Blackstone
Brigadier
PRC cyber laws going into effect. It's a long article, but the summary is pretty clear. US should impose the same exact restrictions on PRC companies operating in the US as PRC imposes on US firms. Reciprocation should be the new operating policy with the PRC.
Three Takeaways
First, China’s new legal framework for cybersecurity does not mean that it will be impossible for foreign tech companies to do business in China, but it is written so as to provide legal imprimatur to Beijing’s political whims. There is an expression in Chinese for the discretionary authority that high-ranking officials have when it comes to laws: “If they say it is fine, then it will be fine. If they say it is not fine, then it will not be fine (说行就行,说不行就不行).” If the Chinese government, customers, and partners want to do business with a foreign company, they will find a solution to get through these new regulatory hurdles. But if they do not, there is now an easy way to say no.
Second, informal implementation of the CSL and related measures began long ago, making the June 1 deadline less relevant than it seems. Global industry associations calling for a are wasting their energy, not least because the law is tightly linked with national security and is not directed at market access alone. Foreign companies have grown accustomed to submitting to invasive security reviews and pressure to store some types of data locally in China for some time. However, the time period before the entry into force of the cross border data flows measures will be crucial for clarifying the parameters of data that will be subject to some type of review.
Third, the most important point of leverage for the US when it comes to China’s cybersecurity regime may be access to overseas markets for Chinese companies as they go global. Beijing appears to be in the process of moderating its approach on cross-border data flows in recognition of the problems this would cause for its global tech ambitions. The threat of sanctions against Chinese companies finally brought Beijing to the negotiating table in September 2015 for the Obama-Xi agreement on cyber economic espionage. US industry and policymakers should keep this in mind as they consider responses, particularly related to the need for business-related data to go back and forth across borders.