Antitrust | Compliance | Corporate 
Data Privacy & Cybersecurity | Private Equity Funds

This China Newsletter provides an overview of key developments during Q3 2023 in the following areas:

1. Antitrust

   • China Amends Provisions on Prohibiting Abuse of IP Rights

   • SAMR Releases Anti-Monopoly Compliance Guidelines for Concentrations of Undertakings

2. Compliance

   • China Introduces National Standard on Restricting Excessive Packaging of Food and Cosmetics

   • 10 Departments Release Measures for Review of Scientific and Technological Ethics (for Trial Implementation)

3. Corporate

   • China Tightens Regulations for Auto Finance Sector, Enhancing Supervision and Streamlining the Operation of Auto Finance Companies

   • SAMR Releases Implementing Measures for Administrative Provisions on Registration of Enterprise Names

4. Data Privacy & Cybersecurity

   • China Central Bank Proposes New Rules to Regulate Financial Data in Bank Sector

   • MIIT Releases Notice on Record-Filing of Mobile Web Applications

   • China Proposes New National Standard on Protection of Sensitive Personal Data

   • CAC Releases Provisions on Security Management of the Application of Facial Recognition Technology (Draft for Comment)

5. Private Equity Funds

   • China Introduces New Rules for Private Funds

Antitrust

China Amends Provisions on Prohibiting Abuse of IP Rights

新版《禁止滥用知识产权排除、限制竞争行为规定》施行

China’s top market regulator, the State Administration for Market Regulation (SAMR), issued the new Provisions Prohibiting Abuse of Intellectual Property Rights to Exclude and Restrict Competition (Revised Provisions) June 29, 2023. The Revised Provisions took effect Aug. 1, 2023, replacing the former version (SAMR Order No.74), which SAMR promulgated April 7, 2015. The Revised Provisions align with the Anti-Monopoly Guidelines issued by the State Council in 2019 (Guidelines) and aim to strengthen anti-monopoly regulation and maintain market competition while protecting intellectual property and promoting innovation. 

Highlights of the Revised Provisions include:

1. IPR-related agreements: Following the revision of the Anti-Monopoly Law, the Revised Provisions add that the business operators must not, by way of exercising intellectual property rights (IPR), organize with other business operators to reach monopoly agreements or provide substantive assistance for other business operators to reach monopoly agreements.

2. Safe harbor rule: The Revised Provisions revise the “Safe Harbor” rule to align with the Guidelines. According to the Guidelines, if the business operator can prove that (i) agreements between competitors where the combined share of the parties in the relevant market is no more than 20%; and (ii) agreements between non-competitors where the share of each party in any relevant market affected by the technology agreement is no more than 30%; and (iii) if market share information is difficult to obtain or does not accurately reflect the market positions of the parties, where, apart from the technologies controlled by the parties, there are at least four additional substitutable technologies in the relevant market that are independently controlled by third parties and obtainable at reasonable cost, such agreement will not be deemed a monopoly agreement.

3. Unfairly high pricing: The Revised Provisions outline five factors to consider whether licensing royalties or whether the price of IP products are unfairly high, including (i) the R&D costs and the recovery cycle of the intellectual property; (ii) the method for calculating royalties for the intellectual property rights and the license conditions; (iii) the comparable historical royalties or fee rate of the intellectual property; (iv) commitments made by the undertaking regarding licensing of the intellectual property rights; and (v) any other relevant factors.

4. Concentrations: The Revised Provisions specify that any technology transactions that may constitute “concentrations” must submit a merger filing in advance.

SAMR Releases Anti-Monopoly Compliance Guidelines for Concentrations of Undertakings

市场监管总局印发《经营者集中反垄断合规指引》

On Sept. 5, 2023, SAMR issued the Anti-Monopoly Compliance Guidelines for Concentrations of Undertakings (the Anti-Monopoly Guidelines). The Anti-Monopoly Guidelines provide practical recommendations to companies with compliance risks relating to concentration of undertakings, clarifying several gray zone issues as set forth below.

