중국의 데이터 국외 이전 규제에 대한 연구- 주요 국가와의 비교를 중심으로 -

Abstract

As the importance of data becomes increasingly prominent, countries around the world are moving to regulate the cross-border transfer of data to safeguard their data sovereignty. Such measures inevitably lead to conflicts of interest among nations or between global corporations in matters related to data. Countries like the United States and the United Kingdom, which traditionally supported the free flow of data, have recently shifted their stance by imposing restrictions on Chinese online services, such as TikTok, to prevent the outflow of their citizens' personal data to China. China, for its part, has often been perceived as imposing stronger and more defensive regulations on data transfer compared to other nations. However, a comprehensive analysis of China's data transfer regulations in this study suggests that, apart from the mandatory requirement for a security assessment in certain cases, the overall level of regulation is not significantly different from that of the EU, Japan, or South Korea. Nonetheless, the absence of clear criteria for determining whether data qualifies as critical, assessing risks to national security, public interests, or the legitimate rights and interests of individuals or organizations, highlights the potential for significant administrative discretion. The scope of security assessment requirements and evaluation criteria may be expanded based on decisions by relevant administrative bodies. Consequently, the degree of regulatory enforcement may depend heavily on the active involvement of Chinese authorities. Incidents such as the recent administrative penalties against Didi Chuxing and violations of anti-espionage laws related to data collection and transfer indicate that the Chinese government maintains a firm stance on regulating cross-border data transfers. This approach reflects its intent to protect national security and economic interests while fostering the development of its domestic digital industries. By doing so, China seeks to reinforce its data sovereignty and establish a data ecosystem centered around its national interests. These stringent regulations compel global corporations to reevaluate their data management strategies, potentially inducing significant changes in the global digital economy. Companies engaged in trade or data collaboration with China, or those operating within the country, must establish robust compliance frameworks to adhere to these regulations.