Two statutes adopted in 2016 completed the core of the security-legislation wave that had begun with the 2015 National Security Law. The Law on the Management of Activities of Overseas NGOs within China (中华人民共和国境外非政府组织境内活动管理法）, adopted April 28, 2016 and effective January 1, 2017, moved foreign nonprofits out of the civil-affairs system and under police regulation. The Cybersecurity Law (中华人民共和国网络安全法）, adopted November 7, 2016 and effective June 1, 2017, asserted state sovereignty over cyberspace, imposed data-localization and security-review duties on network operators and critical information infrastructure, and was enforced quickly — the first major penalties landed within four months of its entry into force. Both laws drew sustained international criticism: the first as a strangling of independent civil society, the second as a barrier to trade and innovation.
The Cybersecurity Law: adoption and provisions
The Cybersecurity Law was adopted by the Standing Committee of the National People’s Congress on November 7, 2016, at the bimonthly session that concluded that Monday, following a third reading. It took effect on June 1, 2017. The drafting history ran for well over a year: a first draft was released for public consultation on July 6, 2015 — five days after the National Security Law took effect — a second draft went out for public comment in July 2016, and the third reading took place in October 2016.
The official framing, as reported by Xinhua on the day of adoption, was that “China’s top legislature on Monday adopted a Cybersecurity Law to safeguard sovereignty on cyber space, national security and the rights of citizens.” Legal summaries noted that the law “declares the state’s sovereignty in cyberspace.”
Key provisions, as rendered in the unofficial English translation of the adopted text (the authoritative text is the Chinese original), included:
- Data localization (Article 37): “Operators of critical information infrastructure that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China shall store such information/data within Mainland China. If, due to business requirements, it is necessary provide such information/data outside of the territory of Mainland China, a security assessment shall be conducted according to the measures jointly formulated by the national cyberspace authorities and relevant departments of the State Council.”
- Security review (Article 35): operators of critical information infrastructure purchasing network products and services that might affect national security must undergo a security review organized by the national cyberspace authorities and relevant State Council departments.
- Annual risk assessment (Article 38): critical-information-infrastructure operators must conduct at least one network-security risk assessment each year and submit the results to the relevant department.
- “Secure and controllable” product regime: critical network equipment and catalogued products were reported to require examination or evaluation before sale or supply, with mandatory testing and certification of computer equipment.
- Investigative access: the Associated Press reported on the day of adoption that companies must give government investigators full access to their data if wrongdoing was suspected, and that the law required internet operators to cooperate with investigations involving crime and national security.
- Weblog retention: legal summaries reported a requirement to retain weblogs for at least six months.
- Real-name registration: the law was reported to require network operators to collect real identity information from users.
Legal analysts noted that the final draft broadened the personal-data scope from “citizens’ personal data” to “personal data,” implying that the data of foreign residents in China also fell under the localization rules.
The Overseas NGO Law: adoption and provisions
The Law on the Management of Activities of Overseas NGOs within China was adopted on April 28, 2016, at the 20th meeting of the 12th NPC Standing Committee, with a structure of seven chapters and 54 articles. It took effect on January 1, 2017 — an eight-month gap that the NPC, at a press conference the day of adoption, justified on three grounds: giving foreign NGOs time to understand the law, giving public-security bureaus and professional supervisory units time to prepare implementation rules, and training officials to serve foreign NGOs and implement the law.
Key provisions included:
- Police, not civil-affairs, registrar (Article 6): “the Ministry of Public Security and the provincial police departments will be responsible for the registration and regulation of foreign NGOs” — a transfer of regulatory competence from the Ministry of Civil Affairs to the public-security apparatus that analysts later called the securitization anchor of the law.
- Activity prohibitions (Article 5): overseas NGOs “must not harm China’s national unity, security, and national solidarity and must not harm China’s national interests, the public’s interests and the legitimate rights and interests of citizens, legal persons, and other organizations”; they “shall not engage in or fund for-profit activities and political activities, and shall not illegally engage in or fund religious activities.”
- Prior approval (Article 9): “foreign NGOs operating in China must not engage in activities in China without approval.”
- Two legal tracks: registered “representative offices,” or temporary activities (up to one year) conducted with a Chinese partner that files records.