1. Factors that Determine Company “Control”: The Anti-Monopoly Guidelines indicate that the elements to consider when determining whether an undertaking obtains “control” under the antitrust law are not limited to acquisition of majority equity interests, but also include the right to veto material matters and other factors. The Anti-Monopoly Guidelines give the following example: an undertaking only acquires minority equity interests but obtains veto right to matters including annual business plan, budget, and appointment and removal of senior officers in the target company, which constitutes “Joint Control” and thus would trigger the declaration obligation. 

2. Timing for Declaration in Step-by-Step Transactions: The antitrust law requires that if a transaction meets the declaration standards, the undertakings must make a concentration declaration prior to entering the relevant “concentration agreement.” The Anti-Monopoly Guidelines clarify for the first time that if the same undertaking conducts a group of transactions within a certain period, which individually do not meet the declaration standards but collectively do, the undertakings must make the concentration declaration before implementing the first transaction.   

3. Circumstances Constituting “Concentration of Undertakings”: The 2023 Provisions on the Review of Concentrations of Undertakings provide that the factors to determine whether a concentration has been implemented include, but are not limited to, whether a market entity registration or registration of changes in rights has been completed, whether senior management have been appointed, whether one undertaking is actually participating in the business decision-making and management of another undertaking, and whether one undertaking has exchanged any sensitive information or substantially merged its business with another undertaking. The Anti-Monopoly Guidelines further reinstate that completion of market entity registration constitutes concentration implementation, and failure to declare a concentration before such implementation will elicit legal consequences.
   1. S&T activities involving human beings as research participants, including projects that use human beings as subjects of testing, investigation, observation, or other research activities, as well as those utilizing human biological samples, personal data, etc.;

Note that several points in the Anti-Monopoly Guidelines were previously presented in drafts of antitrust laws but ultimately removed from the laws to give the authorities certain discretion in law enforcement. Therefore, although the Anti-Monopoly Guidelines are not mandatory and do not create new obligations, companies are advised to comply with them.

Compliance

China Introduces National Standard on Restricting Excessive Packaging of Food and Cosmetics

新修订的《限制商品过度包装要求 食品和化妆品》国家标准实施

China released the National Standard on Restricting Excessive Packaging of Food and Cosmetics (the Standard), which took effect Sept. 1, 2023, and aims to reduce resource consumption and packaging waste.

The Standard applies to all food (including bulk food) and cosmetics packaging produced, sold, and imported within China. However, the Standard does not apply to food and cosmetics exported abroad, transportation packaging, and products labeled as gifts or non-sale items at the factory.

The Standard sets strict limitations on packaging layers. For food grains and their processed products, the packaging should not exceed three layers. Other food and cosmetic products should not exceed four layers.

The Standard also simplifies the method for determining excessive packaging. Consumers can judge whether a product is excessively packaged by checking the weight or volume of the product itself and measuring the volume of the outermost packaging.

In addition to the layer restrictions, the Standard also sets rules for mixed packaging of products. For instance, mooncakes should not be packaged together with other products. The Standard also specifies that the cost of packaging should not exceed a certain percentage of the product’s selling price. 

10 Departments Release Measures for Review of Scientific and Technological Ethics (for Trial Implementation)

关于印发《科技伦理审查办法（试行）》的通知

Ten departments, including the Ministry of Science and Technology (MOST), jointly released the Measures for Review of Scientific and Technological Ethics (for Trial Implementation) (the Measures), in effect as of Dec. 1, 2023.

The Measures are regulations covering science and technology ethics review in various fields, putting forth unified requirements for the basic procedures, standards, and conditions of science and technology ethics review and provide guidance for all localities and related industries.

1. The Scope of Science and Technology Ethics Reviews: The Measures provide that the following scientific and technological (S&T) activities are subject to ethics reviews:

1. S&T activities involving experimenting on animals;

2. S&T activities that do not directly involve humans or animals, but may pose ethical risks and challenges to life, health, ecological environments, public order, sustainable development, etc.; and

3. Other S&T activities requiring S&T ethics review according to relevant laws.

2. The Reviewers: Entities including higher education institutions, scientific research institutions, health care institutions, and enterprises are responsible for managing S&T ethics reviews within their own organizations. Entities engaged in life sciences, medicine, artificial intelligence, or other S&T activities, where the research content involves sensitive areas of S&T ethics, must establish a science and technology ethics review committee.

