What do you do?
As one of the earliest lawyers in China engaging in the privacy and data protection law area, I have been not only actively participating in the legislation of data-related rules in China, but also providing services for domestic and multinational companies on privacy and data protection legal issues. For domestic companies expanding their overseas presence, I assist them to establish internal systems of cybersecurity and data compliance for satisfying requirements in multiple jurisdictions such as the European Union, the US and Brazil. Moreover, I advise multinational companies either as an external or in-house lawyer on their compliance in China including but not limited to some cutting-edge topics like AI, automatic drive, and FinTech.
Why data?
When I was an antitrust lawyer, most of our clients were internet tycoons. Thanks to the promulgation of China Cybersecurity Law in 2016 and the booming awareness of data privacy protection in China, the compliance demand of these companies on data processing increased dramatically. Therefore, I began to provide consultation in this area to satisfy our clients’ requests.
What’s keeping you busy?
As PayPal’s senior legal counsel on data privacy in China, I serve as a watchdog ensuring the company’s data processing compliance, such as assessing the legality of data assets transfer in acquisitions in China; performing data protection impact assessmen before launching of products/services; establishing a standardised procedure on cross-border data transfers; localising global privacy policies and data processing agreements with third parties; and formulating local data breach notification rules.
What mentors or other influential figures have helped you get where you are today?
I have been fortunate to have Susan Ning and Han Wu, both are partners in King & Wood Mallesons, as my mentors of associate. Their intelligence, dedication, profession, and patience influenced me substantially. When I joined PayPal, my manager, Steve Coope, also gives me many valuable suggestions on the role transfer from an external counsel to an in-house lawyer.
If you could change one data-related law, how and why would you change it?
I may think about changing China’s Cybersecurity Law, including but not limited to: (1) adding exceptional conditions for processing personal information without obtaining the consent of data subjects such as data processing necessary for the performance of a contract to which the data subject is a party; (2) clarifying key definitions such as “critical information infrastructure”, “network operator”, “important data”, etc; and (3) adding exceptional conditions which do not need to conduct ex ante security assessment for transferring personal information and/or important data out of China, like data transfers for transaction needs or proactively initiated by data subjects. As such, the law may be more applicable and balanced between the compliance cost to companies and the impact on the interests of data subjects when data breaches.
What’s the next big thing – what data opportunities are companies now looking at?
Since the volume of data collected by companies increases, they are looking at commercialising their data assets such as establishing user profiling for marketing. Companies may need to confirm the legality of the data source and ownership, value data assets and find a lawful way to transact data, given that personal information transaction is illegal in China.
What’s keeping companies worried at the moment – what are some key data risks?
As Chinese data protection laws are in development, it is quite challenging for a company to reach a balance between compliance and business development, especially when certain important laws and regulations on data protection are still in the process of public consultation in China. Multinational companies with global data flows may confront legal conflicts among different jurisdictions.
What do you do to relax?
During the quarantine, I have spent much time with my family at home. We have more opportunities to cook and chat together, which makes me feel relaxed.