Personal information protection challenge for cross-border brokers

As Chinese people's wealth continues to grow, some domestic investors have started investing in the US and Hong Kong stock markets, leading to the rapid development of cross-border internet securities brokerages that provide stock trading services in major global markets.

However, the Personal Information Protection Law, which will come into effect on Nov 1, will pose some challenges to the cross-border internet securities brokerage industry. At present, the operating model for the sector is to develop customers in China, help them create an online account to which they can transfer money through overseas bank cards or after purchasing foreign exchange through domestic bank cards, which will allow them to trade in US and Hong Kong stocks.

While creating such an account, domestic investors need to provide personal information such as occupation, name, annual income, source of funds, and tax payment details to the cross-border internet securities brokers. And while they are trading in stocks, the brokers will also acquire the investors' bank accounts, transaction data and other information. As cross-border internet securities brokerages need to comply with overseas regulatory requirements when operating overseas, they might provide the traders' personal information to the authorities overseas.

For example, US stockbrokers are supervised by the US Financial Industry Regulatory Authority, while the US-listed companies are regulated by the Securities and Exchange Commission. These government departments are empowered to demand client information from the securities brokers.

As such, cross-border internet securities brokers may have to pass on domestic investors' personal information to the US financial authorities.

However, according to China's Personal Information Protection Law, when personal information is shared with parties outside the country for business purposes, its processors must meet one of the following conditions: pass the security assessment of the State Cyberspace Administration; possess personal information protection certification; enter into a contract with the overseas recipient in accordance with the model formulated by the regulator that stipulates the rights and obligations of both parties.

As the regulations do not allow cross-border internet securities brokerages to provide personal information to overseas regulators without authorization, these companies will need to do a lot of work to comply with the law if they want to continue operating such businesses in China. Such compliance will become a prerequisite for the survival and continued development of cross-border internet securities brokerages.