중국 데이터보안법에 대한 연구 - ‘중요데이터의 식별 가이드라인’을 중심으로 -

Abstract

The risk of using big data causing an issue of security has been considered a global problem. Thus, the Data Security Act of the PRC was enacted to regulate data security issues at the national level. This Act also promotes the development of industry and a booming economy. In light of the purpose of the Data Security Act of the PRC, this Act can be distinguished from other Acts and laws. Specifically, Cyber Security Law and Personal Information Protection Act are designed to protect personal information and promote a booming economy. Because of this different purpose of each law, there are critical differences regarding which data can be regulated by a specific law and how a violated usage of data that threatens national security can be controlled. The implication of the Data Security Act of the PRC is to systemize the categorization of data by following objective criteria. If a particular datum can be assessed as critical, the Data Security Act of the PRC regulates this datum at the national level. The point of the Data Security Act of the PRC is that data need to be categorized as ‘core data’ ‘key data(critical data),’ and ‘general data(opened data).’ core data can be considered confidential information at the national security level. The rating system for protecting security can categorize key data. And opened data can be accessed freely and used for business activities. Thus companies should establish the security system by following the Data Security Act of the PRC, arrange an educational program for employees who handle key data, hire a director who supervises the rating system, and have a duty to security risk analysis. In addition, when companies collect and utilize data, they need to pay particular attention and make a backup of key data in China. The meaningful point is that foreign companies transacting with Chinese ones should follow those duties above. Furthermore, the Data Security Act of the PRC regulates that a Chinese company that backs up key data cannot transfer those backup dates to any foreign companies without security screening. As the system of urgent processing, the rating system, and security screening for data security will be firmly established, the Data Security Act of the PRC can significantly influence data usage in China and abroad. Furthermore, in light of the role of a non-tariff barrier, the application of the Data Security Act of the PRC will cause many concerns about international transactions with foreign companies. Thus, this article sheds light on how to handle data security issues when foreign companies trade with Chinese companies.