Data, Privacy & Cybersecurity

TC260 seeks comments on draft Information security technology —Security requirements of vehicle collected data

信安标委就《信息安全技术 汽车采集数据的安全要求》征求意见

The National Information Security Standardization Technical Committee (TC260) released the draft national standard “Information security technology —Security requirements of vehicle collected data” (Draft Standard) Oct. 19, 2021, soliciting public opinions through Dec. 18, 2021.

The Draft Standard largely echoes the Provisions on the Administration of Automotive Data Security (Provisions) promulgated by Cyberspace Administration of China (CAC) two months before, and specifies more detailed safety requirements for processing activities, such as transmission and storage of vehicle collected data, with the standards applying to the design, production, sale, use, operation, and maintenance of vehicles.

More specifically, the Draft Standard outlines requirements associated with the transmission and storage of vehicle collected data, including that (i) without the individual’s consent, the vehicle should not transmit data containing personal information outwards, and (ii) data storage outside the vehicle should not exceed 14 days. In addition, the Draft Standard stipulates cross-border transfer requirements from vehicles, providing that out-of-car, cockpit, and satellite positioning data should not be exported. If the export is essential, a data security assessment organized by CAC must be conducted.

---

CAC seeks comments on draft Measures for Data Export Security Assessments

国家网信办就《数据出境安全评估办法》征求意见

On Oct. 29, 2021, the Cyberspace Administration of China (CAC) released draft Measures for Data Export Security Assessments (Draft Measures), soliciting public comments through Nov. 28, 2021. Compared with CAC’s 2017 and 2019 drafts regarding the cross-border transfer of personal information, the Draft Measures reflect a strict position toward data export administration, especially the cross-border transfer of both important data and personal information aggregated to a certain amount. The Draft Measures also provide for serious consequences for non-compliance.

1. Who will be subject to the security assessment of data exports?

Pursuant to Article 2 of the Draft Measures, any data handler providing cross-border data transfer of either (i) important data collected and generated during its operations in the territory of China, or (ii) personal information subject to security assessments according to Chinese laws and regulations shall be subject to the Draft Measures. Furthermore, under the following four circumstances, the handler must apply for a security assessment jointly conducted by CAC and other regulators:

• Personal information and important data collected and generated by critical information infrastructure operators (CIIO); or

• The data to be exported contains important data; or

• Personal information handlers who process personal information of at least one million individuals provide personal information cross-border; or

• Cumulative transfer of cross-border personal information of more than 100,000 individuals or sensitive personal information of more than 10,000 individuals.

2. Self-assessment as a pre-condition

Article 5 of the Draft Measures requires that before initiating a cross-border data transfer, data handlers must conduct a self-assessment of data export risks, which focuses on the following aspects:

• The legality, legitimacy, and necessity of the purpose, scope, and method of data processing of the data export and overseas recipients;

• The quantity, scope, type, and sensitivity of the data to be exported, and the risks that the exported data may pose to national security, public interests, and the legitimate rights and interests of individuals or organizations;

• Whether the data handler’s management and technical measures and capabilities in the data transfer link can prevent risks such as data leakage and damage;

• The responsibilities and obligations the overseas recipient promises to fulfill, and whether the management and technical measures and capabilities to perform the responsibilities and obligations can guarantee the exported data’s security;

• Risks of data leakage, damage, tampering, abuse, etc. after the data is exported and re-transferred, whether the channels for individuals to maintain personal information rights and interests are unblocked, etc.; and

• Whether the data-export-related contracts concluded with overseas recipients fully stipulate responsibilities and obligations for data security protection.

• After the assessment, data handlers must write a “data export risk self-assessment report,” which would be one of the essential filing documents when applying for a security assessment conducted by CAC.

3. Requirements for data export contracts between data handler and offshore recipient

The Draft Measures also require that the data handlers contract with the data recipients to clarify the obligations and liabilities for ensuring data security. According to Article 9 of the Draft Measures, the following terms must be included in such contract:

• The purpose, method, and scope of data exports, the purpose and method of data processing by overseas recipients, etc.;

• The location and duration of data storage overseas, and the processing measures for the exported data after the storage period expires, the agreed purpose is fulfilled, or the contract is terminated;

• Binding clauses restricting overseas recipients’ transfer of the exported data to other organizations and individuals;

• The security measures that the overseas recipient should take when the actual control rights or business scope of the foreign party undergo a substantial change, or the legal environment of the country or region where it is located makes it difficult to ensure data security;

• Liability for breach of data security protection obligations and binding and enforceable dispute resolution clauses; and

• In the event of data leakage and other risks, properly carry out emergency responses and ensure unobstructed channels for individuals to safeguard their personal information rights.

4. General Procedure of a state-conducted security assessment

In cases of a mandatory CAC security assessment, the data handler must first apply to the provincial CAC branches, filing documents including the application form, self-assessment report, and contracts relevant to data export, etc. The CAC must provide written feedback within seven days, indicating whether or not the case was accepted. The assessment must then be completed within 45 days, which can be extended to 60 days in special cases. The CAC will then issue a written assessment certification, which is effective for two years. The data handler may conduct the export only after receiving this certification.

