Save the Best for Last – All You need to Know about the Standard Contract for GBA Data Transfers (Part I)

On 13 December 2023, the Cyberspace Administration of China (the “CAC”) and the Innovation, Technology and Industry Bureau (the “ITIB”) of the Hong Kong Government jointly released the “Implementation Guidelines for Standard Contract for the Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (“GBA SCC Guidelines”). 

The GBA SCC Guidelines mark China’s first measure to create an integrated approach for the cross-border flow of personal data transfers within the ten cities in the Guangdong-Hong Kong-Macao Greater Bay Area (“GBA”).

In this article, we highlight key provisions and share our observations on the proposed requirements. If you require any further assistance, please contact James Gong at james.gong@twobirds.com or Wilfred Ng at wilfred.ng@twobirds.com.

This is the Part I of this Article, and we will release the Part II after the New Year. 

On 1 November 2023, the National Information Security Standardization Technical Committee (“TC260”) issued the “Network Security Standard Practice Guide—Guangdong-Hong Kong-Macao Greater Bay Area Cross-Border Personal Information Protection Requirements (Draft for Comment)” (the “Draft Guide”), which is intended to serve as the implementation measures to the Memorandum, providing specific operational rules of the certification mechanism ("GBA certification") for cross-border flow of data between the Mainland and Hong Kong (Click here to read our comments on the Draft Guide).

On 8 December 2023, the Hong Kong ITIB and OGCIO released the “Policy Statement on Facilitating Data Flow and Safeguarding Data Security in Hong Kong”. It indicated that the Constitutional and Mainland Affairs Bureau would consider possible amendments to the PDPO to align with the latest international developments in privacy protection, strengthen personal data protection, and address the challenges posed by cyber technologies. 

At the Central Economic Work Conference on 12 December 2023, President Xi Jinping emphasized the need to expand opening up to the international community at a high-level, the serious consideration of cross-border data flow issues, as well as the need to continue to build a first-class internationalized business environment that is market-oriented and rule of law-oriented. The following morning, the GBA SCC Guidelines were officially released, enabling individuals and organizations in the GBA to voluntarily enter into a standard contract (the “GBA SCCs”) as per Appendix I to the GBA SCC Guidelines to facilitate their free data flow within the GBA.

KEY PROVISIONS AND OBSERVATIONS

I. Legal Effect and Application

What is the legal effect of the GBA SCCs mechanism? 

The GBA SCC Guidelines came into effect on December 13, 2023. According to the related information^[3] and press release^[4] issued by the Hong Kong SAR Government on the same day:

i. The adoption of GBA SCCs is on a voluntary basis. 
ii. The GBA SCCs mechanism does not affect the regulation of the processing and export of PI in the Mainland and Hong Kong according to local laws and regulations of the respective jurisdictions.^[5] 

The adoption of GBA SCCs is on a voluntary basis, which means:

• Mainland PI Processors in the GBA can still export data outside the GBA pursuant to the existing three options for cross-border flow of PI under the PIPL.  On the other hand, if the data only needs to be circulated within the GBA (i.e. no onward transfer outside the GBA), PI Processors can rely on the GBA SCCs or the GBA Certification mechanism (We will keep a watching brief on the relevant filing guidelines and any consultation hotline to be released by the Guangdong CAC – watch this space).
• For data users in Hong Kong, there is no change to any restriction of personal data to be transferred outside the jurisdiction.  Existing data flow from Hong Kong to Mainland China will not be subject to a compulsory legal requirement for entering into the GBA SCCs.^[6]

When will the GBA SCCs mechanism apply?

The OGCIO of the HKSAR Government has stated^[7] that the GBA SCCs mechanism applies to both directions of cross-border flow of PI between Mainland cities in the GBA and Hong Kong.

The following conditions must be met: 

i. Both the PI Processor and recipient must be located in the GBA: The PI Processors^[8] and the recipients must be registered (in the case of organisations) or located (in the case of individuals) in Mainland cities within the GBA, i.e. Guangzhou, Shenzhen, Zhuhai, Foshan, Huizhou, Dongguan, Zhongshan, Jiangmen and Zhaoqing of Guangdong Province, or the Hong Kong; and

ii. The transfer should not involve the export of important data: Notably, the GBA SCCs mechanism does not apply if the export of important data is involved. PI may be classified or promulgated as important data by relevant departments or regions. 

iii. There should be no onward transfer of PI outside the GBA: the GBA SCCs mechanism does not apply if there is a need for onward transfers of PI to organisations or individuals outside of the GBA. 

