handling cross-border data flows is more restrictive than the Tianjin FTZ’s model, which outlines the types of data that cannot be exported freely, with the implication that any data not included on the list can be freely exported (with some limitations). This means more types of data are in effect whitelisted in the Tianjin FTZ model than the Lingang New Area model.

Related Reading

Shanghai’s Lingang New Area Launches First Cross-Border Data Service Center to Facilitate Data Export

Nonetheless, it is expected that the initial batch of general data lists will be expanded upon and that the overall environment for data export will thereby become less restrictive over time.

At the same time, companies that handle data that is included in the general data lists will still be required to apply to the Lingang New Area Management Committee and get approval for the specific data export scenarios, which means that there is still an administrative burden on companies, albeit smaller. Following approval, CBDT for the specified activities will be significantly easier.

Finally, the general data lists maintain the restrictions on the volume of personal information a company can export before triggering one of the three compliance procedures – undergoing a security review by the Cybersecurity Administration of China (CAC), signing a standard contract with the overseas recipient of the data, or undergoing data export security certification by a third-party agency. This means that as it currently stands, the regulations on personal information export in the Lingang New Area are not laxer than elsewhere in China.

Lingang New Area is home to a number of large multinationals that will be able to benefit from the new regulations and will have the ability to easily handle the administrative task of applying for data export approval. These include the likes of Tesla, BMW, Ford, and Novo Nordisk.

• Previous Article EU Chamber Business Confidence Survey: Key Findings and Takeaways
• Next Article US-China Relations in the Biden Era: A Timeline