Hacking into China's Cybersecurity Law

Abstract

China’s Cybersecurity Law, which is thus far the most important internet legislation to be passed in the country, came into effect on June 1, 2017. The law has attracted significant attention and criticism from foreign companies. Although the Chinese government claims that the Cybersecurity Law will help reduce the risk of cyberattacks and safeguard national security, some critics believe that the law will further erode internet freedom in China. In particular, concerns have been raised that the law may not effectively enhance China’s current level of cybersecurity but instead may be used to facilitate government censorship and surveillance, to increase unnecessary business operating costs, to steal intellectual property from foreign companies, and to protect domestic industries from global competition.

This Article provides a thorough analysis of important provisions of the Cybersecurity Law as well as their policy implications. It views the Cybersecurity Law as part of a broader set of policy steps that have been taken to streamline laws concerning the internet and national security. The law fulfills China’s persistent aim to assert its internet sovereignty by imposing heavy obligations on network operators and critical information infrastructure operators. This Article contends that the law should be understood from the perspective of China’s unique conception of cybersecurity and human rights. As cybersecurity is defined much more broadly in China than it is in the Western world, any digital information threatening social or political stability will be viewed as a cybersecurity, or even a national security, concern. This explains why the scope of the Cybersecurity Law is unprecedented. Moreover, the treatment of personal information in the Cybersecurity Law reflects China’s human rights philosophy. While individuals enjoy a certain degree of human rights protection, those rights do not effectively protect them from government action.

Keywords: China, cybersecurity, data localization, critical infrastructure, trade secret, internet sovereignty, personal data