3. List System for Sensitive S&T activities: MOST will release a list of which S&T activities require expert review. Before conducting one of the listed S&T activities, the relevant entity must apply to the local or relevant industry authority for expert review.

Corporate

China Tightens Auto Finance Sector Regulations

国家金融监管总局公布修订后的《汽车金融公司管理办法》

To increase supervision and streamline the operations of automobile finance companies, the National Administration of Financial Regulation of China (NAFR) introduced the Regulations on the Management of Auto Finance Companies (the Regulations), which took effect Aug. 11, 2023.

Below are some key takeaways:

1. Stricter conditions to establish finance companies in the auto sector, including: 
   • Non-Bank Investors: Banks may not participate in the auto finance company as contributors. 

   • Principal Contributor Requirement: The principal contributor of a car finance company, i.e., the contributor who provides no less than 30% of the total registered capital, must be either a vehicle manufacturer or a non-bank financial institution. The Regulations further require that non-bank financial institutions that are principal contributors should have more than five years of experience in automobile consumer credit business management and risk control.

   • Financial Requirements for Non-Finance Institution Contributors: The non-financial institution funder of an auto finance company (i.e., an automobile manufacturer) should have no less than RMB 50 billion of revenue at the end of the most recent fiscal year.

   • Minimum Registered Capital: The minimum registered capital of auto finance companies is raised to RMB 1 billion.

2. Strengthened Corporate Governance and Internal Control Requirements: The Regulations require automobile finance companies to establish a sound corporate governance structure, stipulating specific requirements for governance bodies such as shareholders, the board of directors, the supervisory board or full-time supervisors, and senior management. For example, Article 28 of the Regulations states that “an automobile finance company shall set out in its articles of association that its major shareholders shall, if necessary, supplement capital to the company and provide liquidity support when the company has payment difficulties.”

   In addition, the Regulations require automobile finance companies to formulate and improve internal systems in line with their own operating characteristics, including the management system for related transactions, annual information disclosure system, consumer rights and interests protection mechanism, internal control mechanism, financial and accounting system, internal audit system, regular external audit system, and data management system. 

3. Foreign Investment Policy: Auto finance companies may set up overseas subsidiaries to provide financial services needed for the overseas market development of national brand cars, supporting China’s auto industry to “go global.”
   • establishes companies in more than three provincial-level administrative regions;

SAMR Releases Implementing Measures for Administrative Provisions on Registration of Enterprise Names

修订后的《企业名称登记管理规定实施办法》出台

On Aug. 29, 2023, SAMR issued Implementing Measures for the Administrative Provisions on the Registration of Enterprise Names (the Implementing Measures), which replaced the version issued in 2004 (Order of the State Administration for Industry and Commerce No. 10) and took effect Oct. 1, 2023.

Typically, company names in China should contain the following elements and should be arranged in specific sequence: (i) name of administrative division; (ii) trade name; (iii) the industry or business characteristics, and (iv) type of corporate structure. The Implementing Measures further clarify the requirements and exceptions for these elements:

According to the Implementing Measures, the company name must not contain (i) words related to major national strategic policies, which may lead the public to mistakenly believe the company is related to state investment, government credit, etc.; (ii) words like “national,” “highest,” and “the best,” which may cause the public to mistakenly believe the entity has a leading position in the industry; (iii) words that are same as or similar to prior trade names that already have obtained good standing in the industry; and (iv) words that express or imply the entity is a nonprofit, including “research center,” “academy of engineering,” etc.

Data Privacy & Cybersecurity

China Central Bank Proposes New Rules to Regulate Financial Data in Bank Sector

央行就《中国人民银行业务领域数据安全管理办法》征意

On July 24, 2023, the People’s Bank of China (PBC) issued the draft version of the PBC Business Field Data Security Management Measures (the Draft Measures), which was open for public comment until Aug. 24, 2023. The 2021 Data Security Law of China put forth the data classification and grading protection mechanism, while the details of implementing this mechanism were left for regulators in different sectors. In the Draft Measures, the PBC proposes to establish a system of accountability for data security and punitive measures for violations, seeking to manage all data processing activities.

