Tightening Penalties for Violations of the Cybersecurity Law

On 14 September 2022, the Cyberspace Administration of China ("CAC") published a draft amendment to the Cybersecurity Law. The purpose of the amendment is to align the law with the laws on data security and personal data protection, which were adopted at a later date, and to adjust inconsistent regulations. Essentially, the draft, which is likely to be passed in its existing form, contains tougher penalties for violations of the law.

According to the draft, fines of RMB 100,000 can now be imposed for violations, and fines of at least RMB 1 million up to RMB 50 million or 5 percent of the previous year's revenue for specific violations. In addition, further measures are possible, such as the closure of the Internet presence or even the revocation of the business license. Responsible persons within the company can also be fined. Furthermore, such persons may also be prohibited from remaining or becoming active as a director, supervisory board member or executive employee.

In addition, the penalty provisions for operators of critical information infrastructures are also specified in more detail. Here, fines are possible against both the company and the responsible persons if network products or services that have not undergone a security check or have not passed the security check are used.

China's regulations in the area of cybersecurity, data protection, etc. are under continuous review and the regulatory situation is adjusted in the event of inconsistencies between the various laws. This means that China continues to pay the utmost attention to this issues. The increase in possible fines and tightening of other possible penalties also show that the authorities are willing to enforce regulations with more pressure. Companies should therefore permanently monitor their information technology and processing, data transfer, etc., document the monitoring and adjust it if necessary in order to act in compliance with the law and avoid disadvantages.