However, a re-assessment still will be required if there are changes in (i) the purpose, method, scope, and type of data provided overseas, (ii) the use and method of data processing by overseas receivers, (iii) the storage period of the exported data, (iv) the legal environment of the country or region where the overseas receiver is located, (v) actual control of the data handler or the overseas receiver, (vi) the contract between the data handler and the overseas receiver, etc., which may affect the exported data’s security.

5. Potential liabilities

Failure to act in accordance with the Draft Measures will result in administrative measures (including warning, fine, etc.) or even criminal punishment in very serious cases. In particular, if data handlers fail to conduct data export activities in compliance with the requirements specified in the CAC’s assessment results, the CAC could revoke the assessment certification and ask data handlers to cease the data transfer. 

---

The MIIT solicits comments on the Measures on the Administration of Data Security in the Industry and Information Technology Sector (Trial)

工信部就《工业和信息化领域数据安全管理办法（试行）》征求意见

On Sept. 30, 2021, the Ministry of Industry and Information Technology (MIIT) released the Measures on the Administration of Data Security in the Industry and Information Technology Sector (Trial) (Draft) and sought  public comments through Oct. 30, 2021.

The Draft complies with the Data Security Law and clarifies rules regarding the management of industrial data and telecommunications data. The Draft mainly involves:

• Data categories

In accordance with the Data Security Law, the Draft has three data categories:

1. “Core data” under the Draft is broadly defined as any data that could “seriously” threaten Chinese national and economic security or the normal functioning of industrial and telecommunication sectors, and it is afforded the highest degree of protection and regulation.

2. “Important data” is the next-most sensitive level of data, which includes data that poses a threat to China’s national and economic interests or that impacts the normal functioning of industrial and telecommunication sectors, and data for which recovery or elimination of negative effects would be costly.

3. “Ordinary data” is data that has a minimal ability to impact the aforementioned areas.

   • Data management

The Draft clarifies that the data processor is responsible for ensuring the data management system is safe, accurate, and available. Meanwhile, a separate department and position are required to manage important data and core data. The different disciplines that are part of the overall data management system cover a series of steps, including data collection, storage, processing, transferring, etc.

---

The NISSTC seeks comments on the draft Practical Guide to Cybersecurity Standards – Guide to Data Classification and Grading

信安标委就数据分类分级指引征求意见，10月8日

The National Information Security Standardization Technical Committee (NISSTC) released a draft Practical Guide to Cybersecurity Standards – Guide to Data Classification and Grading (Draft) and solicited public opinions through Oct. 13, 2021.

The Draft establishes a framework for classifying data based on its level of sensitivity, value, and criticality to the nation as required by the Data Security Law.

The Draft proposes several rules for personal information, public data, and institutional data identification. The Draft also clarifies what is considered sensitive personal information. One of the most important standards is whether illegal use of sensitive personal information directly violates human dignity. These proposed rules for data classification aim to help determine baseline security controls for the data protection.

---

全国人大常委会就《反垄断法》修正草案征求意见

On Oct. 23, 2021, the 31st session of the Standing Committee of the 13th National People's Congress issued the Anti-Monopoly Law of the People’s Republic of China (Draft Amendments) and solicited public comments through Nov. 21, 2021. Earlier in 2020, the State Administration for Market Regulation issued the Announcement on Seeking Public Comments on the Draft Amendment to the Anti-Monopoly Law (Draft for Comment). The Draft Amendments adjust and add to the Draft for Comment.

The Draft Amendments have 27 articles, mainly focusing on six aspects.

1. Enhancing the status of competition policy

The Draft Amendments revise Article 4 of the Anti-Monopoly Law from: “the State shall formulate and implement competition rules that are compatible with the socialist market economy” to: “The State shall enhance the status of the competition policy as a basic policy and formulate and implement competition rules that are compatible with the socialist market economy.”

2. Establishing a sound, fair competition review system

Article 5 reads: “The State shall establish a sound, fair competition review system. Administrative agencies and organizations authorized by laws or regulations to perform the function of administrating public affairs shall conduct fair competition reviews when formulating any regulations that involve market participants’ economic activities.”

3. Adding and amending Articles regarding monopoly agreements

1. Article 14 is amended as Article 17, of which the second paragraph reads: “An agreement as specified in sub-paragraph 1 (those on fixing the price for resale of a commodity to a third party) or 2 (those on restricting the minimum price for resale of a commodity to a third party) of the preceding paragraph will not be prohibited if the business operators can prove that it does not have the effect of excluding or limiting competition.”

2. Article 18 reads: “A business operator must not organize other business operators to enter into a monopoly agreement or provide substantive assistance to other business operators in entering into a monopoly agreement.”

3. Article 19 reads: “If business operators can prove that their market share in a relevant market is lower than the threshold set by the State Council’s AML enforcement authority, Articles 16 (horizontal monopoly agreement), 17 (vertical monopoly agreements) and 18 (organize or provide substantive assistance) of this Law shall not apply, unless there is evidence that the agreement entered into by the business operators excludes or limits competition.”

4. Regulation of monopoly acts in new industries

Article 17 is amended as Article 22, of which the second paragraph reads: “Setting an obstacle using any data, algorithm, technology, platform rules or otherwise by a business operator with a dominant market position to impose any unreasonable restriction on another business operator shall be deemed an abuse of dominant market position as prescribed in the preceding paragraph.”

