The Big Story

New rules for global data

On Friday, China's National People's Congress passed the long-awaited final version of the Personal Information Protection Law (let's call it PIPL). Together with the 2017 Cybersecurity Law and the Data Security Law — which goes into effect Sept. 1 — Beijing has now built three major pillars of its data governance regime. The net effect: Data generated in China, or data about Chinese people, should stay in China — and "data" is defined broadly.

National security trumps all. Chinese authorities are genuinely concerned about protecting citizens from unscrupulous companies playing games with their personal info. But they are equally (or more) concerned with giving themselves final say about when the law applies, which is why it's now illegal to do anything with Chinese personal data contrary to "national security or the public interest," which can mean nearly anything.

Does the PIPL apply to you? Maybe. Both the Data Security Law and the PIPL apply beyond China's borders.

• The DSL applies abroad when "data handling activities" outside the mainland "harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC."
• The PIPL applies abroad when a data handler means to provide "products or services" to people in China or is "analyzing or assessing activities."

Other countries will likely follow China's lead — maybe even the United States.

• As Protocol's Shen Lu reports, "Many Asian governments are in the process of writing or rewriting data protection laws" and among those, "Vietnam, India, Pakistan and Sri Lanka have all inserted localization provisions in their respective data protection laws."
• Meanwhile, the United States has done nothing to create its own data protection regime, and has ceded virtually all control to private companies … so far. But if the tide turns, Washington could be more likely to pass a muscular, national-security inflected data regime than it would have if China hadn't moved in that direction first.

On Protocol | China

• Beijing has a plan for automated governance. Even as Beijing signals a continuation of crackdowns on the country's largest tech companies, top officials are calling for data measures that would make governing them and the general public more streamlined — perhaps even automated. Contributor Dave Yin reveals Beijing's big plans for big data.
• China is struggling to regulate self-driving cars. Are they autonomous? Self-driving? Are they L2, L3 or L2.99? Zeyi Yang dives into the confusing nomenclature that's given regulators headaches and led drivers to trust still-evolving autopilot systems too much — sometimes to deadly effect. Read more.
• Critical cybersecurity rules are now on the books. China's State Council issued a long-anticipated set of cybersecurity regulations on Tuesday that provide guidance about how regulators will designate "Critical Information Infrastructure" operators and the regulatory scrutiny they will face. Shen Lu explains what it all means.

A MESSAGE FROM TRELLO

After a year and a half of living and working through a pandemic, it's no surprise that employees are sending out stress signals at record rates. Just as with building a healthier lifestyle, enacting measures of support on the day-to-day level is where lasting change is made.

Learn More

China Goes Global

• DiDi dropped its European expansion plans for at least the next 12 months. The Telegraph reported Monday that the company suspended plans to expand in several British cities despite having secured local licenses. It has reportedly stopped hiring in the U.K. and expects to lay off some of the current staff in Europe amid Chinese regulator concerns that DiDi's user data is leaving its home country.
• Believe it: Silicon Valley is (sometimes) a China copycat. Chinese tech publication PingWest analyzed new consumer tech trends and operating models that Chinese tech companies pioneered and American Big Tech is copying. The key areas: livestream ecommerce, short videos, mobile payments, bike-sharing and food delivery.
• Everybody now hates VIEs. The SEC has started requiring greater disclosure from Chinese companies seeking to list in the U.S. that make use of variable interest entities (VIEs), Reuters reported Monday. Chinese Big Tech frequently uses VIEs as onshore holding companies for tech that foreign investors aren't supposed to be able to invest in — the VIEs aren't technically owned by the listed company, but are in contractual relationships with it, curing the legal issue.

Straight From China's Web

Baidu is serious about autonomous driving. The search giant-turned-AI company kicked off its annual Baidu World technology conference last week by unveiling a first glimpse at its level-5 autonomous robocar — in other words, a car with no steering wheel or pedal. Baidu also announced the launch of a robotaxi mobile platform, Luobo Kuaipao.

Big Brother Beijing

• Beijing called out 43 uncooperative apps. Caixin reported last Thursday that the Ministry of Industry and Information Technology found them to still be violating regulations by accessing users' contact books, location information and issuing unwanted pop-ups. Named offenders included Ctrip, Sohu Video, Tencent Video, Tencent Map, WeChat and WeChat Enterprise.
• Ed tech is being forced to kill its killer apps. As part of Beijing's sudden ed-tech crackdown, companies can no longer offer functions that could embolden "bad learning methods" that impair "thinking skills, affect students' independent thinking and are against the principles of education." That means tech companies are now removing tools that search for answers based on photographs of questions, Beijing Business Today reported.