China's New Data Security Law and Cyber Sovereignty - Transcript

 

00:00:02 

 

Joanne Kuai

 

Welcome to the Nordic Asia Podcast, a collaboration sharing expertise on Asia across the Nordic region. My name's Joanne. I’m a visiting PhD student at a Nordic Institute of Asian Studies. Joining me today to talk about China's data protection law and its ramifications for China's AI revolution is Rogier Creemer’s, an Assistant Professor in Modern Chinese Studies at Leiden University. His research focuses on Chinese domestic digital technology policy, as well as China's growing importance in global affairs. Rogier, thank you very much for being here with us today.

 

00:00:45 

 

Rogier Creemers

 

It's a pleasure to be invited.

 

00:00:47 

 

Joanne Kuai

 

So shall we begin by you introducing us to what has led you to your current research interests on Chinese Studies and more specifically on its digital technology policies? 

 

00:01:00

 

Rogier Creemers

 

Well, you know, when you're an academic, what you'd like to say is that you have this grand plan that you sort of thought about 10 years ago and then just executed it. And the reality, of course, is that that's not true. I've been tremendously lucky in very many ways, and I've just sort of been able to follow trends as they happen. Now, I started doing China studies in my late teenage years when I went to university. I grew up in Belgium in a fairly small town. And I really wanted to sort of broaden my horizons and figure out what's beyond my little town. And I started reading into global cultures. And for some reason I find China really interesting. And so I went to do Chinese studies pretty much at that point for the language and culture and the history and the literature. After I graduated four years later, I got a scholarship to go and study at Peking University for a year. And then I discovered that the China of the present is at least equally as interesting as the China of the past, and that this was going to be a country that was going to play a very important role in the global stage. This was 2004. And so after I got back to Belgium, I did another degree in International Relations focusing on China's role in the globalizing world at that stage. And when I graduated from that, it turns out that there really wasn't a lot of demand for that particular profile in Belgium at that time. So my first job was teaching Chinese to adults and evening classes. And one of my students was a professor from Maastricht University who at some point ended up offering me a PhD position to write a PhD on intellectual property law. He was an intellectual property professor, and so I ended up writing a PhD on intellectual property law in China in the light of the World Trade Organization and particularly focusing on copyright, working on things like movie piracy at that point in time.

 

00:03:02 

 

Rogier Creemer

 

Now, when I graduated, the financial crisis was in full swing and again, there weren't a lot of jobs available in Dutch academia. I did my PhD at a Dutch university and there was a postdoc position at the University of Oxford that I applied for and I got, this was on media law. And of course, copyright and media law was fairly closely related in the work that I've been doing. And it's been a sort of very gradual evolution from their own where I moved from media law in the traditional sphere to media in the Internet space. This is 2011, 2012, so obviously that's really the booming period for the Internet in China. And then very quickly, I discovered that you couldn't research media without the Internet, and very rapidly the Internet was much more than media alone. It was the governance. It was national security. It became the digital economy. It became all of these things that we're now talking about. And I'm pretty much just followed that topic as it evolved itself. And I've been very lucky that it turned out to be incredibly interesting for my own personal satisfaction, but also that it's become very relevant in the questions that we're asking more broadly about China and our European or Western future with China. And that's pretty much how I rolled.

 

00:04:27 

 

Joanne Kuai

 

I know that your latest research is on China's upcoming personal information protection law. Would you please share with us some of the most interesting findings?

 

00:04:27 

 

Rogier Creemer

 

Well, we have to be a little bit careful in the sense that the definitive personal information protection law isn't quite out yet, but the Data Security Law, which is its twin, came out in its final form a week ago. As we're recording this, and I presume that the personal information protection law isn't going to take very long anymore either. I expect it certainly to be done and dusted by the end of the year. And I think one of the very interesting finding is you really need to take those two laws together as part of a broad architecture for the creation of data protection laws and regulations in China. Traditionally. I'm writing a paper about this right now, and as I was doing the literature research for this paper, I came to the conclusion that whenever we talk about data protection, generally, we talk about the protection of personal information. There is some technical data protection in literature, in the cybersecurity field. But generally, when we talk about law and regulation, we talk about people's names, addresses, email addresses, banking details, that sort of thing. And that's obviously what the GDPR it's been built on, that's what the Americans call data privacy, where their framework is based on, it's very much that notion of maintaining a degree of individual control over your information in the light of constitutional notions of privacy, which in Europe we recognize as a fundamental right, slightly more complicated in legal terms in the United States. But still, there is a constitutional foundation for privacy, and that's where that is built on. Now, the emerging Chinese personal information protection framework borrows a lot from Western conceptions in terms of definitions, in terms of vocabulary, but it doesn't really have that constitutional footing. So the Chinese personal information protection framework isn't about protecting privacy as a fundamental right.