5. Adding and amending the Articles regarding concentration of undertakings

1. Article 21 is amended as Article 26, of which the second paragraph reads: “Where a concentration of undertakings does not meet the threshold for declaration set by the State Council, but there is evidence that the concentration of undertakings has or may have the effect of excluding or limiting competition, the State Council’s AML enforcement authority shall conduct an investigation pursuant to the law.”

2. Article 32 reads: “Where any of the following circumstances occurs, the State Council’s AML enforcement authority may decide to suspend the calculation of the review period for the concentration of undertakings under review and notify the business operators in writing: 1. The business operators fail to submit any document or material as required, resulting in the review unable to be conducted; 2. Any new circumstance or new fact emerges which has a material impact on the review of the concentration of undertakings and will need to be verified; or 3. The restrictive conditions to be placed on the concentration of undertakings need to be further evaluated, which is agreed to by the business operators. From the day when the circumstance that caused the suspension of the calculation of the review period disappears, the review period shall resume running, which shall be notified to the business operators in writing by the State Council’s AML enforcement authority.”

3. Article 37 reads: “The State Council’s AML enforcement authority shall enhance the review of concentrations of undertaking in people’s livelihood-related, financial, science and technology, media and other fields of activities pursuant to the law.”

6. Imposing tougher penalties for monopoly acts.

Monopoly Act	Situation	Anti-monopoly Law	Draft Amendments
Monopoly Agreements	entering into and implementing a monopoly agreement (sales)	1%-10% of the operator’s sales in the preceding year	1%-10% of the operator’s sales in the preceding year
	entering into and implementing a monopoly agreement (no sales)	N/A	a fine of not more than CNY5 million
	the monopoly agreement entered into has not been implemented (both sales and no sales)	a fine of not more than CNY500,000	a fine of not more than CNY3 million
	the legal representative, main responsible person, or any directly responsible person of the business operator’s organization	N/A	a fine of not more than CNY1 million
	operator organizes other business operators to enter into a monopoly agreement or provides any substantive assistance	N/A	same as above
	a trade association violated this law	a fine of not more than CNY500,000	a fine of not more than CNY3 million
Abuse of Dominant Market Position	abuse of dominant market position	1%-10% of the operator’s sales in the preceding year	1%-10% of the operator’s sales in the preceding year
Concentration of Undertakings in Violation of the Law	has or may have an effect of excluding or limiting competition	a fine of not more than CNY500,000	a fine of not more than 10% of the operator’s previous year’s sales
	does not have an effect of excluding or limiting competition		a fine of not more than CNY5 million
Acts in any Way Obstructive to the Investigation	entity (sales)	a fine of not more than CNY1 million	a fine of not more than 1% of the operator’s previous year’s sales
	entity	N/A	a fine of not more than CNY5 million
	individual	a fine of not more than CNY100,000	a fine of not more than CNY50,000
Exceptional Pernicious Impact and Exceptional Grave Consequences			In the case of a particularly grave violation of this law with an exceptional pernicious impact and exceptional grave consequences, the AML enforcement authority may impose a fine of not less than two times but not more than five times the amount of the fine stated in Article 56, 57, 58, or 62.

---

SAMR releases Guidelines for the Overseas Anti-monopoly Compliance of Enterprises

国家市场监督管理总局发布《企业境外反垄断合规指引》

The State Administration for Market Regulation (SAMR) released Guidelines for the Overseas Anti-monopoly Compliance of Enterprises (Guidelines) on Nov. 15, 2021, aiming to advise Chinese companies on how to strengthen their overseas antitrust compliance management and reduce risk. The main audience for the Guidelines is Chinese companies either (i) conducting business overseas, or (ii) conducting business domestically while potentially making an impact on the overseas market with activities including import and export, outbound investment, M&A, transfer of IP, tendering and bidding, etc.

The Guidelines briefly explain anti-monopoly practices in other jurisdictions, including the business activities subject to antitrust regulations, the general procedure of an overseas antitrust investigation and litigation, as well as the potential liabilities for violating anti-monopoly laws. Further, the Guidelines provide a general framework of overseas anti-monopoly compliance management systems, suggesting measures that Chinese enterprises could take to lower the relevant legal risks.

However, SAMR also emphasizes that the Guidelines are only a sketch of overseas anti-monopoly issues and are intended as a reference for Chinese companies.

---

Foreign Investment

NDRC and MOFCOM issue updated 2021 Negative List and 2021 FTZ Negative List

国家发改委和商务部发布《外商投资准入特别管理措施（负面清单）（2021年版）》及《自由贸易试验区外商投资准入特别管理措施（负面清单）（2021年版）》

On Dec. 27, 2021, the National Development and Reform Commission of China (NDRC) and the PRC Ministry of Commerce of China (MOFCOM) jointly issued China’s updated foreign investment negative lists:

• the Special Administrative Measures (Negative List) for Foreign Investment Market Access, 2021 Version (2021 National Negative List); and

• the Special Administrative Measures (Negative List) for Foreign Investment Market Access to Pilot Free Trade Zones, 2021 Version (2021 FTZ Negative List).

Both the 2021 National Negative List and the 2021 FTZ Negative List (jointly New Negative Lists) came into effect Jan. 1, 2022, replacing the previous Negative List 2020 and FTZ Negative List 2020.