Specifically, it is not allowed to provide^[9] PI to organisations or individuals outside of the GBA under the GBA SCCs mechanism, but GBA SCCs do not explicitly prohibit transfer to the entrusted sub-processor outside the GBA^[10]. However, the Guangdong CAC currently rejects any implication that entrusted sub-processing can be conducted outside the GBA. We will keep a watching brief on the relevant filing guidelines and any consultation hotline to be released by the Guangdong CAC – watch this space.

The above conditions do not concern the quantity of PI being exported.  This suggests that the GBA SCCs have less stringent requirements for implementation compared to the PIPL SCCs^[11], a point confirmed by the Hong Kong SAR Government.^[12] This may mean that for Mainland PI Processors in the GBA:

• Despite reaching the threshold of governmental security assessment, if the above conditions can be met, Mainland PI Processors can still choose to export PI pursuant to the GBA SCCs mechanism.
• Conversely, if the exemption conditions in the draft regulation for Administering and Promoting Cross-border Data Flow for data export compliance mechanisms (such as PIPL SCCs) are met, Mainland PI Processors do not have an obligation to export data pursuant to the GBA SCCs mechanism. 

If not, for PI Processors who meet the exemption conditions, the cross-border compliance requirements in the GBA are higher than those in other Mainland areas, which contradicts the goal of promoting data flow in the GBA. We will keep a watching brief on the relevant legislative developments to further confirm such implications - watch this space.

Stay tuned for Part II after the New Year, where we’ll dive deeper into the provisions of the GBA SCC Guidelines and share with you our views and observations.

—

^[1] A personal information processor (“PI Processor”) is defined as an organisation or individual that independently determines the purposes and means of the processing, akin to the concept of data controller under the General Data Protection Regulation (“GDPR”) of the European Union.

^[2] As stated in the Chief Executive’s 2023 Policy Address on 25 October 2o23 and a written reply to the Legislative Council by the Secretary for the ITIB on 15 November 2023 (see website: Innovation, Technology and Industry Bureau : Questions (2023-11-15) (itib.gov.hk)).

^[3] OGCIO: Facilitating Cross-boundary Data Flow within the Greater Bay Area

^[4] Facilitation measure on "Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)" and its early and pilot implementation arrangements

^[5] According to the GBA SCCs, relevant local laws and regulations, for the Mainland, refer to the laws and regulations including the Cybersecurity Law, the Data Security Law, the PIPL etc.; for the HKSAR, refer to the laws and regulations including the PDPO.

^[6] See Q&A #9 at OGCIO: Facilitating Cross-boundary Data Flow within the Greater Bay Area

^[7] OGCIO: Facilitating Cross-boundary Data Flow within the Greater Bay Area

^[8] According to the GBA SCCs, “Personal information processor”, for the Mainland, refers to an organisation or individual that autonomously determines the purposes and means of PI processing; for the HKSAR, it also covers a “data user” which, in relation to personal data, means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.

 ^[9] Although there is currently no clear definition of "provide" in Mainland laws and regulations, based on the context of the PIPL and the application of other regulatory documents, we understand that “providing” to a third party refers to transfer data to a third party that can independently determine the purpose and method of data processing, while the entrusted third party in “entrusted processing” can only process data according to the purpose and method specified by the entrusting party.

 ^[10] Article 3 of the GBA SCCs: The recipient shall fulfil the following obligations and responsibilities: (9) Obtain consent of the PI Processor in advance where the processing of PI is entrusted by the PI Processor and further entrusted to a third party, and request the third party not to process the PI beyond the purposes and means of processing, etc. as agreed in Appendix I “Description of cross-boundary transfer of PI” of this Contract, and supervise the PI processing activities of the third party.

 ^[11] According to Article 4 of Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information, to provide PI to an overseas recipient through a SCCs executed, a PI Processor shall meet the following conditions:

(1)   not being a critical information infrastructure operator;

(2)   handling PI of fewer than one million individuals;

(3)   having provided PI of fewer than 100,000 individuals in aggregate to overseas recipients since January 1 of the previous year; and

(4)   having provided sensitive PI of fewer than 10,000 individuals in aggregate to any overseas recipients since January 1 of the previous year.

^[12] Facilitation measure on "Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)" and its early and pilot implementation arrangements