European businesses ask China for greater details on data transfer regulations

The plea was part of a statement released by a European business lobby group this week, in which firms were told they might see millions of euros go to waste should they decide to hold non-sensitive information in China.

The European Chamber of Commerce in China has asked authorities to give precise descriptions “important information” and “personal information” as stipulated in their guidelines. Additionally, the group urged the swift finalisation of proposed relaxations to specific aspects of regulations announced two months ago.

Over the past six years, European firms have grappled with the absence of a clear definition for ‘Critical Data’ since the introduction of the Cybersecurity Law in 2017, according to Stefan Bernhart, a vice president of the chamber.  

As revealed by a report based on the impact of China’s data regulations, European companies operating in China are faced with substantial operational and compliance risks, if greater specificity across numerous laws is not forthcoming.

Concerns have heightened among foreign investors in China over the past year due to corporate raids, primarily targeting consultancies and due diligence firms. Questions regarding compliance with the law present significant challenges, potentially dissuading smaller firms from investing in China.

The chamber’s report mirrors recent remarks from a European Commission official who, in September, expressed anxiety felt by European businesses about the lack of clarity in China’s data laws. 

In the same month, overseas business chambers and legal figures gave a positive response to China’s announcement over the possibility of waiving data export security assessments for cross-border manufacturing, international commerce, and other activities.

While the Chinese government’s draft revisions were seen as a good signal, European companies keenly anticipate their translation into action by the end of November. Employee personal information stands as the most common variety of data being sent across foreign borders by European firms, the survey found. Suppliers’ and customers’ personal details are also being transferred regularly.

For a third of companies, failing the cross-border transfer security assessment could cost ‘several million euros,’ while over 10 percent of businesses polled estimate a cost in ‘hundreds of millions of euros.’