1. Further reduction in foreign investment restrictions

The New Negative Lists contain no additional entries of restricted industries and sectors, compared to their 2020 counterparts. Instead, the number of entries decreased, dropping from 33 to 31 in the 2021 National Negative List, and from 30 to 27 in the 2021 FTZ Negative List. The following areas reflect the reduction:

• Restrictions on automotive manufacturing removed. The New Negative Lists remove the requirement that “PRC capital must be no less than 50% for manufacturers of passenger vehicles” and the requirement that “a single foreign investor may establish up to two joint ventures (“JVs”) in the PRC to manufacture the same type of vehicles.” For the first time, the automotive manufacturing industry is fully open to foreign investment.

• Restrictions on television and broadcasting equipment manufacturing removed. The New Negative Lists no longer contain the entry “investment in the manufacturing of ground receiving facilities and key parts for satellite television broadcasting,” opening up the manufacture of ground-receiving facilities and key components for satellite television broadcasting to foreign investment.

• Zero manufacturing entries for pilot-free trade zones (FTZs). This revision results in zero manufacturing entries for FTZs, demonstrating that the PRC is willing to give further access to and promote its manufacturing industry.

• Relaxed foreign investment restrictions with respect to “market surveys” and “social surveys” for FTZs. In addition to the 2021 National Negative List, the 2021 FTZ Negative List has eased foreign investment restrictions on “market surveys,” no longer requiring “market surveys to be limited to JVs.” Similarly, the restriction on foreign investment for “social surveys” has also been eased. The agencies changed the provision banning foreign investment in the sector to a restrictive one, stating that “PRC capital must be no less than 67% and the legal representative must have Chinese nationality.”

2. Overseas securities listing

Furthermore, the 2021 National Negative List includes a new provision regarding the overseas listing of domestic companies engaging in prohibited business. Section VI of the note to the 2021 National Negative List states that, where Chinese companies engaging in prohibited businesses intend to complete overseas offering and listing, the following three conditions must be satisfied:

• Completion of review and approval by competent authorities,

• Foreign investors may not participate in operating and managing the Chinese companies, and

• A shareholding percentage limit will apply to the foreign investment, as currently applicable to foreign investment in the Chinese stock market, i.e., any single foreign investor (including with its affiliates) cannot hold more than 10% of the issuer’s total capitalization, and all foreign investors cannot hold more than 30% of the issuer’s total capitalization.

However, whether the aforementioned permission will apply to an indirect overseas offering of an issuer with VIE structures remains unclear.

---

Corporate

The Standing Committee of the 13th National People's Congress Seeks Public Comment on the Amendment to Company Law of the People’s Republic of China

全国人大常委会就《中华人民共和国公司法（修订草案）》征求意见

On Dec. 24, 2021, the Standing Committee of the 13th National People’s Congress released the draft Amendment to Company Law of the People’s Republic of China (Draft Amendment), seeking public comment. The Draft Amendment revises and adds to the current version around 70 articles, which introduce a number of substantial changes to Company Law, listed below. The comment period closed on Jan. 22, 2022.

1. Stronger Rules on Shareholder Liability toward Capital Contribution

   • Forfeiture of Shares. Article 46 of the Draft Amendment creates a new system that requires companies to notify and give a grace period of no less than 60 days to shareholders who fail to make a full payment of capital contribution in time or who contributed non-cash assets whose value is substantially lower than the equity interests subscribed for, to make up the capital contribution in full. If any shareholders fail to fulfill their capital contribution obligation within the grace period, the company may require the shareholder to forfeit the portion of equity interests or shares that have not been paid and, and the company may either transfer or go through the capital decrease process to cancel the forfeited equity interest or shares within six months.

   • Acceleration of Capital Contribution. Article 48 of the Draft Amendment introduces the system of “acceleration of capital contribution,” which allows a company and its creditors to require shareholders to make capital contributions regardless of the payment schedule when the company clearly lacks the ability to repay its debts.

   • Defective Contribution and Contribution Withdrawal. With respect to shareholders’ liability in case of defective contribution and contribution withdrawal, Articles 47 and 52 of the Draft Amendment absorb several provisions from the Supreme People’s Court’s judicial interpretations and further clarify that the shareholders must make up the capital contribution and pay interest to the company at a bank’s deposit rate.

2. Reform on Internal Governance Organs of Companies

   • Employee Director. In the current version of Company Law, only state-owned companies are required to include an employee representative on the board of directors. Article 63 of the Draft Amendment applies the employee-director requirement to all companies with more than 300 employees, regardless of the nature of the shareholders.

   • Audit Committee and Supervisory Board. In the current version of Company Law, all companies are required to have a supervisory board or one or two supervisors to act as the supervising body organ of the company. Article 64 of the Draft Amendment gives companies the option to replace the supervisory board with an audit committee consisting of board members.

   • Board of Directors. In the current version of Company Law, companies must have a board of directors consisting of at least three but no more than 13 directors. Small companies or companies with a limited number of shareholders may instead decide to appoint one executive director to exercise the powers and duties of a board. Articles 63 and 70 of the Draft Amendment remove the restriction on the maximum number of directors of the board and propose that only small companies can choose to use one executive director in lieu of a board.

