What to Do When Your Secret is Out

• Pages: 7-8

Moreover, the CSL prescribes that CII operators must store

both personal information and important data collected

during operations in China within the territory of China.

CII operators can be requested to undergo much stricter

cybersecurity review before cross-border data transfers. If

cross-border transfer of such information is truly necessary

for business reasons, the CII operators must conduct a

security assessment (details of which are not available at the

moment and subject to further implementation legislation)

before cross-border transfer. The Chinese authorities could

block any cross-border transfer of data, if they believe the

risks of data leaks or loss of data to be considerable.

Sanctions

For CII operators, unauthorized cross-border provision of

personal or important data can be subject to conscation of

illegal gains and a ne of up to RMB 1,000,000 (EUR 130

000), suspension of business or revocation of business

license and nes of up to RMB 100,000 (EUR 13 000) for

responsible management personnel.

What happens if you don’t comply with the CSL regulations?

In the event that you do not comply with the CSL, you may

suer from a triple punishment, namely;

A. Chinese authorities’ potential punishment for non-

compliance (including nes, suspension or revocation of

business license);

B. The obligation to be certied by a cybersecurity expert,

which is an expensive process, and

C. Your non-compliance might be detected following the

hack of your networks and the leak of your valuable and

strategic data (i.e. your IP), for example commercial and

nancial information, customers personal data etc. This

could cause you to lose competitive advantage in your

eld of activity but also damage your reputation.

As an SME, such non-compliance might even mean the end of

your business development in China. As a result, compliance

with the CSL requirements should be taken seriously.

Trade secrets

Trade secret is any condential business information or

know-how which provides an enterprise with a competitive

advantage, and for which measures are taken to keep it

secret. Examples of trade secrets include drug trial data,

design drawings, descriptions of manufacturing processes,

client lists, patent information or recipes. Three conditions

should be met for you to enjoy trade secret protection

in China: (1) the concerned information must be either a

technical, operational or business information; (2) such

information must have a business value; and (3) it must be

protected by condentiality measures. The level of protection

should be reasonable considering the importance and value

of the trade secret. As non-registrable IP, trade secrets are

protected as long as they are kept secret.

Complying with the CSL is not optional, SMEs wishing to start

a business in China must comply with its obligations. Thus,

you should design your IP protection strategy, especially

regarding the protection of trade secrets, which cannot be

protected by registration, taking into consideration the CSL

rules. Certain requirements, such as the use of Chinese

service providers, can be considered as an obstacle for many

SMEs fearing security risks to trade secret protection, as not

all service providers accept liability in case of data leakage

or cyber-intrusion. As these requirements are mandatory,

your trade secret protection strategy needs to take this into

account. For example, you could opt for not providing the

Chinese oce with all your sensitive information, but only

the necessary data to operate in China. The rule of “need to

know” can be applied for the oce, reducing the amount of

information outside the company´s server. Should you need

to store your trade secrets in China or access them remotely

from your EU headquarters, you should keep condential

information encrypted.

5. Implications for IP protection

7