China’s ongoing negotiations in pursuit of joining the Digital Economy Partnership Agreement (DEPA) may result in some much-needed clarity for U.S. colleges and universities trying to comply with China’s Personal Information Protection Law (PIPL) cross-border transfer provisions. DEPA member nations aim to promote their countries’ digital product and service economies by collaborating to implement rules and processes that facilitate worldwide provision of digital products and services. Since delivering digital products and services worldwide often involves the cross-border transfer of personal information, the cross-border transfer restrictions imposed by China’s PIPL are inherently contrary to the spirit of DEPA. While Chinese authorities are unlikely to loosen PIPL’s cross-border transfer restrictions, DEPA negotiations could result in Chinese authorities clarifying some restrictions to give digital product and service providers more confidence that their cross-border transfers are PIPL-compliant.
Applicability to U.S. IHEs: Transfer of “Important” Personal Information
One potential point of clarification of particular importance to U.S. colleges and universities relates to transfers of “important” personal information. According to recently finalized regulations on outbound data transfer security assessments, before transferring any “important” personal information from China to another country, institutions must undergo a security assessment conducted by the Chinese government. The draft 2017 IT Guidelines for Cross-Border Data Transfer suggest that “important” personal information may include information such as diagnosis, treatment, and health data collected by U.S. colleges and universities conducting clinical trials in China, or certain financial information of Chinese alumni that U.S. colleges and universities may collect as part of their donor records. If Chinese authorities clarify that these types of personal information are in fact “important,” then U.S. colleges and universities collecting such personal information in China will need to (1) undergo a Chinese government security assessment, or (2) carefully plan their collection and handling processes to avoid triggering PIPL’s cross-border transfer restrictions (e.g., by anonymizing the personal information before transferring it from China to the U.S.).
U.S. colleges and universities engaged in any research, fundraising, study abroad, or other activities in China should therefore pay close attention to China’s DEPA negotiations, particularly with respect to any clarification of what constitutes “important” personal information. That clarification may mean the difference between having to undergo a Chinese government security assessment versus being able to transfer the personal information in a less onerous manner.