   • Powers of Supervisory Board. Article 81 of the Draft Amendment gives the supervisory board the right to require reports regarding work performance from directors and senior officers.

3. Improve Rules on Obligations of Directors, Supervisors, and Senior Officers

   • Duty of Loyalty and Diligence of Directors. Under the current version of Company Law, directors owe the company a duty of loyalty and duty of diligence. Article 180 of the Draft Amendment further clarifies that duty of loyalty requires directors not to seek improper interests by taking advantage of their functions and powers, and duty of diligence requires directors to perform their duties to the best reasonable care normally expected of a director.

   • Affiliate Transactions. Article 183 of the Draft Amendment requires that directors, supervisors, and senior managers report to the board or shareholder meeting if the directors, supervisors, senior managers, or the close relatives of any of these figures has transacted with the company.

   • Obligations regarding Capital Maintenance. Articles 47, 52, 207, and 222 of the Draft Amendment provide the directors, supervisors, and senior managers’ compensation obligations in case of deficiency contribution or contribution withdrawal by shareholders, and in case of illegal dividend distribution or illegal capital reduction by the company.

   • Joint and Several Obligations with the Company. Article 190 of the Draft Amendment states if a director, supervisor, or senior manager causes damage to a third person during performance of duties due to their willful conduct or gross negligence, this director, supervisor, or senior manager will be responsible for compensation to the third party jointly and severally with the company.

   • Director Removal. Article 66 of the Draft Amendment provides that if a company dismisses a director without providing proper reason, the dismissed director may request compensation from the company.

4. New Rules for Merger, Capital Reduction, and Company Liquidation Process

   • Merger Without Approval of Shareholder Meeting. Article 215 of the Draft Amendment allows a company to merge with another company only with approval of the board of directors in the following two scenarios: (i) the company merges with its shareholder which holds more than 90% equity interest of the company, or (ii) the price paid for the merger transaction is less than 10% of the net worth of the company, provided, for scenario (i) the other shareholders may request that the company repurchase its shares at a reasonable price; and for scenario (ii) the articles of the company do not contain any provisions against such arrangement.

   • Simplified Capital Reduction Process. In the current version of Company Law, when a company conducts a capital reduction process, creditors can require early payment of debts or additional securities from the company. Article 221 of the Draft Amendment provides that a company which cannot cover its deficit after making up losses with statutory and other funds in accordance with Company Law may reduce its registered capital by publishing a notice, and creditors are not entitled to ask the company to repay debts ahead of the payment schedule. After completing the simplified capital reduction, the company cannot distribute profits until the amount of the statutory funds exceeds the registered capital of the company.

   • Liquidation Obligators. Article 228 of The Draft Amendment proposes that directors be the liquidation obligators and, unless the company’s articles of association otherwise stipulate, the directors shall constitute the liquidation committee. Liquidation obligators will be responsible for damages caused to the company and creditors if they fail to perform their liquidation obligations.

5. Reform in the Capital System of Companies Limited by Shares.

   • Authorized Capital System. Articles 97 and 164 of the Draft Amendment for the first time allow the board of directors of a company limited by shares, with authorization and subject to conditions set forth in the articles of association or by the shareholder meeting, to decide to issue shares that are not issued to the shareholders during incorporation, provided that two-thirds of directors consent to the issue. I. However, if the number of new shares exceeds 20% of the total voting power of company shares, the issue must be resolved at the shareholder meeting.

   • Class of Shares and Par Value. Articles 155 and 157 of the Draft Amendment provide that companies may issue shares with or without par value, and they may issue more than one class of shares.

6. Improved Special Rules Applicable to State-Invested Companies

   • Scope of the state-invested company. The current version of Company Law only sets special rules for companies wholly owned by the state. The Draft Amendment extends the application of special rules under Company Law to state-controlled companies. The definition of state-controlled companies is not set forth in Company Law.

   • Communist Party enhances leadership role of State-Invested Companies. Article 145 of the Draft Amendment adds that the Communist Party shall play a lead role in state-invested companies and discusses the company’s major business and management matters.

   • Governmental approval required for state-invested companies. Article 152 of the Draft Amendment provides that the merger, division, dissolution, bankruptcy, and appointment of directors of important state-invested companies will be subject to approval by the competent government.

7. Other Important Changes

   • Removal of special restrictions and requirements on sole shareholder companies. In the current version of Company Law, a shareholder can only have one sole shareholder company, and such sole-shareholder company is prohibited from setting up another sole-shareholder company. The Draft Amendment removes these special restrictions and requirements.

   • Capital Reserve Fund. In the current version of Company Law, a capital reserve fund cannot be used for making up losses. Article 210 of the Draft Amendment allows companies, after running out of statutory funds and other funds, to make up losses using a capital reserve fund.

---

Compliance

The National Development and Reform Commission Seeks Public Comments on the Negative List for Market Access (2021 Version)

国家发改委就《市场准入负面清单（2021年版）》征求意见

On Oct. 9, 2021, the National Development and Reform Commission (NDRC) issued an Announcement Seeking Public Comments on the Negative List for Market Access (2021 Version) (Negative List 2021) and sought public comments until Oct. 14, 2021. This is the fourth version released since China officially implemented the negative list system in 2018. The list comprises sectors prohibited or restricted for investment from both Chinese and foreign companies without special regulatory approval.

