Chapter 17 discusses China’s Criminal Procedure Law, which provides a general cooperation obligation for all relevant entities, including service providers. As collecting data from service providers has become increasingly important in criminal investigations, the past decade has witnessed a certain number of laws, regulations and explanatory documents adopted to specify service providers’ cooperation obligations. This chapter systematically studies these provisions and summarizes the rich content of service providers’ cooperation obligations relating to collection of historical and real-time data in criminal investigations as well as in their daily operation. It also discusses future improvements to the current legislations, namely more protection of sensitive data, due process in evidence collection and criminal liability for service providers when cooperation obligations cannot be fulfilled. Based on China’s position of respecting data sovereignty, China requires data to be stored locally. Foreign LEAs can obtain data from Chinese service providers only via mutual legal assistance, and service providers in China are prohibited from providing data directly to foreign LEAs.

This chapter contributes to understanding the possible impacts of China’s Cyber Security Law once that law is fully implemented, as it concludes that Chinese authorities conduct an ongoing cost–benefit analysis in evaluating data localisation policies and practices, and that this partly explains China’s delay in implementing the data localisation provisions within the law. This is also consistent with the longstanding practice of the Chinese government to create fuzzy logic laws in areas of rapid change in order to allow for flexibility in implementation depending on the milieu. The costs and benefits of data localisation vary over time, requiring continual re-evaluation; hence, the laws can be implemented and reinterpreted in line with fuzzy logic. In particular, what is meant by ‘important data’ can be changed according to the policy considerations outlined in this chapter.

Do China’s data localisation laws, which were introduced as part of China’s Network Sovereignty policy, adversely affect – or are they likely to adversely affect – open innovation in Chinese AI firms, which is a key goal of China’s Internet Plus policy?

The key provisions of China’s Cyber Security Law relating to data localisation and data exits still allow for competing interpretations by regulators, which makes compliance difficult, even in 2021. The further attempt to include ‘backdoor’ keys to encryption in this law is also noted, although foreign companies have managed to exert some influence on this point and other implementation issues. The Cyber Security Law is an important and high-profile development in Chinese cyber policy history. It created much more controversy than the Anti-Terrorism Law explained in the previous chapter. In recent years, China has gradually adopted a series of laws, regulations and macro policies in the field of cyber security and data protection aimed at turning the country into a ‘cyber superpower’ and boosting its digital economy. The Cyber Security Law, which came into partial effect from 1 June 2017 (with an official 18-month phase-in period for the data localisation provisions), is a milestone in the development of China’s legal framework for cyber security and data protection. The law also provides further evidence of the inherent tensions underlying the innovation policies described in Chapter 3. However, vague regulations allow regulators leeway to adjust their aims in response to broader economic and political trends by means of implementing rules. Finally, clarifying the vaguest provisions in the Cyber Security Law through more transparent rules may provide an opportunity for the Chinese government to decide which way it is heading: towards further innovation or further restriction beyond the ongoing US–China trade war.