BEIJING -- Businesses, including foreign ones, that collect and use data in ways that "harm national security or the public interest" would face hefty fines under new legislation drafted by Beijing amid its escalating tech clash with Washington.
The Data Security Law is China's first comprehensive legislation governing the handling of information, extending its oversight beyond state secrets and military intelligence to everyday data.
But if the government clamps down on data usage without clarifying what activities the legislation actually covers, it risks hampering businesses in an era when judicious use of data is vital for competitiveness.
A draft released early this month states that all data will be ranked based on the potential harm to national security if it is falsified, leaked or used illegally. Government departments and regional authorities will be required to rank what information is considered important and implement protections accordingly.
Organizations and individuals outside the mainland will be held legally liable, according to Article 2 of the draft legislation, for "data activities that harm the national security, the public interest, or the lawful interests of citizens or organizations of the People's Republic of China." That could allow Beijing to target foreign businesses that collect or use data from China on national security grounds.
"Since we don't know how it'll be applied, we have no choice but to see what specific rules they draw up and respond accordingly," said a senior member of a law firm with foreign companies among its clients.
The legislation includes measures to safeguard national security regarding data collection and processing, with penalties for violators, including fines of up to 1 million yuan ($143,000).
What constitutes harm to national security or the public interest is uncertain. Foreign businesses will likely need to take extra care when handling data on critical infrastructure such as telecommunications and energy, as well as information relevant to incidents related to public safety, such as vehicle and equipment movement in the area.
The text also covers activities that "harm the lawful rights and interests of citizens and organizations," with no clear explanation of what that means, raising concerns that the legislation will be applied quite broadly.
"Even with advertising or marketing activities that seem unrelated to national security, we'll have to take care not to irritate Chinese authorities or Chinese businesses," said an executive at a foreign company.
The legislation includes text allowing for Beijing to take retaliatory measures if a foreign government imposes "discriminatory" bans or restrictions regarding data-related investment or trade, reflecting U.S.-China tensions that have expanded well beyond the original trade war.