The Negative List 2021 includes prohibited and approved matters. Market players must not engage in prohibited access matters, and administrative organs must not examine or approve them or handle the relevant formalities. Market players must submit applications regarding approved access matters, including relevant qualification requirements and procedures, technical standards, and approval requirements, and administrative agents must decide on access based on laws and regulations, or market players may enter according to the access conditions and methods the government stipulates. All kinds of market players may, legally and equitably, enter into industries, fields, business, etc. the List does not include. The Negative List 2021 includes six prohibited matters—one more than the Negative List 2020 —and 111 approved matters — seven fewer than the Negative List 2020 — for a total of 117 matters, down from 123 in the Negative List 2020.

The Negative List 2021 mainly focuses on two aspects.

1. Prohibition of any news-media-related business activity in breach of provisions.

This is a new prohibited matter. Specifically, market players must not engage in the following six matters.

1. Non-public capital must not engage in news gathering, editing, and broadcasting businesses.

2. Non-public capital must not invest in the establishment or operation of news institutions, including but not limited to news agencies, newspaper publishers, radio and television broadcasters, radio and television stations, as well as internet news information gathering and publication service institutions, etc.

3. Non-public capital may not operate news institutions’ layouts, frequencies, channels, columns, public accounts, etc.

4. Non-public capital may not engage in live broadcast businesses in the fields of politics, economics, military, and foreign affairs, or major activities or incidents in society, culture, technology, health, education, sports, etc. that are related to political orientation, the orientation of public opinion, and values orientations.

5. Non-public capital may not introduce news released by foreign entities.

6. Non-public capital may not host summits and award selection activities in the field of news and public opinion.

2. Removal of seven approved matters.

The Negative List 2021 has seven fewer approved matters than the Negative List 2020.

1. Information transmission, software, and information technology services. The Negative List 2021 removes the previously approved matter stating that without a license, it is prohibited to rent overseas satellite resources or establish an international communication access bureau. Meanwhile, a matter stating that without a license, it is prohibited to conduct telecom business or construct and use telecom networks or telecom resources has been updated to include approval for the renting of overseas satellite resources by domestic entities and examination, as well as for the establishment of international communication access bureaus. The Ministry of Industry and Information Technology is the relevant department to conduct such examination and approval.

2. Finance. The Negative List 2021 removes the previously approved matter stating that without a license, it is prohibited to issue shares or conduct the merger and acquisition restructuring of specified listed companies. In another matter regarding securities investment, the new list updates the language to state that without a license or the fulfillment of statutory procedures, it is prohibited to engage in relevant business such as securities investment, the issuance of derivative products, and foreign exchanges. The list also amends the matter to state that the China Securities Regulatory Commission conducts the approval of companies issuing shares and depositary receipts.

3. Leasing and commercial services industries. The Negative List 2021 removes the previously approved matter stating that without a license, it is prohibited to engage in foreign-related statistical investigation business.

4. Water conservancy, environmental, and public facilities management industries. The Negative 2021 List removes the previously approved matter stating that without a license or qualification accreditation, it is prohibited to conduct the construction or detection of lightning protection devices in limited areas has been deleted.

5. Education. The Negative List 2021 removes the previously the approved matter stating that without a license, it is prohibited to conduct security guard training business.

6. Health and social work. The Negative 2021 list removes the previously approved matter stating that without a license or qualification, it is prohibited to engage in medical-radioactive-products-related business.

7. The Negative 2021 list removes the previously approved matter stating that it is prohibited to engage in Internet financial information services without a license in the Catalog of the Prohibition and Approval for Internet Market Access.

---

市场监管总局等两部门联合印发《市场监管领域重大违法行为举报奖励暂行办法》

The State Administration for Market Regulation (SAMR) and the Ministry of Finance (MOF) jointly released the Interim Measures for Rewards for Whistleblower Reports of Major Violations in the Field of Market Regulation (Measures) on Aug. 20, 2021, and the Measures took effect on Dec. 1, 2021. The Measures describe the reporting of “major market violations,” the investigation of which is coordinated by th SAMR at all levels. Below are the three key areas of focus.

1. Reportable conduct

According to the Measures, reportable conduct includes “major violations” the whistleblower has reasonable grounds to suspect. “Major violations” refer to illegal acts that may have led to criminal behavior or that are subject to administrative penalties such as being ordered to suspend production or business operations, being ordered to close down, having their permits or certificates revoked (cancelled), or being fined a relatively large amount of money. To be more specific, reportable conduct includes:

1. major violations in the fields of food, drug, special equipment, product safety and quality, etc.;

2. major violations that may have effects across regions and sectors;

3. major violations that may have a significant impact on society;

4. any violations with suspected criminal implications; and

5. any other circumstances recognized by the market administer.

2. Whistleblowing methods

Whistleblowers may  raise concerns via the internet, telephone, fax, mail, service window, and other methods designated by the market administrator, and they should provide any background and history, including relevant dates and any witnesses.

3. Whistleblower rewards

The whistleblower may be rewarded 1% to 5% of what the authority recovers. The actual reward depends on several factors, including how much detail the whistleblower provides. According to the Measures, the maximum reward per case is one million yuan.