1. Scope of Application: The Draft Measures apply to data processing activities carried out by a data handler operating in mainland Chinese banking verticals under PBC supervision. According to the explanatory notes, these are mainly monetary policy operations, cross-border RMB business, interbank market transactions, comprehensive financial industry statistics, payment and clearing, currency management and digital RMB, treasury management, credit reporting, and anti-money laundering.

2. Management Principles and Goals: Data security work follows the basic principle of “whoever manages the business manages the business data and the data security.” Data handlers should fulfill their data security obligations, take effective measures to prevent risks such as data being tampered with, destroyed, leaked, or improperly obtained and used, and ensure their data security mechanism serves to avoid harming national security, public interest, financial order, and the legitimate rights and interests of individuals and organizations.

3. Data-focused – but not just personal data: The Draft Measures focus on data protection broadly instead of just personal information protection. The explanatory notes clarify that personal information is a specific type of data, and the Draft Measures defer to the personal information protection requirements under other laws, regulations, and PBC rules. The notes also indicate that the PBC may in the future issue other department rules on personal information protection.

4. Data Classification: The Draft Measures divide data into three levels: general, important, and core, according to accuracy, scale, and impact on national security. Data handlers should accurately identify and determine whether the full amount of data stored in their information system belongs to the important data or core data categories. In addition, the Draft Measures imply that the PBC will issue a long-awaited classification standard through which important data can be identified. In-scope institutions will need to identify important data (as well as core data and general data) and submit a catalogue to the PBC.

5. Data Security Protection Management Measures: Data handlers should strictly manage the establishment and authority of various business processing accounts, database administrators, and other privileged accounts of information systems according to the principle of minimum necessity and separation of duties, and adjust permissions or withdraw accounts when personnel changes.

6. Data Collection Protection Management Measures: Data handlers should follow the principles of legality and fairness when collecting data and take appropriate security protection management measures.

7. Cross-border Data Transfer: The Draft Measures reiterate the “security assessment” requirement for certain cross-border data transfers set out under the higher-level laws – i.e., a prior “security assessment” must be cleared if (i) any “important data” is to be transferred out of China; (ii) the personal data exporter has been identified as an operator of critical information infrastructure; (iii) the personal data exporter processes personal data of more than 1 million individuals; or (iv) the personal data exporter has transferred the personal data of 100,000 individuals or the sensitive personal data of 10,000 individuals out of China since Jan. 1 of the previous year.

Further, the Draft Measures require data handlers to calculate or estimate the accumulated volume and scale of outbound data transfer in the previous two years by Jan. 31 of each year. The results of such calculation or estimate, as well as the contact details of the relevant overseas recipients, must be retained for at least three years.

The Draft Measures clarify that the PBC is responsible for handling data access requests from international organizations and foreign financial regulators. Without approval from the PBC and other relevant competent authority, data processors must not provide data stored within China to any such international organizations or foreign financial regulators.

MIIT Releases Notice on Record-Filing of Mobile Web Applications

工信部发布《工业和信息化部关于开展移动互联网应用程序备案工作的通知》

On July 21, 2023, the Ministry of Industry and Information Technology of the People’s Republic of China (MIIT) issued the Notice on Record-Filing of Mobile Web Applications (Notice). According to the Notice, starting Sept. 1, 2023, all mobile web applications that engage in internet information services within the PRC are required to go through internet content provider (ICP) filing procedures. The Notice applies to mobile applications released in app stores as well as apps in the form of mini programs within other mobile applications.

According to the Notice, the ICP filing procedures must be completed before the mobile internet application can engage in internet information services. For apps that launched before the Notice, app developers must undergo the ICP filing procedures before March 31, 2024. Otherwise, these apps will be removed from the app stores.

The app developer must complete a filing form, which contains ICP-filing entity information and a brief introduction of app information, and they must carry out ICP-filing procedures with their local provincial communication administrations. The network access service providers and app distribution platforms must conduct verification online through the National Internet Basic Resource Management System. Once the filing materials are completed, provincial communication administrators will review within 20 working days.