 

00:06:40 

 

Rogier Creemer

 

In fact, when you look at the legal history of this in China, there's been a separation between privacy, which by now is mostly protected through the civil code and personal information protection, which is also mentioned in the civil code. But now we'll have this, the specialized legislative act coming out to protect it. And the difference is really that in this Chinese legal context, privacy is about confidentiality. It's about things that you wouldn't like of the people necessarily to know about you, so in the civil code, this is about anything from your movements to the way that you live, the interior of your house and other private spaces to, you know, intimate pictures of your body. Those are things that fall into privacy, whereas the personal information protection law is much more about, you know, there's nothing necessarily shameful about my address or my date of birth or other pieces of information that enable people to identify myself or to affect my economic interests, think about banking information. There's nothing shameful about your bank account number. And so personal information protection is less about protecting privacy in that very specific sense. It's more about ensuring that the personal information of citizens is protected well, primarily in the digital economy and to a certain degree vis a vis the government. And that's to me, the biggest difference between China and Western approaches that I find in the personal information protection sphere. But then when it comes to the Data Security Law here, we come to something which in my view, is very innovative and fairly unique. I am not aware at this point in time that any major cyber power be it the United States, be it any country in Europe, has anything remotely resembling the Chinese data security law, which isn't just about personal information. It's about any data that could potentially have ramifications for national security in the public interest.

 

00:09:00 

 

Rogier Creemer

 

So it could be personal data, right, where you could use like the Russians ostensibly did in the 2016 presidential election in the United States, you could use personal data to disrupt political processes, but it doesn't have to be personal data. It could be industrial data. It could be data on the functioning of the national grid or irrigation networks or dams or other forms of critical infrastructure. And so what the data security law does is it classifies and categorizes all kinds of data. And then as you rise in importance, there are five levels. And more important data is subject to higher degrees of protection requirements, which may also involve government inspections or which may involve required security audits by certified third party bodies. And obviously, in Western governments, we have information management systems where it's about classified information, but that tends to be government or government related information only. It's a much narrower scope. Whereas what China's doing with the Data Security Law is this potentially covers every single piece of data in China. And obviously, if it's about my subscription information with my local gym, that's obviously less national security relevant, but it could be covered as well. And in that sense, I think the Data Security Law is really something that with our Western focus on personal information, when we when we talk about data security, we really risk overlooking the importance of.

 

00:10:38 

 

Joanne Kuai

 

By what you just said, I get a feeling that the Chinese state is using the legislations, these rules and regulations and laws in particular, to reinforce the status as a big state. Is that correct?

 

00:10:58 

 

Rogier Creemers

 

You mean, is this part of China's plan to become a major cyber power? Do I understand that correctly?

 

Joanne Kuai

 

You can put it away. Yes.

 

00:11:05 

 

Rogier Creemers

 

“Wangluo Qiangguo (网络强国)”. I remember there was a song about that back in the early days of the Cyberspace Administration of China. Well, a lot of this has to do with, you know, the word major cyber power. It's very much a fairly vague slogan. And the question is really what does it mean? And to a certain degree, certainly when we look at the area of personal information protection, it's China in a way, coming abreast with what other countries have been doing for a while. So Europe has a history of data protection that goes back decades. And the same is true for the United States. Right. You look at things like credit reporting in the United States. We've had that for pretty much half a century. And obviously China has much less of that history. When you look at personal information, protection related points in earlier laws and regulations, you find a couple of things protection of health care information, protection of banking information. But China really has much less of a history in personal information protection even before we start talking specifically in the Internet. And so obviously, given the fact that China's digital economy has been developing much later, that on the one hand it creates an opportunity for leapfrogging, which is why China is way ahead when it comes to things like digital payment in comparison to the West. Simply, China didn't have credit cards or other form of electronic payment, which Europe and America did. And so there was much less of an efficiency gain to be made here in comparison to China moving from essentially being a cash based economy to having online payments. And certainly a very large smattering of what we see in personal information protection is about catching up. It is about making sure that you have a adequate legal system that is suited to the needs of this digital economy.

