Global Data Compliance Shall Get More Attention for Companies Going Global
On December 2021, 2021 Global Data Compliance and Privacy Technology Development Report was released by Ernst & Young Consulting, a comprehensive review of data compliance, especially data privacy compliance systems development in different countries. Based on the interpretation of this report, Associer has picked out key points related to cross-border activities.
1. Data flows across borders raise compliance concerns
According to the Ernst & Young report, driven by the global digital economy, cross-border data flow is becoming more frequent. Cross-border data inevitably includes important data such as personal information, key operation data and national information data. As data is stored, circulated, and used across borders on a larger scale, data types are more diverse, and cross-border data is more frequent, resulting in increasingly severe security risks.
Besides, as global cross-border governance framework has not yet formed a unified alignment, data cross-border flows related concept definition, standard definition still exist differences in different countries, such as some countries support multinational transmission, data processing and storage, some countries to support data needs to be stored in the home country, but open for outside to visit. However, cross-border data is often limited by the protection level of the local storage, which may lead to data leakage risks. In addition, there are differences and even conflicts in relevant data compliance policies and laws in different countries and regions, and there may be ambiguity in the use authority of cross-border data, which further highlights cross-border data compliance risks.
In addition, once cross-border data is leaked, the scope of influence is more extensive, and it is often linked to the dark web/underground market data transaction, malicious elements will be stolen data and personal information packaged for sale, enterprises are difficult to trace and respond to disposal. The security risks brought by cross-border data flow are a major challenge for overseas enterprises. It is urgent to strengthen the construction of key technical means of data protection and realize security measures to effectively detect and respond to illegal cross-border flow of sensitive data.
At present, countries around the world have taken measures to deal with cross-border Data. For example, the United States has issued Clarifying Lawful Use of Overseas Data Act to provide jurisdiction basis for it to take extraterritorial Data. Essentially, it is trying to pass domestic legislation. In terms of data sovereignty to make the hyper-geographical expansion. Some countries can strengthen local data governance by enforcing compliance restrictions on the cross-border flow of data and adopting local storage or processing measures to protect personal data from foreign surveillance and access.
As global data risks and challenges emerge in endlessly, with the complexity of data scenarios and the diversification of data participants, it has become the main focus of all countries to improve and perfect the legal system and regulatory rules of data security. This is what companies going for global need to focus on when designing global compliance system and adapting to local compliance strategies of overseas countries.
2. Data security legislation and compliance supervision status in different countries
On a global scale, the EU's data security measures are comprehensive and stringent. It has established a relatively mature system and framework on data security and personal information protection, which has an important reference for promoting the development process of global data security.
On 14 April 2016, the European Parliament adopted the General Data Protection Regulation (GDPR), which will enter into force in eu member states on 25 May 2018. At the strategic level, based on the Strategic Plan of the European Data Protection Authority (2020-2024), it emphasizes the continuous strengthening of data security protection from three aspects of foresight, action and coordination, and reiterates the importance and inevitability of guaranteeing users' basic rights to personal privacy. At the legal level, GDPR and the Regulations on the Free Movement of Non-personal Data constitute a key legislative system in the field of data security. The Electronic Privacy Regulation is a special law to refine and supplement the GDPR in the field of electronic communication, and the two regulations maintain a certain consistency. The electronic evidence Regulations focus on technology companies providing data assistance to government departments while ensuring data security. At the standard guidance level, the 2020 Supplementary Measures for the Instrument for The Transfer of Data across Borders to Maintain the level of protection of Personal Data in the European Union provides further guidance on data protection issues in cross-border data flows.
Judging from the EU's enforcement actions under the GDPR, transparency remains a key concern for data protection efforts in Europe. The standardization and elaboration of regulatory authority and law enforcement procedures not only helps regulatory discretion, but also contributes to law enforcement transparency and social demonstration effect. That is a big reason why the EU's regulation is so efficient despite its tough penalties.
As the EU has formed a strict and perfect strategy and regulatory system on data security and personal information protection, overseas enterprises of eu member states and other countries are faced with great data compliance challenges in the EU region, and they need to read and study various laws and regulations closely.
The United States is the first country in the world to enact laws on information protection, starting to implement the Freedom of Information Act on July 6, 1967. In the process of more than 50 years of legislation related to data security, the United States divides data protection into "data privacy protection" including collection and use of personal data, and "data security protection" including protection of unauthorized access and use of personal data. In general, the data security legal system in the United States has been established for a long time, with complex historical background and scattered laws. Although the provisions on data protection are more detailed, most of them lack integrity and core guidance for specific industries or specific data. In the future, the FEDERAL government of the United States may make deeper and more extensive exploration on the extension of the scope of personal information, the confirmation and protection of property, and form a unified and more extensive federal data security act to improve its data legislation system.
In 1974, the United States implemented the Privacy Act, which made more detailed provisions on how government agencies should collect personal information, how the collected personal information should be opened to the public and the rights of information subjects. At the same time, a number of us states have revised their personal information protection laws to further expand the definition of "personal information" and supplement the details of their data security laws by referring to the PROVISIONS of the GDPR or improving the handling of data breaches.
California, for example, has officially implemented the California Consumer Privacy Act (CCPA) since January 1, 2020. The law, which has been called the "toughest and most comprehensive personal privacy protection act" in the country, applies not only to California businesses but to all businesses doing business in the state. Some enterprises, especially multinational enterprises, are under the dual supervision of GDPR and CCPA. On September 8, 2021, the California State Senate passed the Genetic Information Privacy Act, which requires companies that collect consumers' personal information to inform consumers of the types of personal information to be collected and the purposes for which the information will be used at the time of collection or before collection, and grants consumers the right to opt out of selling personal information to third parties.
