BEIJING -- Businesses in China would face a national security review prior to transfers outside the country of personal information of 100,000 individuals or more, under a proposal unveiled Friday that comes as Beijing rolls out cybersecurity mandates.
The government will collect expert opinion on the draft data protection regulations through Nov. 28, said the Cyberspace Administration of China, the country's top internet watchdog. The directives are expected to go into force soon after.
Companies such as U.S. electric vehicle maker Tesla have been suspected of transferring personal data across the border. Tensions with Washington have driven China to tighten the lid on data seen as key to gaining a competitive advantage.
The proposed directives call for a government review of any operator that handles "important" data concerning critical infrastructure such as communications, finance and transportation prior to cross-border transfers.
For other businesses, the requirement is triggered if a company transfers personal data encompassing at least 100,000 people, or gathers personal information from 1 million individuals. Authorities also will screen cross-border transfers of sensitive personal data, such as fingerprints, affecting 10,000 or more people.
During the reviews, the businesses will report the purpose and methods of transferring the data. Screeners will judge whether the transfer is lawful and necessary, and determine the risk of data breaches and other harm.
In addition, authorities will review the cybersecurity regulatory environment of the nation or territory receiving the data. Some suspect this facet of the reviews will impact transfers to countries that clash with China over data policy.
China has tightened controls on outbound data transfers in recent years. The People's Liberation Army has restricted the use of Tesla vehicles for certain units due to suspicions that the cars collect data that is transferred overseas.
This summer, authorities launched a security probe into leading ride-hailer Didi Chuxing shortly after it listed in the U.S. A suspected data breach triggered the investigation.
The new set of data regulations is based on the Cybersecurity Law that went into effect in 2017, along with the Data Security Law that went into force this September and a personal data privacy law due to take effect Monday. Beijing is expected to expand its control over data, using these three pieces of legislation.
Multinationals operating in China, including automakers, apparently hold information on large numbers of customers within the country.
"Considering the Sino-U.S. tensions, data is handled separately by region, so personal data is not expected to be transferred overseas," according to an executive at a foreign-owned company.