 

00:13:08 

 

Rogier Creemers

 

But more broadly, I think what the major cyber power represents is, I think a Chinese political mindset, which is much more aware and awake to the risks of large scale digitalisation than Western ideas have been. I mean, in the 1990s, 2000s here, we had a lot of techno optimism. Technology would make everything better. It would bring democracy everywhere in the world. It would disrupt the economy. But all of that economic disruption would be a great thing because we had an innovation economy and everything would become better. And as a result of that, we really haven't lost very big questions about how you do this in a way that is technically secure, but also the way that doesn't inadvertently generate all kinds of new risks, such as what happened in the 2016 presidential election. And so we're now belatedly coming to the point where it's almost like we've woken up the morning after a long party with a big hangover and suddenly we're going, wait a minute, this this didn't really go the way that we wanted it to go. And China never had that. China has been pretty much asking itself the question, digitization or informatization, as we call it, in the Chinese context. Xin Xi Hua  （信息化）.It's a wonderful thing. Potentially, it can do a lot for us in terms of economic growth, in terms of political reform, in terms of social services. But it's not going to come cost free. And obviously, when you are a developing country like China and even 10, 15 years ago, China was nowhere near as technologically capable as it is now. That brings in its own vulnerabilities, right? You are reliant, for instance, on foreign technology, on hardware, on software, on online services to a certain degree, and you need to think seriously about what that means for your security status in the same way that many countries in Europe are now wondering whether it's a good idea to have Huawei hardware installed in their 5G architecture.

 

00:15:24 

 

Rogier Creemers

 

These are questions that China has been asking for a while. And so a lot of the major cyber power strategy is really about ensuring that the government in Beijing has both the competence from a legal perspective and the ability from an implementation capability perspective to ensure that they have effective control over what happens in Chinese cyberspace. And obviously that is applied for economic purposes. As I said, the goal of the Personal Information Protection Laws to primarily affect the economic realm says something about government departments, but relatively little in comparison. But it's certainly the case for the data security law, where this is really about ensuring national security and the public interest, where it is affected by data. And that can run the whole gamut from, you know, like I said, the mass data about Chinese individuals that companies like Alibaba and Tencent have connected to all of these critical infrastructure related fields that the Chinese government is very concerned about.

 

00:16:36 

 

Joanne Kuai

 

As you just mentioned, so this Data Protection Law, along with this antitrust law, has been regarded as the Chinese state effort in reining in the Chinese tech giant’s power. How is this power dynamics between the Chinese state and a tech industry constructed and what are the implications?

 

00:16:56 

 

Rogier Creemers

 

Well, we have to actually cycle a little bit back into history for that. In the early 1990s, after Deng Xiaoping decreed that we were going to have a socialist market economy, essentially the Chinese economy would split into two parts the commanding heights of the economy, which would be a collection of strategic sectors like energy, the automotive industry and a bunch of other things. Media, those strategic sectors would be populated by state owned or state controlled enterprises. And then you had the rest of the economy, things like small or small goods, manufacturing, toys, clothing, that sort of thing. That was going to be the rest. And that would be far more subject to free market operations. Now, this division was made in the early to mid 90s before there even was something like a sizable digital sector in China. And so what really happened is the digital sector in China emerged largely populated by private businesses, but then suddenly it gained strategic relevance. And so what we have seen is that over the 2010s, there was this sort of mutual recognition that there had to be some sort of a strategic relationship between those businesses who are obviously growing rapidly and wanted to make a lot of money. And the Chinese government that in very many ways was rather surprised by this enormously rapid development, by the enormously rapid adoption of all these new forms of technology and most notably mobile phones, smartphones, which really form the center of the online ecosystem as it exists in China today. But then also all the services that you build on top of that, Alibaba, Tencent and all of that. And on the one hand, the government was really happy generally with the emergence of that sector, because it ticks a lot of their boxes. They enable China to move up the development value chain so economic growth can continue.

