Previous 20 / 63 Next

China ARTICLE 19 China requires data localisation for data or entities operating in certain areas or specialised industries.42 This represents a fairly expansive data localisation regime, although it is not technically applicable to all internet companies and services as some sources suggest.43 The Cybersecurity Law imposes certain data localisation requirements on CIIOs, which must also undergo a security assessment before transferring data outside of China.44 Real-name registration requirements are imposed on mobile phone, domain name registration, and other specified network operators, which must then require users to provide information on their real identity.45 More generally, network operators must provide technical support and assistance to security authorities.46 Article 58 also enables authorities to impose temporary measures to limit network communications in a designated area in order to protect national security or to respond to major security incidents. Along with the Cybersecurity Law, 2 other laws form the core of the data management obligations imposed on companies operating in China. The Data Security Law 2021 47 introduces general data management requirements, such as restrictions on the cross-border transfer of data, and establishes categories of information which are subject to special management rules (such as if the data impacts national security). The Personal Information Protection Law 2021 outlines personal data protection obligations for companies, but with additional elements such as data localisation for CIIOs which handle more than a certain quantity of personal data and mandatory state security assessments prior to cross-border transfers of personal data.48 Tech companies are also subject to legal obligations under a range of national security laws, including: • National Security Law 2015: This important framework law requires enterprises and other organisations to preserve national security, defined broadly to include public welfare and other ‘major national interests’, and to cooperate with authorities to implement security measures.49 It also tasks the state with establishing a national network and information ____________________________________________ A. Douglas and H. Feldshuh, How American Companies Are Approaching China’s Data, Privacy, and Cybersecurity Regimes, The US–China Business Council, April 2022 43 Freedom House, Freedom on the Net 2023: China; A. Robertson, Facebook Takes a Shot at Apple in China, Says it Won’t Store Data in Certain Countries, The Verge, 6 March 2019. 44 Creemers, Triolo, and Webster, Translation: Cybersecurity Law, Article 37. 45 Creemers, Triolo, and Webster, Translation: Cybersecurity Law, Article 24. 46 Creemers, Triolo, and Webster, Translation: Cybersecurity Law, Articles 28 and 69. 47 Creemers, Triolo, and Webster, Translation: Cybersecurity Law. 48 Creemers and G. Webster, Translation: Personal Information Protection Law of the People’s Republic of China – Effective Nov. 1, 2021, unofficial English translation, DigiChina, 20 August 2021, Article 40. 49 China Law Translate, National Security Law of the People’s Republic of China, unofficial English translation, 1 July 2015, Articles 2, 11, and 79. 42 20

Select target paragraph3

● ● ●

Engaging tech for internet freedom in authoritarian countries

Report

Preview

Language

English

Topic

Information Operation
Internet Restrictions

Author(s)

Article 19

Date Published: Oct 5, 2024

Abstract: In this report, ARTICLE 19 reviews the human rights context and responsibilities of tech companies operating in 3 authoritarian countries in Asia, namely China, Myanmar, and Vietnam. It focuses on the rights to freedom of expression and privacy, and the manner in which authoritarian states directly or indirectly expect companies to assist them in censoring content, promoting propaganda, accessing user data, and engaging in surveillance. While these are undoubtedly highly challenging contexts, companies have not sufficiently prioritised protecting human rights in their policies and actions. States are the primary duty bearers under international human rights law, but companies also have human rights responsibilities, as outlined in the United Nations Guiding Principles on Business and Human Rights (UNGPs). Even if domestic law or circumstances make it impossible for companies to fully meet their human rights responsibilities, they should take action so as to respect human rights standards to the greatest extent possible. Tech companies should not merely reference local law as an excuse for collaborating in rights violations. They should take steps such as those detailed in this report, like adopting appropriate policies, asking governments to justify content removal requests clearly and specifically, and reporting transparently on their compliance with government demands. For each country, we survey the country context and provide an overview of legal obligations which companies operate under that are problematic from the perspective of international human rights law and that may, as a result, put pressure on companies to become complicit in violations of the rights to freedom of expression and privacy. We then explore how Western tech companies operating in these countries, many of which have explicitly stated their commitment to respecting freedom of expression and privacy, have responded to these legal obligations and to other government expectations that they will cooperate in violations of these rights.

Link: source

Primary Documents

ETIF-Thematic-Report-12Sep-24.pdf
English
Download View

Myanmar Internet Project

Select target paragraph3

Engaging tech for internet freedom in authoritarian countries

Primary Documents

Notifications