By MLex Staff ( February 11, 2025, 05:47 GMT | Insight) -- Data handlers in key industries within Shanghai’s pilot free-trade zone are preparing for relaxed controls on outbound personal-data transfers, after local regulators introduced a "negative list" regime as part of efforts to stabilize foreign investment.
Data handlers in key industries within Shanghai’s pilot free-trade zone are preparing for relaxed controls on outbound personal-data transfers, after local regulators introduced a "negative list" regime as part of efforts to stabilize foreign investment. The recently announced management measures apply to the China (Shanghai) Pilot Free Trade Zone and the China (Shanghai) Pilot Free Trade Zone Lin-Gang Special Area (see here). China's 2024 rules easing cross-border data transfers empowered free-trade zones to create a negative list, where the types of data not on the list can exit the country without restrictions. Data on the list, however, will trigger one of China's three cross-border data transfer systems (see here). Last year, Beijing (see here) and Tianjin (see here) authorities issued negative lists for outbound data transfers appliable to key industries in their respective free-trade zones. Shanghai's initial negative list includes the reinsurance, international shipping, retail, catering and accommodation industries — sectors deemed crucial to its ambition of becoming an international economic, financial and shipping center. The negative list defines the scenarios and outlines the data category subdivisions and data characteristics that require a data-exit security assessment and which necessitate filing through the standard contract for personal-information exit and personal-information protection certification. The six scenarios in the list cover personal insurance reinsurance, property insurance reinsurance, waterway transportation services, port operation production, crew management and membership management. — Significantly relaxed thresholds — Compared to the 2024 rules, Shanghai’s thresholds for data that would trigger security assessments, standard contract filings and certifications for personal-information exits — including sensitive personal information — have been significantly relaxed in these scenarios, a move even bolder than what Beijing did. For instance, only the export of personal information of over 10 million people or sensitive personal information of over 1 million people in the personal insurance reinsurance and property insurance reinsurance scenarios will require a security review, contrasting with China's universal rules' thresholds of one million people and 10,000 people, respectively. The same higher thresholds apply to the membership management scenario in the retail, catering and accommodation industries seeking security review clearance. The relaxation does not extend to outbound transfers of personal information in the crew management scenario. But international shipping companies’ cross-border transfers of the sensitive personal information of over 150,000 people — instead of over 10,000 in 2024 rules — will trigger the security review regime. Accordingly, in these scenarios, the thresholds for standard contract filings and certifications have also been relaxed. The negative list also clarifies what constitutes sensitive personal information in the selected scenarios for data handlers in related sectors. — ‘Important data’ — The Shanghai negative list also notably defines “important data” for identified scenarios in the reinsurance and international shipping sectors. No important data is identified in the membership management scenario for the trade and commerce sector. As outbound transfers of important data need security-review clearance, data handlers have been calling for a clarity. In the personal insurance reinsurance and property insurance reinsurance scenarios, underwriting and claims data related to important facilities, equipment and personnel involving national security are categorized as important data. Unpublished data that can reflect the overall or key areas of economic operations, financial activities, relate to industrial competitiveness and major social public interest areas are also deemed important. Besides those published or notified by industrial regulators, important data also includes data from sensitive and special units such as party and government organs above the county level, national defense facilities, military management areas as well as their personnel. Important data are also found in the waterway transportation services and port operation production-related scenarios. Basic geographic information, port facilities and equipment data and port system operation and safety data in daily port production and operations are all categorized as important data. Port operation and management data — such as service data, logistics data, port development strategies and major decisions, energy and environmental protection — as well as waterway transportation service data, are all considered important....