 

00:19:06 

 

Rogier Creemers

 

But also they solve a lot of economic and social problems. The Chinese government has been trying to figure out a way to become more responsive to citizens, and then it finds that you can use a private platform for that. You have official WeChat channels and official government social media accounts that, you know, we'd like to talk big politics when we're talking about China. But for very many Chinese citizens, what they really want is the potholes in the road fixed or other small problems that directly affect them. And at least at that level, these new social media channels provided a really useful opportunity for the Chinese government to do what it wanted to do. And there was a recognition in government that a state owned enterprise probably could have never built these things. It could have never built something like Huawei or something like Alibaba or Tencent or whatever. So there was a recognition that on the whole these things were good things and perhaps counterintuitively, for a system that really likes to be in control, there was almost sort of a point where the leadership decided to let this grow for a bit and see where it ended up and not yet intervene too strictly for fear of killing the chicken with the golden eggs. Now, that period now seems to be over to some degree. And I think we have to be careful a little bit that we don't overdramatize this. This is not this is not a spectacular 180. I do think that that strategic relationship of a mutual reliance between the government and the private sector in the digital sphere, that's going to continue to exist. Just look at the extent to which these companies are involved in massive government informatization projects. There's been a lot of discussion about things like the social credit system, and obviously it would take a long time to go into the detail on that.

 

00:21:08 

 

Rogier Creemers

 

But the national database for this, for the social credit system, it's been developed by Baidu. These businesses are also government contractors. So I do think that that strategic nexus is going to continue to exist to some degree. But what always needed to be clear was that even though it's a strategic relationship, it's clearly an asymmetric one in the sense that in the end, it's the government that wants to decide what's going to happen. It's the government that's going to decide what “Team China”, quote unquote, is about, and it wants to make sure that these companies are good and loyal members of China. And obviously, this is where you have a lot of complex strands that are interweaving. Part of it is China's not alone in this. This is part of a world wide phenomenon where in China, in Europe, in the United States, in our various ways and for various reasons, we are tackling the power of tech platforms. And even though these processes emerge or manifest themselves in different ways worldwide, I do think they are part of a worldwide trend where these tech platforms have gotten really, really big, have become enormously powerful, and this is the inevitable counter reaction from governments worldwide. So China is not alone in this. And there's really a point where the power of these big platforms means that there is a concern among the leadership that they might use that power to stifle innovation or to capture a lot of the economic revenue through monopolistic practices. And apart from the economic harm that that causes, you know, they're not going to reinvest it in innovation. They're going to reinvested in making shareholders happy, stopping innovation, buying up emerging startups who might have good technology, and that might have a deleterious effect on China's ability to actually become a global technology leader. So that's one element of it.

 

00:23:18 

 

Rogier Creemers

 

But the other element of it is that both Alibaba and Tencent have become financial service providers. And I think we shouldn't underestimate the extent to which the crisis of 2008 has been a lesson to policymakers in Beijing of what can happen if you allow the financials, the financial sector, to get out of hand. We've seen many quotes from Xi Jinping, as well as other senior officials, essentially saying that the real economy must always be front and center and the role of the financial sector is not to become a point for capital, for capital accumulation in its own right, but to support that real economy. And so, as Alibaba and Tencent have really gained a major impact on things like Chinese debt creation, you know, they need to be brought under control because if there's anything that the leadership doesn't want, certainly now is a financial system meltdown like we saw in the West in 2008.

 

Joanne Kuai 

 

Speaking of China's goal of becoming a technology leader, in 2017 China has already laid out its national strategy of becoming a global leader in the field of artificial intelligence. And some will have to opinion, for example, like Kaifu Lee, he wrote AI Superpowers talking about a tech rivalry between China and us, saying that China's disregard for privacy and their massive collection of data might give this country like an edge in development, as data is the ingredient of training any kind of AI technology. I'm just wondering, what is your take on this and what will be the implication of China's AI development on other parts of the world?

