MIIT Solicits Public Comments on Measures for the Data Security in the Field of Industry and Information Technology

On February 10, 2022, the Ministry of Industry and Information Technology (“MIIT”) issued the “Measures for the Administration of Data Security in the Field of Industry and Information Technology” (“Measures”), clarify specific requirements for data classification and grading protection, important data management, etc.

1. Adding the definition of radio data.　The definition of data in the field of industry and information technology has been improved. Data in the field of industry and informatization includes industrial data, telecommunication data and radio data. In addition, the radio data security management is supplemented in the relevant items such as the identification standards for important data and core data, and the data security supervision department.

2. Refining the data security management filing regulations.　The statement that “data processors should insist on classification first and then classification” has been deleted from the Measures to allow the market to operate more flexibly. The classification and grading method of data in the industrial and information fields basically follows the original classification and identification of data based on factors such as industry requirements, business needs, data sources and uses to form a data classification list; Illegally obtained or used illegally, and the degree of harm caused to national security, public interests, or the legitimate rights and interests of individuals and organizations is divided into general data, important data and core data. Data processors in the field of industry and information technology shall file the catalogue of important data and core data of their units with the local competent department of industry and information technology (for the field of industry) or the Communications Administration (for the field of telecommunications) or the radio management agency (for the field of radio).

3. Clearly prohibiting theft or other illegal data collection. It is stipulated that the important data and core data collected and generated by data processors in the industrial and information fields shall be stored within the territory of the PRC complying with the laws. The data export security assessment shall be carried out in accordance with laws and regulations if it is really necessary to provide it overseas.