- Professional supervisory unit sponsorship: an overseas NGO needed the sponsorship of a professional supervisory unit to register a representative office. Pillsbury reported in 2017 that the Ministry of Public Security had published a catalogue of activities and a supervisory-unit list in December 2016, with more than 40 national-level units — 43 government agencies plus four social groups such as the All China Women’s Federation; the Ministry of Foreign Affairs and the Chinese Academy of Social Sciences were notably excluded.
- Onerous reporting: filing of annual activity plans and annual inspection.
- No member recruitment in China (Article 28): except as approved by the State Council.
- No imposed terms (Article 20): foreign NGOs “must not impose additional terms and conditions on their Chinese cooperating organizations and beneficiaries which violate Chinese law and regulations.”
- Broad scope (Article 2): overseas NGOs were defined as “not-for-profit, nongovernmental social organizations lawfully established outside of mainland China, such as foundations, social associations, and think tanks” — broad enough, legal-information analysts noted, to cover trade associations and chambers of commerce.
The official framing emphasized orderly management. Xu Xianming, deputy head of the NPC Law Committee, said that “foundations and social service organizations operated by overseas NGOs, which have already registered with the civil affairs department, will be able to continue operating.” Xinhua reported that “the law stresses that legal operation of overseas NGOs on the mainland is protected.” State news outlets estimated at the time that more than 7,000 foreign NGOs would be affected.
Responses to the Cybersecurity Law
The business community reacted sharply. James Zimmerman, chairman of the American Chamber of Commerce in China, said in an emailed statement after passage: “This is a step backwards for innovation in China that won’t do much to improve security. The Chinese government is right in wanting to ensure the security of digital systems and information here, but this law doesn’t achieve that. What it does do is create barriers to trade and innovation.” AmCham China had already warned in an April 2015 policy report against data-localization policies becoming trade barriers, and the chamber later said it had “led extensive lobbying efforts by more than 40 industry groups against the most damaging aspects of the law.”
Trade associations wrote to Beijing. The Associated Press reported that a coalition of 46 groups from the United States, Europe, Asia, and Latin America — including the U.S. Chamber of Commerce, the European Services Forum, and groups from Japan, Korea, and Mexico — wrote to Premier Li Keqiang urging changes, warning that the localization requirements might make data theft easier and reduce access to Chinese customers. Separately, Bloomberg reported that more than 50 trade associations and chambers of commerce signed a letter asking for the law’s implementation to be delayed, “noting that the law ‘could impact billions of dollars of cross-border trade and lock out foreign cloud operators because of limits on how they operate in the country,’” and that “these measures will add costly burdens, restrict competition and may decrease the security of products and jeopardize the privacy of Chinese citizens.” The sources do not make clear whether the 46-group letter and the 50-plus-group letter were the same initiative or two different ones.
Corporate compliance moved ahead of enforcement. Airbnb announced “Airbnb China” in October 2016, processing and storing reservation data for travel and hosting in China and citing “Chinese laws and regulations,” days before the law’s passage. Scott Thiel, a partner at DLA Piper, said foreign firms were expected to feel more impact because they typically had more businesses, headquarters, and data-processing centers overseas, with a greater need to move information outside the mainland.
Domestic and analytic voices diverged. Professor Li Yuxiao of Beijing University was quoted as calling secure information systems “integral to protecting the economy while also placing value on domestic operating systems over foreign products.” Adam Segal of the Council on Foreign Relations said: “We can assume that Chinese leadership will use it as an example of why China needs its own technology and cannot continue to rely on foreign suppliers.” The Associated Press, on the day of passage, described the statute as “a sweeping and controversial law that may grant Beijing unprecedented access to foreign companies’ technology and hamstring their operations in the world’s second-largest economy.” U.S. and European law firms — including Hogan Lovells, Mayer Brown, and Lexology contributors — emphasized in contemporaneous analyses the vagueness of key terms such as “critical information infrastructure,” “important data,” and “security assessment,” treating unresolved implementing measures and interpretive uncertainty as the primary compliance harm.