---

CNIPA issues General Trademark Violation Judgment Standards

国家知识产权局印发《商标一般违法判断标准》

Following the release of Judgment Criteria of General Violations Against Trademark Law in early August, the China National Intellectual Property Administration (CNIPA) issued General Trademark Violation Judgment Standards (Standards) on Dec. 13, 2021, aiming to refine the enforcement of trademark law. The Standards took effect Jan. 1, 2022.

The Standards, within the framework of the Trademark Law and its implementing rules, have 35 articles which mainly provide clues for identifying unlawful acts in connection with trademark use.

The Standards identify nine categories of unlawful trademark use behavior, referred to as “general trademark violations,” including:

• failure to use a registered trademark when a registered trademark is required to be used pursuant to Art. 6 of the Trademark Law;

• use of signs that cannot be used as a trademark in violations of Art. 10 of the Trademark Law;

• use of words such as “well-known trademark” in commercial activities;

• failure of a trademark licensee to indicate their name and origin of goods;

• making unauthorized changes to trademark registered information;

• passing off an unregistered trademark as a registered trademark;

• failure to fulfill administrative obligations relating to collective or certification trademarks;

• failure to fulfill trademark print and production obligations;

• filing trademark applications in bad faith.

The Standards provide detailed criteria for identifying the above trademark violation acts. Among them, the following aspects are notable:

1. What signs cannot be trademarks?

Not all signs can be trademarks in China. The Standards list several circumstances that would prevent a sign from being registered as a trademark, for instance if the sign lacks distinctive character. According to the Standards, a sign is not “distinctive” if it directly indicates the quality, key ingredients, functions, purposes, weight, quantity, etc. of the goods or services it represents. A sign that does not distinguish goods or services is not a trademark. The Standards also mention that a sign cannot be a trademark if it defies domestic accepted principles of morality. This judgment can be made based on common knowledge of Chinese standards of behavior.

2. Misuse of “registered trademark.”

If a trademark is not registered with CNIPA, it will not be treated as a “registered trademark” in China, even if it is registered in another country. Thus, before any goods are sent to China, exporters and importers must examine labels for use of the phrase “registered trademark” or be fined up to 20% of revenue.

---

Medical Treatment & Health

The National Health Commission Seeks Public Comments on the Rules for Regulation of Internet-based Diagnosis and Medical Treatment

国家卫健委就《互联网诊疗监管细则》征求意见

On Oct. 26, 2021, the National Health Commission (NHC) issued the Announcement on Seeking Public Comments on the Rules for Regulation of Internet-based Diagnosis and Medical Treatment (Rules of Regulation) and sought public comments until Nov. 26, 2021.

The Rules of Regulation are formulated in accordance with the Law on the Promotion of Basic Medical Care, Hygiene and Health; the Physicians Law; Law on the Prevention and Treatment of Infectious Diseases; the Administrative Regulations on Medical Institutions; the Administrative Regulations on Nurses; the Administrative Measures on Internet-based Diagnosis and Medical Treatment (for Trail Implementation); and the Administrative Measures on Internet-based Hospital (for Trail Implementation).The goal of the Rules of Regulation is to regulate  and strengthen the construction of the internet-based diagnosis and medical treatment system.

According to the Rules of Regulation, internet-based diagnosis and medical treatment takes the “real-name system,” where users register using their legal name. First, the medical institution must verify the identity of the medical staff who will conduct diagnosis and medical treatment (Article 12). The Rules also specify that real-identity verification must be conducted before a patient visits a physician, to ensure they receive the visit personally (Article 13). In other words, no other person or artificial-intelligence-based software may pose as or replace the physician during patient visits. Additionally, the patient must provide their real identification and other basic information, and no one may impersonate another person for medical treatment (Article 17).

The Rules of Regulation strengthen the regulation of medical staff. In addition to real-identity verification, they specify that any medical personnel who makes internet-based diagnoses and conducts medical treatment at an internet-based medical institution separate from the main practice location must conduct registration or filing according to the requirements for multi-agency practice in the location of the internet-based medical institution (Article 16).

The relevant health departments under people’s governments at the provincial level must build the province-level internet-based diagnosis and medical treatment regulatory platform (Regulatory Platform). Internet-based medical institutions are supervised through the Regulatory Platform. The relevant information of the medical personnel who carries out the internet-based diagnosis and medical treatment must be uploaded and shared on the Regulatory Platform, including but not limited to ID number, photo, relevant qualification, practice location, and years of experience. Moreover, the electronic prescriptions, prescription audit records, and prescription review records must be traceable and accessible through the Regulatory Platform.

Furthermore, according to the Rules of Regulation, not all patients can be diagnosed and treated using an internet-based medical institution. Patients must provide medical records with a clear diagnosis, such as outpatient medical records, inpatient medical records, discharge summaries, diagnostic certificates, etc. The receiving physician will determine whether the conditions for re-diagnosis are met and collect information, on paper or electronically, proving that the patient has been diagnosed. The Rules of Regulation require medical institutions to set up clear conditions for terminating the internet-based diagnosis and medical treatment. The receiving physician must immediately terminate the visit and guide the patient to seek medical services in a physical medical institution in the following cases: (i) there is a change to a patient’s illness, (ii) the physician deems the patient meeting an initial visit, or (iii) there are other circumstances that make internet-based health care inappropriate. The Rules of Regulation also stress that medical institutions must establish a report system for incidents involving patient safety and encourage medical service providers to actively report any incidents.