The United States has not only issued a wealth of state acts to protect data security, but also passed data security legislation to provide the basis for its law enforcement agencies to exercise extraterritorial jurisdiction over data. The Clarifying Lawful Overseas Use of Data Act, which was formally signed in 2018, stipulates that relevant evidence can be collected in accordance with the Act for crimes and serious criminal crimes that endanger THE NATIONAL security of the United States. This means that US law enforcement agencies can require a multinational company to transfer data stored on servers in other countries related to an investigation or case to US law enforcement agencies if they believe there may be a threat to US national security. In the context of increasing demand for cross-border access to law enforcement data, the act extends US enforcement to the world and establishes a us-centric regulatory framework for cross-border access to data. This trend means that overseas companies need to further study and analyze data security laws and regulations in multiple countries and plan and deploy data storage sites to reduce compliance conflicts.
In terms of regulation, under the influence of the legislative system, regulatory agencies in the United States are also divided into federal agencies and state regulatory agencies. As a result, companies face not only federal regulatory enforcement, but also different laws in each of the 50 states.
In addition to China, the United States and Europe, most countries in the world have stepped up the deployment of data security strategies and carried out strict regulation on data compliance and privacy protection. Some countries in the Middle East and Latin America, which lag behind in cyber security, are also embracing data security and introducing regulatory measures. For example, the UK has adopted the Data Protection Draft to strengthen personal data protection and law enforcement. The Indian government issued the Personal Data Protection Act (PDP), which sets out broader requirements for data localization; Thailand's Parliament deliberated and passed the Personal Data Protection Act (PDPA). Singapore issued the Guidelines on Data Protection Management Procedures, Guidelines on Data Protection Impact Assessment and draft Personal Data Protection Law (Revised). Brazil issued the General Data Protection Law, which covers and emphasizes the effect of extraterritorial jurisdiction; Japan passed amendments to the Law on the Protection of Personal Information; Other countries also show great enthusiasm and government participation in data governance, and continue to improve legislation and supervision systems at the national level. Although there are differences in the progress and methods of legislation and supervision in various countries, the trend of data security legislation is obvious around the world.
3. The Path and focus of data compliance supervision
At present, data security supervision in various countries mainly shows the following key points:
First, big multinational tech companies are easier targets for regulation. On the one hand, the data collected, stored and processed by large multinational technology companies based on business needs are generally higher than that of ordinary companies in terms of data volume and importance, with higher data value and potential risks. For example, in recent years, some large multinational technology companies have faced numerous problems such as privacy infringement, data abuse and data leakage, making stricter supervision imperative. On the other hand, data security should not only be led by the regulatory authorities, but also require the society, enterprises and the masses to play a role together. Large multinational technology companies, with their higher social influence, can use their platform advantages to play the role of the industry and promote the construction of a better data security environment. Therefore, taking multinational Internet giants as the key object of data protection supervision is not only conducive to massive data protection, but also has more demonstration and early warning effects in law enforcement.
Second, security review has become an important measure for strong supervision of data security in key areas. Network security reviews are generally conducted to review and supervise information technology products and services used in information systems that are related to national security and social stability. At present, many countries have set up censorship systems, and the scope of censorship is further expanding as the security situation changes. In the United States, for example, its cybersecurity review covers foreign investment, critical infrastructure protection, supply chain security management, and so on. At present, the global cybersecurity review is more focused on key areas and the information technology industry. It is worth noting that the state regards security review as one of the important regulatory means to achieve the ultimate goal of data security, but considering that there may be competition or conflict of laws and regulations in the network security review systems and systems of different countries, enterprises need to conduct pre-self-examination and self-examination.
Third, cross-border data flows have been included in the scope of key regulations, and the trend of data localization has become more and more prominent on a global scale, especially in developing countries. Operators of critical information infrastructure, large multinationals or businesses doing business overseas need to focus on local legal provisions around "cross-border data transfer", "localized data storage" and "data privacy protection". At present, the governance and supervision of cross-border data flows have not yet formed a global regulatory system, but some countries have issued corresponding laws and regulations. Taking China's newly released "Data Export Security Assessment Procedures (Draft for Solicitation of Comments)" as an example, unless otherwise provided by laws and administrative regulations, data processors providing important data collected and generated in the course of operations within the territory of the People's Republic of China and personal information that should be subject to security assessment in accordance with law shall conduct a security assessment in accordance with the provisions of the Measures.
At present, the focus of cross-border data supervision is mainly in the following aspects:
Whether the purpose of cross-border data transfer is legitimate and reasonable, such as data transfer to meet the necessary business development needs, or to meet the needs of overseas regulatory filing;
the scope and type of data transmitted and the purposes and methods of processing of the data by the foreign recipient;
In order to demonstrate security, the relevant data processors should carry out a self-assessment of the risk of data export before providing data to overseas.
Conclusion
With the popularization of the concept of "meta-universe", blockchain technology, 5G, and 6G construction, the frequency and complexity of cross-border data exchanges will increase exponentially, and the degree of perfection and supervision of legislation in various countries will be strengthened. Companies going for global should pay more attention to data compliance when laying out overseas business strategies. With the improvement of data security and privacy protection regulations around the world, the global privacy environment is undergoing a transformation. Companies going global must comply with a series of new compliance requirements, and the increasingly complex cyberspace and severe threat environment put forward higher requirements for personal information protection, under the dual pressure of data security and data compliance, along with the breakthrough progress in the research and development and application of cloud computing, big data, blockchain, supercomputing and other fields, based on new technical means to provide reliable solutions for data compliance and privacy protection has begun to become a new direction for all walks of life to explore.