Responses to the Overseas NGO Law
Civil-society and professional reactions were alarmed. The American Society of Association Executives, which submitted comments on the draft, said on May 2, 2016: “While the draft law seeks to establish a regulatory framework for non-mainland non-governmental organizations (including trade associations and professional societies) to operate in China, the registration process is onerous and overly burdensome and would likely lead a broad range of organizations that have been active in China to rethink their involvement.” CIVICUS Monitor wrote in 2017 that the law “has been widely condemned as a thinly veiled attempt to impede the emergence of an independent civil society in China.” Chinese Human Rights Defenders said on June 1, 2017, that “international NGOs operating in China have been treated as ‘hostile foreign forces.’” The International Center for Not-for-Profit Law framed the statute neutrally as “the first comprehensive law regulating the activities of all overseas NGOs (ONGOs) in the PRC,” setting out the registration mechanics. A 2018 academic analysis by the GIGA Institute argued that the decisive push for the law came from the National Security Commission and that placing oversight in the Ministry of Public Security was “a clear sign of the securitisation of China’s policy towards international civil society.”
Registration statistics offered an empirical counterpoint. According to Chinese-language research by Tsinghua University researcher Huang Zhenping (黄真平）, translated by China Development Brief, by September 30, 2017, 146 foreign NGOs had established 167 representative offices, alongside 41 Taiwan, Hong Kong, and Macau NGOs with 54 offices — a total of 187 overseas NGOs with 221 offices. Official statistics from the Ministry of Public Security’s Office of Overseas NGOs, translated by China Development Brief, showed that by December 31, 2017, 305 overseas NGOs had registered representative offices; the top five countries and regions of origin were the United States (72), Hong Kong (60), Japan (42), Korea (24), and Germany (20), together accounting for 71.48% of the total; 74.43% of registrations were in Beijing, Shanghai, Yunnan, Guangdong, and Liaoning. In the full year 2017, 305 offices were registered and 494 temporary activities were filed. The first batch of 31 registrations came in January 2017 at public-security bureaus in Beijing, Shanghai, and Guangdong, and Pillsbury reported that the first 20 Beijing offices — mostly former civil-affairs-registered foreign foundations — transferred their registrations within about two weeks.
Competing viewpoints
On the Cybersecurity Law, the debate broke into distinct attributed readings. The official position held that the law safeguarded cyberspace sovereignty, national security, and citizens’ rights, with domestic scholarly support describing secure information systems as integral to protecting the economy; the government downplayed suggestions that the law would be used to drive foreign technology and products out of the Chinese market. The trade-barrier critique, voiced by AmCham and the trade-association letters, held that the law created barriers to trade and innovation, added costly burdens, restricted competition, and could decrease the security of products and jeopardize citizens’ privacy. A security-skeptical critique within the business framing — Zimmerman’s compound claim — argued the law failed on its own stated terms: “a step backwards for innovation in China that won’t do much to improve security.” And a compliance-analytic reading from law firms emphasized that vague definitions of “critical information infrastructure,” “important data,” and “security assessment,” plus unresolved implementing measures, made uncertainty itself the central harm.
On the Overseas NGO Law, the official framing described orderly management: the law brought clarity to a previously ambiguous operating environment, served national security and social stability, and protected lawful operations of overseas NGOs. The civil-society framing, from CIVICUS, CHRD, and Amnesty, described a thinly veiled attempt to impede the emergence of an independent civil society and the treatment of foreign NGOs as “hostile foreign forces.” Moderate readings, from ASAE and legal observers, focused on compliance burden: onerous registration, broad official discretion in interpretation, and guidance that only partially clarified procedures. And a Chinese academic-empirical reading, led by Tsinghua’s Huang Zhenping and Professor Jia, worked from the registration data rather than judgment — counting offices by country of origin and tracking the rise of temporary-activity filings as an alternative compliance channel.
