Long overdue changes? A look at China's proposed revision to its key Internet regulation

In this Newsletter, we will have a look at some of the key changes proposed to be made in the Draft Revised Regulation.

The Current Regulation mainly regulates providers of "internet information services". In the Revised Draft Regulation, new categories of service providers will be subject to regulations:

• Internet information service providers (ICP)

• Internet network/access services providers (INP)

• Domain name registry, resolution and other service providers

Certain internet service providers that are neither ICPs or ISPs will also be regulated. These include domain name registration service providers.

• Notable exemption

Article 53 specifically carves out the regulation of internet information services which are "dedicated for provision through television terminals". Such services will be regulated according to the laws and regulations of television and broadcasts.

Under the Current Regulation, the main regulator appears to be the Ministry of Industry and Information Technology. In practice, the Cyberspace Administration of China, the Ministry of Public Security and other authorities all have regulatory oversight on different aspects of online services in China. The Draft Revised Regulation proposes that there will be three main regulators with the following specific functions and responsibilities:

In addition to the above three key authorities, the Draft Revised Regulation continues to recognise other authorities which will have power to regulate specific aspect of online services, for example, online game publishing which will also be regulated by the National Press and Publication Administration.

3. Extra-territorial application

For the first time, the Draft Revised Regulation specifically provides that it will apply to any organisation or individual in the PRC that uses domestic and foreign network resources to provide internet information services to domestic users in China. This change provides a much needed legal ground for the regulators to regulate, for example, onshore companies which host their services in servers located outside of China (but the services are for users in China) where the onshore companies hope to circumvent telecom regulatory and licensing controls in China.

The Draft Revised Regulations seek to include the following new categories of prohibited online content through Article 26:

• Fabricated or false information that disrupts the financial market or economic order;
• False information regarding dangers, epidemics or other information which may disrupt social order; and
• Information that incites illegal assemblies or disrupts social stability and order.

• all identity information must be retained during the term of the service and for at least 2 years after the term ends;
• ICPs must retain all published information and must keep it for no less than 6 months; and
• ICPs and INPs must record and retain network log information for at least 6 months (this requirement can also be found in the PRC Cybersecurity Law).

• Publishing, or accepting consideration to publish, information known to be false;
• Providing services to delete, block, replace, or bury information for consideration;
• Mass resale, registration and provision of online accounts that are used for committing crimes; and
• Participating in activities such as false clicks, votes, reviews, or transactions.

8. Safety assessment

The Draft Revised Regulation provides that ICPs must establish a system for security assessments, and when a new internet operation is established, must conduct a security assessment and report the findings to relevant authorities. This "security assessment" requirement is not new: the MIIT released the "Measures for the Administration of Security Assessment of New Internet Services (Draft for Consultation)" back in 2017. The details of security assessment is expected to be elaborated on separate implementation rules.

The Current Regulation divides internet information services into two categories: (i) commercial services and (ii) non-commercial services, with the former subject to a licensing regime and the latter subject to a filing/recordal requirement. Whether a specific internet service is of a commercial or non-commercial nature depends on whether consideration is received for the service.

The Draft Revised Regulation no longer uses the term "commercial" and "non-commercial". Instead, whether ICP service is subject to the licensing or recordal requirements will depend on whether the service is a telecom operation. Such distinction no longer hinges on whether the service is "compensatory”, which is in line with spirit of Telecommunication Regulation.

• Blacklist and prohibition to act for certain period: A blacklist system of ISPs (not INPs) will be established. Organisations and individuals whose licences/recordals have been revoked/cancelled cannot apply for the same licences/recordal for the next 3 years.

• Personal liability: Unlike the Current Regulation which is generally silent on imposing legal liabilities on directly responsible persons of service providers, the Draft Revised Regulation specifically provides in multiple articles that potential legal liabilities can be imposed on persons directly responsible for the ICPs or INPs. This is consistent with the legislative trend to "pierce the corporate veil" and hold the individuals "behind the scene" responsible.

Our observations

Although the Draft Revised Regulation comes across as a significant overhaul of the current regulatory regime, many of the changes proposed to be introduced by the Revised Draft Regulation simply reflect current practices or changes which relevant authorities have been advocating in the last few years. Nevertheless, the Draft Revised Regulation will likely increase compliance costs and legal risks of non-compliance.