China Proposes New National Standard on Protection of Sensitive Personal Data

信安标委就《信息安全技术 敏感个人信息处理安全要求》征意

On Aug. 9, 2023, the National Information Security Standardization Technical Committee of China (TC260) released a draft cybersecurity national standard – the Information Security Technology - Security Requirements for Handling Sensitive Personal Information (Draft Standard) for public comment. It proposes ways to identify sensitive personal information and stipulates the security requirements for handling sensitive personal information. The public comment period ended Oct. 8, 2023, and the TC260 is yet to publish another version of the Draft Standard.

The Personal Information Protection Law (PIPL) defines sensitive personal information as personal information that, once leaked or illegally used, can easily harm the dignity of a natural person or endanger personal and property safety. It also lists the types of sensitive personal information, including biometric identification, religious beliefs, specific identities, medical health, financial accounts, whereabouts, and the personal information of minors under the age of 14.

The Draft Standard, based on the PIPL’s stipulations, proposes the following further regulation of sensitive personal data:

Identification of sensitive personal data: The Draft Standard states that sensitive personal information falls into the below categories:

1. The leakage or illegal use of such personal information could easily lead to the infringement of a natural person’s dignity. For example, the data subject may be subjected to discriminatory treatment due to the leakage of information such as specific identity, criminal record, religious beliefs, sexual orientation, specific diseases, or health status.

2. The leakage or illegal use of such personal information could easily endanger the personal safety of a natural person, e.g., the leakage or illegal use of financial account information and its related identification information (such as payment passwords) may cause property loss.

3. Considering the overall attributes of such personal information after it has been pieced together, if the aggregated personal information is leaked or illegally used, it may have a significant impact on personal rights and interests.

Protection of sensitive personal information: The Draft Standard elaborates on the security protection and security management requirements that must be met when processing sensitive personal information. For example, when transmitting sensitive personal information on the internet, the Draft Standard requires that, at minimum, channel encryption be used for transmission, and it is advisable to use a combination of channel encryption and content encryption. The channel encryption and content encryption algorithms should comply with the relevant industry technical standards and the requirements of the industry competent department; applications and API asset lists should be sorted out regularly; and audits should be conducted regularly on the transmission of sensitive personal information by applications and APIs, etc.

When accessing sensitive personal information, the Draft Standard requires that on the basis of role permission control, operation authorization should be triggered according to the requirements of the business process, and logs should be audited regularly for operations such as access, modification, deletion, and export of sensitive personal information. A monitoring and warning and response mechanism should be established for abnormal activity, such as operations that exceed normal business needs (e.g., frequent, large-scale browsing, downloading, printing of sensitive personal information, non-working hours operations, etc.), which should be interrupted. Warnings should be issued through emails, messages, pop-ups, etc. as part of the analysis and investigation of abnormal activity and in order to eliminate hidden dangers in advance. Watermarks including access subject identification, access time, etc. should be added to the sensitive personal information display interface, and functions such as copying, printing, and screenshotting should be disabled by default.

In addition, the Draft Standard stipulates special security requirements for processing biometric information, religious belief information, specific identity information, medical health information, financial account information, trajectory information, and information of minors under the age of 14. Note that the “Draft Standard Opinion” references current national standards of the relevant information industry, in addition to proposing new regulations. In other words, it supplements the regulations based on current industry standards to avoid the repetitiveness of various standard contents. For example, when processing biometric information, the Draft Standard notes it is required to meet the Information Security Technology Basic Requirements for Biometric Identification Information Protection (GB/T 40660—2021); similarly, in terms of medical health information, it is required to first meet the provisions of the Information Security Technology Health Medical Data Security Guide (GB/T 39725—2020).

CAC Releases Provisions on Security Management of the Application of Facial Recognition Technology (Draft for Comment)

国家网信办就《人脸识别技术应用安全管理规定》征求意见

On Oct. 8, 2023, the Cyberspace Administration of China (CAC) released Provisions on Security Management of the Application of Facial Recognition Technology (Draft for Comment) (Draft Provisions) for public comment. The public comment period closed Sept. 7, 2023. 

Under the PRC’s personal information protection regime and according to the PIPL, facial recognition, as a type of biometric data, is regulated as sensitive personal information and thus has heightened security requirements for processing — such as additional encryption and pseudonymization measures, separate storage with other identifying personal information, and timely destruction of original biometric data. The Draft Provisions propose that facial recognition technology be used only when there is a specified purpose and sufficient necessity, with strict protective measures. At the same time, non-biometric identification solutions should be adopted where such methods are equally effective. 