Implementation and aftermath
The Cybersecurity Administration of China moved quickly. On April 11, 2017, it released draft measures for the security assessment of personal information and important data to be transmitted abroad, which would have expanded the localization obligation beyond critical-information-infrastructure operators to other network operators. On August 11, 2017, the CAC directed its Beijing and Guangdong authorities to investigate Tencent’s WeChat, Sina’s Weibo, and Baidu’s Tieba, following user reports that the platforms had “not fully take on their management responsibilities toward information posted by users that are prohibited by laws and regulations.” On September 25, 2017, Tencent, Weibo, and Baidu received the CAC’s maximum penalties for allowing pornographic and violent content and content promoting ethnic hatred; the fine amounts were not made public, and the companies were ordered to remove the content and strengthen platform management. The CAC stated: “The internet does not operate outside of the law… the CAC will seriously implement the new cybersecurity law and other regulations to increase territorial supervision and enforcement efforts regarding the internet.” International press reported that it was the first time the CAC had levied maximum fines on technology firms under the new law.
Compliance pressure rippled outward. Sina Weibo reportedly recruited 1,000 content supervisors in October 2017. In June 2017, Apple was required to remove hundreds of VPN apps from its China App Store to comply with the new cybersecurity law; Skype was removed from app stores that November, according to Freedom House’s 2018 Freedom on the Net report. That report also documented the June 2017 internet-news regulations, under which only traditional media or state-controlled enterprises were licensed to gather and disseminate news online — about 80 Sina Weibo and WeChat accounts were shut down on June 7, and the state press and publication regulator ordered three major sites, including Sina Weibo, to stop streaming political and social audio-video content on June 22.
For the Overseas NGO Law, the first year of implementation was administrative rather than punitive: the January 2017 first batch of 31 registrations, followed by the year’s official totals of 305 registered offices and 494 filed temporary activities. The Ministry of Public Security’s December 2016 filing guidelines and catalogue of activities and supervisory units had partially clarified procedures, though many questions remained into early 2017.
Free China Movement record
No contemporaneous Free China Movement press statement, commentary, or campaign on either the Cybersecurity Law or the Overseas NGO Law from 2016–2017 is on record in the sources reviewed. FreeChina.live’s Great Firewall & Internet Persecution in Mainland China page later carried a standing archive entry on the 2017 Cybersecurity Law, but no FCM materials on the Overseas NGO Law were located.
Sources
- Xinhua / People’s Daily Online, November 7, 2016 (Cybersecurity Law adoption)
- Xinhua via thefreelibrary, April 2016 (Overseas NGO Law adoption and official framing)
- Central Government of China release, April 29, 2016 (Overseas NGO Law), via Chinascope
- Cyberspace Administration of China notices, August 11 and September 25, 2017 (WeChat/Weibo/Tieba investigation and penalties), via China Media Project and Reuters
- Reuters, September 25, 2017 (maximum fines on Tencent, Weibo, Baidu), via gadgets360
- Associated Press, November 7, 2016 (Cybersecurity Law passage), via Carrier Management
- Bloomberg, 2016 (50-plus trade-association letter), via ETCentric
- Associated Press, 2016 (46-group letter to Premier Li Keqiang), via manufacturing.net
- James Zimmerman, AmCham China, emailed statement, November 7, 2016, via Carrier Management
- AmCham China, “China’s Cyber Insecurity” (lobbying account); April 2015 Policy Spotlight report
- American Society of Association Executives comment, May 2, 2016, via associationsnow
- CIVICUS Monitor, 2017
- Chinese Human Rights Defenders statement, June 1, 2017 (via CIVICUS Monitor)
- International Center for Not-for-Profit Law, FAQ on the Overseas NGO Law
- Ministry of Public Security, Office of Overseas NGOs, 2017 registration statistics (via China Development Brief translation)
- Huang Zhenping (黄真平）, Tsinghua University, registration analysis to September 30, 2017 (via China Development Brief translation)
- Pillsbury, 2017 (NGO-law implementation note; supervisory-unit catalogue)
- Hogan Lovells, November 2016 (“China passes controversial Cyber Security Law”)
- Mayer Brown, November 2016
- Lexology, 2016–2018 (Cybersecurity Law highlights)
- Global Policy Watch, May 2016 (NGO law analysis)
- JD Supra, 2016 (NPC press-conference note; NGO law memo)
- Mondaq, 2017 (CAC draft cross-border measures)
- Freedom House, Freedom on the Net 2018 (2017 events analysis)
- GIGA Focus Asia, December 2018 (securitisation thesis)