 

00:24:22 

 

Rogier Creemers

 

Well, there's a couple of interesting points there. And the very first question that I think we have to ask is, what do we really mean with AI leadership? I'm not always convinced that the sort of the competition thing or the competition metaphor, the race metaphor really applies. Right. If there is a race there, sort of like there's a circuit or there's a route and there is a finish line somewhere, and someone is going to cross that finish line first and takes the flowers and the big check and that's it. They lived happily ever after. So if it was about who gets to the moon first in in the 1960s that you can properly color race, there is a clear goal. Someone is going to achieve it first. And I think the field is much too complex to see it in that metaphor. Partially, that's because fundamental science, where it comes to a fundamental scholarship on algorithms in and of themselves and the underlying mathematics really hasn't evolved massively in the last decade or two. Rather, it is about actually realizing the potential of these algorithms. And that means a whole bunch of things. It means, obviously, you need to get a whole bunch of data. So you need a whole number of people that come online or whose information or data can be captured in any other way. You require storage capability. You require computational capabilities. Obviously, these have been going very rapidly, but then you also need an application. Another way to look at AI is really something like electricity. It's a capability that you could use for one hundred and one different goals. Right? You can use electricity to power cars or fridges or computers or an electric guitar. And obviously you're going to do different things with an electric guitar, then you're going to do with a fridge.

 

00:27:04 

 

Rogier Creemers

 

And I think AI is very much the same thing. Militaries across the world are talking about the AI-enabled battlefield, but we can also use AI, you know, there's AI applications in home decoration or smart translation, all these sort of different things. And so really what you need to ask yourself is what is the application to which a particular piece of a AI software is going to be used? And so what we really, really need to think about as we're talking about AI leadership and an AI competition, is that this is not a simple thing like who gets to the moon first to cross the finish line first. We would never talk about an electricity race, and yet electricity is crucial, amongst others, for national security. It's really what we use the electricity for. And part of that is powering infrastructure that we all rely on. So we want the electricity grid to work. And that's really the thing with with AI we need to look at it in that detailed context.

 

Joanne Kuai

 

So you spend a lot of effort studying Chinese laws, regulations and policies like you asked, what have you found as some major commonalities and differences when it comes to the Chinese and a Western approach to this cyber sovereignty, Internet regulation, data protection? And is there any lessons we can draw on China's approach?

 

00:28:15 

 

Rogier Creemers

 

Well, that's a really interesting question, and certainly because you're using the word “cyber sovereignty”. Now, I remember when I started getting into this line of research, the word cyber sovereignty, certainly here in Europe was a very dirty word. Governments would tell their diplomats definitely never to use it because it came from China. And we don't want to recognize this particular Chinese idea. We don't want to validate this approach to the Internet, which which we don't like. And now we're at the point where we have European policymakers, senior officials, members of the European Parliament using it themselves, for instance, in the context of the GDPR. And this is something really interesting where very few people are probably going to recognize it here in Europe. But what I'm actually seeing is a certain degree of convergence between what's happening here in Europe and what's happening in China. And the reason for that is, as I said earlier, China asked itself the question of how do we prudently deal with this particular new phenomenon, this growth of the digital sphere. It asked of that question far earlier than we have and with with less ideological baggage. Right. Certainly when you look at digital technology here, the Internet community, as it started out, had a very, very libertarian mindset and that really has sort of carried forward up to the present day. And cyber sovereignty is a very interesting example of that, because the whole point of sovereignty classically in international law is there are big things that we're never going to agree on. And historically, that could have been, for instance, religion. Sovereignty really comes from religious wars in the European renaissance, Catholics versus Protestants. And so the idea of sovereignty is to say there are some things that we're never going to agree on. So what we're going to agree is that governments back at that time, kings and aristocrats within their territories decided what was going to happen and that will allow us to work together without having to start another religious war every five years.

 

00:30:49 

 

Rogier Creemers

 

Because if you do not have a notion of sovereignty, the only other thing really that you have is the idea of globally unified rules. And if you want to get globally unified rules, you need some sort of global government. Now, the idea of sovereignty historically has been very often honored, more in the breach than in the recognition. And certainly during the colonial era, white people weren't really keen on extending the notion of sovereignty to populations in Africa, Asia, many other places in the world. But what I think is the big thing or the source of the tension on sovereignty is that certainly from the 1970sonwards after the Helsinki Accords with the Soviet Union, human rights became a very strong, constraining factor on sovereignty. It's almost like a constitution for the globe. You can only be a sovereign state if you meet minimum criteria of civil political rights, economic and social rights. The standard argument always going Westerners or Western countries prioritize civil and political rights. The Soviet Union back in the day and China today emphasizes economic and social rights. But so the point is that human rights constrain sovereignty. In other words, if you do not have the right to free speech or free assembly, then you don't really have the right to be a sovereign state, to put it very strongly. Not surprisingly, China really disagrees with those constraints on sovereignty. The Chinese government maintains that, in essence, sovereignty means that no one is going to tell the Chinese government what to do. And obviously, there is a very strong historical tradition in this, the century of humiliation, which continues to be a strong rhetorical basis for this. And I don't think it's often recognized in the West to what extent China's experience of the flip side of imperialism, it isn't just rhetoric. I do think that there's something there.

