In February, the Shanghai Free Trade Zone (FTZ) (including the Lingang Special Area) released rules governing its data export negative list. These rules implement the overall plan issued by the State Council to boost cross-border business in the Shanghai FTZ.

Within weeks, the Hainan Free Trade Port has also issued its data export negative list to facilitate data flows from the free trade port.

These negative list developments echo recent cross-border data transfer initiatives in other FTZs, varying from negative lists issued by Tianjin FTZ and Beijing FTZ, to the whitelist approach adopted by Shanghai FTZ Lingang and Fujian Pingtan FTZ.

This note recaps recent FTZ data export initiatives, outlining key takeaways for multinationals operating or considering setting businesses in these regions.

What a negative list or whitelist means

The 22 March 2024 provisions for liberalisation of cross-border data transfers specifically entitle FTZs to develop their own cross-border data transfer rules, including to ease data export restrictions for organisations based in the FTZs.

A negative list means a list of data types whose export from China will be subject to additional restrictions, such as to conduct a government-led data export security assessment, sign a China Standard contract, or to obtain data protection certification. In essence, the reverse implication of these lists is that MNCs located in the FTZs may “freely” transfer out of China data that are not on the negative list, without triggering the above transfer formalities (even if other data privacy requirements still apply). Additionally, the FTZ negative list regimes increase the thresholds at which these transfer formalities apply to exports of certain data types relating to specified industries/sectors.

A whitelist, as an opposite approach, means data types whose export is explicitly permitted by the FTZ regulators. The whitelist approach, as previously adopted in some FTZs such as that in Lingang, Shanghai, appeared to only cover limited scenarios compared with the full-range negative lists released by other FTZs such as Tianjin and Beijing.

An overview of FTZ reforms is available here.

Clarification of important data

Export of important data is subject to stringent regulations. Businesses have been anticipating the release of industry-specific catalogues on important data by the PRC regulators. However, as of now, there has been only limited guidance or standards available in several industries and sectors.

Notably, the negative lists provide some valuable reference to what industry-specific data types would be more likely to be treated as important data. Taking the Shanghai FTZ negative list as an example, the types of data below are deemed important data in the reinsurance and shipping industries:

Free trade zone negative list as an alternative approach to cross-border data transfers?

The use of FTZ negative lists is emerging as a viable approach to facilitating cross-border data transfers, providing a simpler alternative pathway for multinational companies operating within China to connect to their global networks. In 2024, Bayer Healthcare became the first company to successfully file a bespoke negative list to widen the scope of its cross-border data transfers from Beijing E-Town.

However, while beneficial, this negative list filing strategy does not waive all compliance obligations falling on multinational companies under China’s national security and data protection laws, such as the eligibility requirements and the record-filing process mentioned above.

Among others, to leverage the FTZ initiative, a multinational company will need to have a presence in, and, as required in most FTZ initiatives, conduct data export activities from, the FTZ. What qualifies as “conducting data export activities” within the FTZs lacks clarification.

A reasonable read would be to refer to the storing, processing, and transferring of the data intended for export in or from the FTZ, with a clear example being that the applicant’s data export nodes or data storage facilities are situated within these zones. However, it is unclear if the negative lists are deemed applicable when data export activities physically occur outside the FTZ, even if the data is contractually exported by a business registered within the relevant FTZ to meet both business needs and the eligibility requirements.

Additionally, since each set of FTZ rules is formulated by a different FTZ and implemented at various times, differences in the criteria adopted by each FTZ may pose challenges for MNCs attempting to maintain a consistent approach when operating across different FTZs.

Strategic considerations for multinational companies

Multinational corporations looking to leverage the benefits of FTZ initiatives for a more streamlined data export compliance process should consider the following steps:

• Make an assessment: Determine whether a FTZ initiative applies and whether the required additional compliance resource is worth expending to qualify data flows under the specific regime.
• Classify data assets: Formulate and implement data classification and data grading processes by reference to national data classification standards, industry rules and standards, and available FTZ-specific frameworks.
  
• Monitor policy updates: Stay vigilant for changes in a dynamic regulatory landscape. In particular, the Shanghai FTZ negative list states that negative lists published by other FTZs may be “referenced” by the Shanghai FTZ and the FTZ in Lingang New Area, so companies should pay attention to updates to the negative lists in various FTZs.
• Ensure continuous data protection compliance: The FTZ exemptions do not mean that an organisation need not comply with the general data protection obligations under China’s data protection laws. These especially include, e.g., providing necessary notices and obtaining consents (unless relying on an alternative legal basis) and conducting personal information protection impact assessments.

We are currently working with several clients to analyse these developments. For further guidance or questions, please feel free to reach out.

An overview of Free Trade Zone reforms is available here.