---

The National Medical Products Administration Releases the Pharmacovigilance Quality Management Specifications

国家药监局发布《药物警戒质量管理规范》

To regulate and guide the pharmacovigilance activities of drug marketing license holders and drug registration applicants, the National Medical Products Administration (NMPA) formulated the Pharmacovigilance Quality Management Specifications, a.k.a. the “Good Pharmacovigilance Practice” (GVP).

The GVP came into effect Dec. 1, 2021. GVP consists of nine chapters, including quality management, monitoring and reporting, risk identification and assessment, risk control, and pharmacovigilance during clinical trial. It applies to pharmacovigilance activities carried out by drug marketing license holders (holders) and drug registration applicants (applicants) approved to conduct clinical drug trials. Holders and applicants must carry out pharmacovigilance activities based on drug safety characteristics, minimize drug safety risks, and protect and promote public health.

1. Incorporate key pharmacovigilance activities into MAH’s quality assurance systems.

The GVP makes clear that marketing authorization holders (MAHs) must incorporate the key pharmacovigilance activities into their quality assurance system with the aim of risk prevention and control, and focus on the following nine matters: (1) setting up a reasonable institutional framework; (2) being equipped with the personnel, equipment, and resources required for pharmacovigilance activities; (3) formulating a management system that meets the requirements of laws and regulations; (4) formulating comprehensive and clear operating procedures; (5) establishing effective and smooth channels for collecting information on any suspected adverse drug reaction; (6) carrying out reporting and disposal activities that meet the requirements of laws and regulations; (7) carrying out effective risk signal identification and assessment activities; (8) taking effective control measures against the identified risks; and (9) ensuring that pharmacovigilance-related files and records are available, accessible, and traceable.

2. Report adverse drug reaction

According to the GVP, an MAH must actively carry out post-marketing monitoring of drugs, establish and continuously improve information collection channels, and actively, comprehensively, and effectively collect information on any suspected adverse drug reactions during the use of drugs, including the information from spontaneous reports and related post-marketing research and other organized data collection projects, academic literature, and related websites. A holder may collect information on any suspected adverse drug reaction from medical institutions by telephone, fax, email, and other methods, as well as collect the information on any suspected adverse drug reaction from drug manufacturers and distributors  and ensure smooth channels for these groups to report any adverse drug reaction. For drugs marketed both domestically and overseas, MAHs must collect the information on any suspected adverse drug reactions overseas.

3. Post-marketing drug safety research

An MAH must actively carry out post-marketing drug safety research based on the risk of the drug or in accordance with the requirements of the medical products administrations at or above the provincial level. An MAH may not conduct post-marketing drug safety research and activities to promote products. The purposes of post-marketing drug safety research include but are not limited to: (1) quantifying and analyzing potential or identified risks and their influencing factors (such as describing the incidence, severity, risk factors, etc.); (2) assessing the safety of a drug on special categories of patients over whom the existing drug safety information is not available or inadequate (for example, pregnant women, groups of a certain age, people with renal or hepatic insufficiency, etc.); (3) assessing the safety of long-term medication; (4) assessing the effectiveness of risk-control measures; (5) providing evidence that the drug does not have relevant risks; (6) assessing use patterns of a drug (such as over-indication use, overdose use, or errors in combined medication); and (7) assessing other safety issues that may be related to the use of a drug.

4. Master files of the pharmacovigilance system

An MAH must update the master files of the pharmacovigilance system in a timely manner to ensure consistency with the current pharmacovigilance system and activities, and to continue to meet relevant laws, regulations, and actual work needs. The master files of the pharmacovigilance system must include at least the following: (1) description of the organizational structure, responsibilities, and mutual relationships related to pharmacovigilance activities; (2) basic information about the person in charge of pharmacovigilance, including residential area, contact information, resume, and responsibilities; (3) the number, relevant professional backgrounds, and responsibilities of full-time staff; (4) description of the main ways and methods of collecting information on suspected adverse drug reactions; (5) description of information-based tools or systems used to carry out pharmacovigilance activities; (6) brief description of the pharmacovigilance management system and a catalog of the pharmacovigilance management systems and operating procedures; (7) description of the process of monitoring and reporting of adverse drug reactions, and the identification, assessment, and control of drug risks; (8) specification of the content and time limit of the entrustment and entrusted entity, and a list of entrustment agreements; (9) description of the pharmacovigilance quality management, including quality objectives, quality assurance systems, quality control indicators, and internal audits; and (10) system and operating procedural files, drug list, entrustment agreements, internal audit reports, and revision log of master files.

5. Pharmacovigilance during a clinical trial

During a clinical trial of a drug related to registration, the applicant must actively cooperate with clinical trial institutions and other relevant parties to strictly implement the main obligations for safety risk management. The applicant must establish a pharmacovigilance system; comprehensively collect safety information; monitor, identify, assess, and control risks; discover existing safety problems in a timely manner; proactively take necessary risk-control measures; and evaluate the effectiveness of risk-control measures to minimize risks and effectively protect the safety of subjects.

* This GT Newsletter is limited to non-U.S. matters and law.