Pharma Companies in Beijing Free Trade Zone to Benefit from Relaxed Data Transfer Rules
On August 30, 2024, the Beijing Municipal Cyberspace Administration, Beijing Municipal Commerce Bureau and Beijing Municipal Government Services and Data Administration Bureau jointly released the “Administrative Measures for the Data Exit Negative List of the China (Beijing) Pilot Free Trade Zone (Trial)” (Administrative Measures) and the “Data Exit Administration List (Negative List) of the China (Beijing) Pilot Free Trade Zone (2024 Edition)” (Negative List) to facilitate the export of important industry data and personal information out of the country by companies operating in the Beijing free trade zone (FTZ). The Negative List and Administrative Measures serve to further relax restrictions on certain cross-border data transfers in five industries, including automotive, pharmaceutical, civil aviation, retail and modern services, and artificial intelligence (AI) training. Under certain scenarios, companies in certain of these sectors will be permitted to transfer certain data outside of China without implementing a “transfer mechanism” (i.e., security assessment, standard contract for outbound transfer of personal information, or personal information protection certification) unless their data transfer activities fall within the scope of the Negative List.
Specifically, with respect to companies located in the Beijing FTZ, the Negative List sets forth the specific types and volumes of data in the five industries that require certain compliance procedures to be exported cross-border. Data not included in the Negative List can be freely exported cross-border. The Administrative Measures set forth the rules to enact, amend and implement the Negative List.
While these updates are relevant for several industries, this article examines the impact of the new Negative List rules and Administrative Measures on data transfers in the pharmaceutical industry.
I. What companies in the pharmaceutical industry can benefit from the Negative List?
The Negative List and Administrative Measures apply to pharmaceutical manufacturing enterprises (including chemical drug active pharmaceutical ingredient (API) manufacturing, chemical drug preparation manufacturing, biological drug manufacturing enterprises, etc.) that are registered and conduct cross-border data transfer activities in the Beijing FTZ.
II. What data transfer activities are exempted under the Negative List?
Under the previous rules (i.e., the “Provisions on Facilitating and Regulating Cross-Border Data Flows” issued by the Cyberspace Administration of China (CAC) in March 2024), a pharmaceutical company was required to implement one of the following transfer mechanisms based on the amount and sensitivity of data it exported from China in a calendar year (except for a few limited exemptions, e.g., transferring employee data for cross-border human resources management). The previous requirement thresholds (Previous Amount Thresholds) are set forth below.
- The company must apply for the security assessment (Security Assessment) organized by the CAC, if it transfers abroad (a) the non-sensitive personal information of 1 million or more individuals, or (b) the sensitive personal information of 10,000 or more individuals in a calendar year; or
- The company must sign the “Standard Contract for Outbound Transfer of Personal Information” and file the signed contract with the CAC (Standard Contract Filing), or obtain a personal information protection certification (PI Protection Certification) from certification bodies accredited by CAC, if it transfers abroad (a) the non-sensitive personal information of 100,000 to 999,999 individuals, or (b) the sensitive personal information of 1-9,999 individuals in a calendar year.
The Negative List and Administrative Measures significantly relax the above-referenced Previous Amount Thresholds and exempt pharmaceutical companies operating in the Beijing FTZ from the obligation to employ a transfer mechanism with respect to a broader scope of data transfer activities. Certain data transfer activities remain subject to the Previous Amount Thresholds, and “Important Data” cannot be freely transferred cross-border and requires a Security Assessment. The below table summarizes the new rules introduced by the Negative List.
* Important Data include, among other things, (1) diagnosis and treatment, health and physiological conditions, medical assistance and protection data of groups of a certain size or larger, and experimental data on specific medicines (e.g., electronic medical records database of more than 100,000 people); (2) biometric data and medical resource data of specific fields, groups, and regions of a certain size or more; (3) data concerning matters subject to export control or technology export management; and (4) genetic information, genetic data that have reached the scale or precision specified by the relevant authorities (excluding those that have obtained the human genetic resources authority’s approval or filing).
III. What steps must be taken to rely on the Negative List?
In order to benefit from the more relaxed rules of the Negative List, a pharmaceutical company in the Beijing FTZ must apply to the FTZ authority for use of the Negative List, and if the application is approved by the FTZ authority, then the company must submit a filing and materials for export activities to the FTZ authority. After reviewing the submitted documents, the FTZ authority will issue a notification letter to the company. If the FTZ authority determines that no transfer mechanism is required for the company’s data transfer activities, the company may conduct the data transfers without implementing any transfer mechanism. If the FTZ authority determines that a transfer mechanism is required, the company shall implement the applicable transfer mechanism and report back to the FTZ authority within three months.
The Negative List may significantly relax the compliance burden of multinational pharmaceutical companies operating in the Beijing FTZ that process data in the certain volumes and categories described above. If the new rules prove to be satisfactory in practice, the government may expand the scope of the Negative List to cover companies located outside of the FTZ in the future.
This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.