The Draft Provisions emphasize that when facial recognition uses technology to identify human faces, that person must give separate or written consent. Businesses should consider taking the following actions to safeguard the use of facial recognition information: (i) keep only what is needed for business; (ii) protect the information that is kept; (iii) properly dispose of any information that is no longer needed; and (iv) create a security plan to respond to incidents. Controllers wishing to utilize facial recognition technologies need to undergo a personal information protection impact assessment and properly document the assessment result for at least three years prior to processing. Controllers processing more than 10,000 individuals’ facial recognition data in public areas, apart from the mandatory personal information protection impact assessment, are also required to report to the local CAC about such processing within 30 days prior to commencing the processing activity. Once finalized, the Draft Provisions will apply to both the controllers that collect and process the facial recognition data, and the parties providing the facial recognition devices, technology, and services. The Draft Provisions further emphasize the confidentiality obligations for the facial recognition technology service and/or device providers.

Private Equity Funds

China Introduces New Rules for Private Funds

国务院公布《私募投资基金监督管理条例》

The Chinese government introduced the Regulations on the Oversight and Administration of Private Funds (Private Fund Regulation) to regulate the business activities of private funds, protect the legitimate rights and interests of investors and related parties, and promote the standardized and healthy development of the private fund industry. This regulation took effect Sept. 1, 2023.

1. Scope of Application: The Private Fund Regulation applies to funds raised in a non-public manner in China, the establishment of investment funds or companies, partnerships managed by private fund managers or general partners that are established for the purpose of conducting investment activities, and investment activities for the benefit of investors.

2. Obligations of Private Fund Managers and Custodians: The Private Fund Regulation clarifies the circumstances when one may not become a private fund manager, or its controlling shareholder, actual controller, director, supervisor, senior management personnel, etc., and stipulates that practitioners should receive compliance and professional ability training as required. It provides that private fund managers should fulfill registration procedures with the institution entrusted by the State Council Securities Regulatory Commission and clarifies the circumstances for registration cancellation.

3. Fundraising and Investment Operations: Private funds should be raised or transferred to qualified investors, and the cumulative number of investors in a single private fund should not exceed the number stipulated by law. Private fund managers should match private fund products of different risk levels according to investors’ risk identification ability and risk tolerance.

4. Supervision and Enforcement: To ensure market stability and safeguard investor interests, the Private Fund Regulation introduces a comprehensive monitoring mechanism for privately offered funds. This system enables centralized oversight of fund operations and investor holdings. The State Council’s securities regulatory authority will supervise this monitoring process, taking necessary actions to enforce compliance with the regulation’s provisions. The regulator retains the authority to shut down operations, replace directors and senior executives, and mandate third-party audits if fund managers engage in activities detrimental to fund operations and investor interests, as outlined in the new rules. Various infractions, including improper fund property use, non-public information disclosure, and non-compliance with regulations, could result in fines, warnings, or suspension of business operations.

5. Foreign-invested fund managers and cross-border fundraising: The Private Fund Regulation states that administrative guidelines for foreign-invested private fund managers will be separately formulated by the China Securities Regulatory Commission and relevant State Council departments, aligning with foreign investment rules. This suggests that new regulations tailored to foreign-invested private fund managers are forthcoming. The Private Fund Regulation states that foreign institutions generally cannot directly raise funds from domestic investors to establish private funds unless the state specifies exceptions. Private fund managers conducting fund activities overseas must adhere to pertinent state regulations.

   While the extent of these exceptions remains unclear, it is presumed to encompass rules linked to programs enabling foreign asset managers to secure capital from domestic Chinese investors for overseas investments, such as QDII (Qualified Domestic Institutional Investors), QDLP (Qualified Domestic Limited Partners), and QDIE (Qualified Domestic Investment Enterprise).

   Nonetheless, global asset managers should be cautious when considering fundraising from domestic Chinese investors (via cross-border models), ensuring the fundraising is not misconstrued as a regulated activity within China.