Analyzing China's comprehensive approach to data

China's approach to data governance may significantly impact the international system as the country becomes a global rule-maker, experts said.

In a March 2 webinar hosted by the Institute for China-America Studies (ICAS), panelists discussed China's legislative actions on data governance, which show a pivot toward a comprehensive, economic approach.

Kendra Schaefer, partner and head of tech policy research at Trivium China, stressed that China has focused on data classification to build a framework for the data market, seeing data as the most critical resource for economic development.

"If the digital economy is one of the key engines maintaining China's forward momentum, then as we know, data is the gas that powers that engine," said Schaefer.

Sourabh Gupta, a senior fellow at ICAS and leader of the discussion, compared the different approaches to data governance in the US and China. He said that the US used "a laissez-faire approach to data flows with narrow, adversary-oriented exceptions".

In contrast, China's approach is "comprehensive, concerted and state-managed" for data protection and privacy, he said.

Paul Triolo, senior vice-president for China and technology policy lead at Dentons Global Advisors-Albright Stonebridge Group, said that it is important to "retain interoperability or develop new ways to interoperate between countries and regions with very different legal systems and drivers" to conduct data governance.

In Triolo's analysis, the European Union is a leader in managing data security and protecting privacy, with "this whole edifice that's been built up since the GDPR (General Data Protection Regulation) was implemented in 2018".

But now it is hard to implement a "sort of one size fits all", and there are too many regulations, he said.

The US, in his view, has a "very messy system".

"We have no single US federal law that comprehensively regulates the collection and use of consumers' personal data. Congress has enacted a number of laws designed to provide statutory protection of individual personal information, but it uses a sectoral approach," Triolo said.

"The lack of an overarching law is complicating the US relationship with the EU over issues such as Privacy Shield (a data-protection effort between the US and the EU and Switzerland), as well as creating difficulties, as the administration addresses connected apps such as TikTok," Triolo said.

He noted that China is going its own way.

"China is trying to sort of chart its own middle ground between the EU approach and the US approach. And this is in keeping with Chinese preferences for things, like, you know, categorizing data … with a multilevel protection scheme," said Triolo.

China finalized its data governance regime last year by releasing the Data Security Law and the Personal Information Protection Law, setting up some basic buckets for high-risk and medium-risk data.

"This is the big-picture economic thinking underpinning the data classification schemes," said Schaefer, who called China's move an ambitious project "that hasn't been done by any country anywhere in the world".

Schaefer also expressed some reservations.

"They could overclassify data as restricted, and what that would mean is that Chinese companies would have a very difficult time exporting their data," she said. "Data trade would become overcomplicated when they try to take those data regulations and match them up with data regulations in Europe or the US," said Schaefer. However, she called China's data vision "incredible".

"The one thing that seems to be sure is that the entire landscape of global governance and management of data has already become more challenging than we expected, and we now have multiple regulatory regimes," said Denis Simon, a senior adviser to the president for China affairs and a professor at Duke University. "As the emerging global rule-maker, China's bilateral and multilateral engagement on data governance is going to have a huge influence on the trajectory of other countries."

Simon agreed that China's data governance is "innovative and creative", but said he was concerned about "some challenging times ahead".

"The reason for my concern really is that we've entered a period where China's relations with the United States and other Western countries are likely to remain problematic for a while," he said.

Gupta said that he hoped "everyone perhaps can gravitate to a common platform rather than actually move out in a decoupling way on data".