 

00:32:57 

 

Rogier Creemers

 

I don't think that we sufficiently recognize how important that is. But so China comes to the point where faced with this notion of the Internet is going to unify the world. And remember Bill Clinton in the early 2000s saying China wants to control the Internet. Good luck. That's like trying to nail jello to the wall. Turns out if you're willing to put in enough nails, you actually can nail jello to the wall. But so there's this notion of sovereignty that in China, at least, where we want to have our own cyberspace. So contrary to the notion that there are no borders in cyberspace, the Chinese government is saying, yes, there should be. And within those borders, no one is going to tell us what to do. We will cooperate internationally, but only in those things that we voluntarily participate in. Now, we may well disagree with particular elements of the Chinese approach to the Internet and certainly on a personal level, I do. But what sovereignty really is about is recognizing that government is always going to be local. And so what we're really seeing now in comparison with Europe, that example that I just gave about sovereignty in relation to the GDP are the notion of data sovereignty. Is Europe coming to the same conclusion? There are things within Europe that we want to protect and we want to have different rules from the rest of the world or even if there not too different. We want to have our own rules, but we want the European government or individual European governments, plural, to be in charge of this very important area that affects the well-being of our citizens, our economic prosperity. We want to have that control. And that's exactly the same argument that the Chinese government is giving for saying we want censorship. So sovereignty, really the idea of sovereignty is something that these people are agreeing on, but they want to use it for different purposes.

 

00:34:56 

 

Rogier Creemers

 

And the purpose of that or the purposes to which China wants to put digital technology very often we do not like. But this is really a big quandary because what are we going to do with that? To what extent are we willing and able to do something about that? And that's a question that we've never asked ourselves, what are we going to do with a China that is going to become more and more powerful? And our ability to influence outcomes in Beijing is small and shrinking, and that's really the challenge that we're facing right now.

 

00:35:36 

 

Joanne Kuai

 

That's a very interesting take, I have taken a lot of time, so my last question will be, what are some of your ongoing or upcoming projects that you're working on?

 

00:35:47 

 

Rogier Creemers

 

So there's a couple of things. Obviously, I'm going to be public and say that I'm writing this paper on data protection so that I actually have some incentive to finish it. I'm also working on a book on China and global cyberspace, so I'm also making that public so that I have an incentive to finish it. But in terms of things that people can access today, if you're interested in sovereignty, I did two very interesting, or at least the two papers that I rather enjoyed writing on this one for the German, which is available freely. And another book chapter which people can easily find that's also available in the public domain. I'm a co-founder of DigiChina, which is a project that we do together with Stanford University and Leiden Asia Center. We're hoping to build it into a sort of Wikipedia for digital China, where we translate new laws and regulations. So we did all of the drafts of the Personal Information Protection Law. We provide analysis, but as we're moving forward and we're building up our our team, we're really hoping to really build this out into an encyclopedia where people can find things like a dictionary. Right. What do particular Chinese legal terms or concepts or political ideas mean? How are they realized in cyberspace? Who is who? Which ministry is in charge of what? I very strongly invite people to take a look at that. Apart from that, I work with the Leiden Asia Center on a project for the Ministry of Foreign Affairs here in the Netherlands to build up relevant knowledge on digital China. So there's a bunch of reports coming out on that. And people could look at the Asia Center website to see what we've been up to. We do reports, but we also do public events. And at the most basic level, people are welcome to follow me on Twitter, where my handle is @China_Digital.

 

00:37:51 

 

Joanne Kuai

 

Rogier, thank you so much again for joining us today. So to the listeners, thank you for listening to the Nordic Asia podcast showcasing Nordc collaboration and studying Asia.

 

00:38:04 

 

 

 

You have been listening to the Nordic Asia podcast