Re: China's Data Security Law - Sept 1st

[Cathy Hubbs <hubbs () AMERICAN EDU>]

Thanks Chad.
it’s been quiet in terms of responses to my question. I did, however, receive the following response a separate 
discussion thread.

“We have followed the duo of laws for the last few months. For the privacy portion, we are continuing along with our 
general privacy readiness efforts. Our readiness efforts are designed to get us substantially in compliance with many 
of the newer privacy legislations in other countries (China, Brazil, etc.) along with ethical privacy principles, and 
PIPL one doesn’t appear to have anything significantly out of line with that plan. Two things we are keeping a closer 
eye on:  1) how the Chinese security assessments required for cross-border transfers of large amounts of data by CII 
operators will go, and 2) what, if any, standard contract clauses will be released/approved for use. “


Cathy

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of Chad Tracy 
<ctracy () BATES EDU>
Reply-To: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU>
Date: Monday, August 30, 2021 at 8:01 AM
To: "SECURITY () LISTSERV EDUCAUSE EDU" <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] China's Data Security Law - Sept 1st


External Email: Use caution with links and attachments.
Cathy,

Little late to the thread, but wanted to know if you found anything out. We are reviewing data collection processes 
used by our Admission Officers when they travel to mainland China. Honestly, I don't think there will be much of an 
impact as we only have high school students in China providing name, email address, school name and address - there is 
implied consent with this data process. Admissions does use an app for this collection process so I will review the app.

Chad

On Tue, Aug 24, 2021 at 10:15 AM Cathy Hubbs <hubbs () american edu<mailto:hubbs () american edu>> wrote:
Good morning all,
Curious to hear from those of you out in front on China’s new Data Security Law (DSL).
What impact or considerations do you see on students?
What, if any, unique to DSL, steps are you taking toward the requirements?

Reuters
https://www.reuters.com/world/china/china-passes-new-personal-data-privacy-law-take-effect-nov-1-2021-08-20/<https://urldefense.com/v3/__https:/www.reuters.com/world/china/china-passes-new-personal-data-privacy-law-take-effect-nov-1-2021-08-20/__;!!IaT_gp1N!hU4RSKWDV9tOaGF-OOPuO46zWg1qq6m0DOmT40DID-DKA23L8wYx68TWA1kecpdo$>

Legal Summary
https://www.jdsupra.com/legalnews/china-finalizes-data-security-law-to-4249871/<https://urldefense.com/v3/__https:/www.jdsupra.com/legalnews/china-finalizes-data-security-law-to-4249871/__;!!IaT_gp1N!hU4RSKWDV9tOaGF-OOPuO46zWg1qq6m0DOmT40DID-DKA23L8wYx68TWAztkF7qU$>

Feel free to reach out to me directly if you prefer.

Cathy

Cathy Hubbs (she/her)
Chief Information Security Officer
Office of Information Technology
American University


**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://urldefense.com/v3/__https:/www.educause.edu/community__;!!IaT_gp1N!hU4RSKWDV9tOaGF-OOPuO46zWg1qq6m0DOmT40DID-DKA23L8wYx68TWAyvLXl0m$>


--
Chad Tracy
Director of Information Security, Policy and Compliance
Bates College
207 786-6491

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://urldefense.com/v3/__https:/www.educause.edu/community__;!!IaT_gp1N!hU4RSKWDV9tOaGF-OOPuO46zWg1qq6m0DOmT40DID-DKA23L8wYx68TWAyvLXl0m$>

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community