China's Law-Based Cyberspace Governance in the New Era

II. Consolidating the Legal System for Cyberspace Governance

The law is a powerful tool for governing a country, and sound laws are the prerequisite for good governance. Following the trend of internet development, China has advanced the legal system for cyberspace governance through legislation that is enacted in a well-conceived and democratic way and in accordance with the law. Cyber legislation is becoming systematic, holistic, coordinated, and time-efficient.

Cyber legislation in China has undergone a long, gradual process that can be roughly divided into three stages. The first stage ran from 1994 to 1999, a period when China became connected to the internet. Internet users and devices grew steadily in number. Legislation during this stage focused on network infrastructure security, specifically computer systems security and network security. The second stage lasted from 2000 to 2011, when personal computers (PC) served as the main terminal for internet connection. As PCs and internet users grew rapidly in numbers, internet connection services became more affordable and web-based information services boomed. Legislation during this stage shifted to internet services and content management. The third stage, which began in 2012, is dominated by mobile internet. Legislation now is gradually focusing on comprehensive cyberspace governance by covering areas such as network information services, information technology development, and cybersecurity.

Over the years, China has promulgated more than 140 laws on cyberspace, forming a cyber legislation framework with the Constitution as the foundation, supported by laws, administrative regulations, departmental rules, local regulations and local administrative rules, endorsed by traditional legislation, and underpinned by specialized cyber laws governing online content and management, cybersecurity, information technology, and other elements. This system of laws on cyberspace governance provides a strong institutional guarantee for building up China's strength in cyberspace.

Panel 1 Cyber Legislation in China

Law

・ Electronic Commerce Law

・ Electronic Signature Law

・ Cybersecurity Law

・ Data Security Law

・ Personal Information Protection Law

・ Law on Combating Telecom and Online Fraud

Administrative Regulation

・ Regulations on the Security and Protection of Computer Information Systems

・ Regulations on Computer Software Protection

・ Administrative Measures on Internet Information Services

・ Telecommunications Regulations

・ Regulations on the Administration of Foreign Investment in Chinese Telecommunications Businesses

・ Regulations on the Protection of the Right of Communication Through Information Networks

・ Regulations on the Security and Protection of Critical Information Infrastructure

Departmental Rule

・ Regulations on the Protection of Children's Online Personal Information

・ China Internet Domain Name Regulations

・ Measures on the Supervision and Administration of Online Transactions

・ Provisions on the Administration of Internet News and Information Services

・ Regulations on the Governance of Online Information and Content

・ Regulations on the Management of Algorithmic Recommendations for Internet Information Services

Local Regulation

・ Guangdong Provincial Digital Economy Promotion Act

・ Zhejiang Provincial Digital Economy Promotion Act

・ Hebei Provincial Regulations on Information Technology Development

・ Guizhou Provincial Regulations on Government Data Sharing

・ Shanghai Municipal Data Regulations

Local Administrative Rule

・ Measures of Guangdong Province on Public Data Management

・ Measures of Anhui Province on the Management of Data and Resources for Government Affairs

・ Measures of Jiangxi Province on the Protection of Computer Information System Security

・ Interim Measures of Hangzhou City on the Administration of Online Transactions

Total Number

Exceeding 140

1. Establishing a System of Laws for Protecting People's Rights and Interests in Cyberspace

China has established a sound system of laws to protect people's rights and interests in cyberspace, laying the legal groundwork for protecting both online and offline rights.

— Protecting the freedom and confidentiality of correspondence. This is a prerequisite for citizens to air views and needs in cyberspace of their own volition. China enacted the Measures on Ensuring Security of Internationally Connected Computer Information Networks in 1997, to provide legal protection of the freedom and confidentiality of correspondence as enshrined in the Constitution. It formulated the Telecommunications Regulations in 2000, stipulating that citizens' freedom to use telecom services and their confidentiality of correspondence are protected by law. It revised the Regulations on Radio Administration in 2016, further strengthening the protection of the confidentiality of correspondence via radio service. Thus, this basic right enjoys full protection in cyberspace.

— Protecting personal information rights and interests. China has built a line of defense in law for protecting personal information rights and interests. In 2020, the Civil Code was adopted at the Third Session of the 13th National People's Congress, which makes systemic provisions on protecting personal information in civil cases based on previous legal stipulations. In 2009 and 2015, Amendment VII and Amendment IX to the Criminal Law added provisions on the crime of infringing upon citizens' personal information, thus strengthening the protection of personal information in the Criminal Law. In terms of cyber legislation, the Standing Committee of the National People's Congress issued the Decision on Strengthening Online Information Protection in 2012, announcing clearly to protect electronic information that may reveal citizen's identity and privacy. The Cybersecurity Law enacted in 2016 further refined rules on personal information protection.

The Personal Information Protection Law, promulgated in 2021, represented an overall upgrading of personal information protection. It defined and refined principles on protecting personal information and rules on processing personal information, and specified how state agencies should process personal information in accordance with the law. It empowered the subjects of personal information with a range of rights, emphasized the obligations of personal information processors, improved the mechanism for protecting personal information, and set clear and strict legal liabilities.

— Safeguarding citizen's property. China has strengthened legislation to curb infringements upon citizens' property by way of the internet. In 2018, the Electronic Commerce Law was promulgated, stipulating that products or services from e-commerce suppliers should not undermine personal safety or the security of property. The Civil Code has clear provisions on the legal liability of those who infringe upon others' property rights and interests by way of the internet. In 2022, China enacted the Law on Combating Telecom and Online Fraud, providing strong legal support for fighting crime and safeguarding people's property rights and interests.

— Protecting the digital rights of special groups. Through multilevel and multifaceted legislation, China has invested a real effort to close the digital divide for minors, elderly people, and persons with disabilities, so that everybody can join in the digital society on an equal basis and enjoy the benefits of the digital age as much as possible.

As stipulated in the Cybersecurity Law, the state supports research and development on internet products and services that are beneficial to minors' healthy growth, and punishes by law those who place their physical and mental health at risk via the internet. In 2019, China issued the Regulations on the Protection of Children's Online Personal Information, prioritizing the protection of personal information for children. In 2020, the Law on the Protection of Minors was revised, to strengthen minors' education on internet literacy, online supervision and regulation of content for minors, protection of minors' personal information online, and prevention and control of internet addiction, all to safeguard minors' legitimate rights and interests in cyberspace. The Data Security Law, promulgated in 2021, stipulates that providers of smart public services should take into full consideration the needs of elderly people and persons with disabilities, and make sure they do not create obstacles to their daily life.

2. Improving Law-Based Governance of the Digital Economy

To transform from high-speed growth to high-quality growth, China has continued to improve institutions fundamental to data development, maintain order in the digital market, and regulate new business forms and models of the digital economy, laying a sound framework of rules for the healthy growth of the digital economy.

— Creating institutions fundamental to data development. Data is a fundamental resource and an engine for innovation. The Data Security Law contains provisions on implementing the big data strategy, supporting R&D on data-related technology and business innovation, advancing data-related standards, and developing data trading markets. These provisions aim to improve data development and utilization, and promote the growth of the digital economy in which data serves as a key factor.

— Regulating the operation of the digital market. China regulates and develops the digital market in accordance with the law, stands firmly against monopolies and unfair competition, and improves digital rules to ensure a market environment for fair competition.

The Electronic Commerce Law provides a full set of regulations on e-commerce operation, with clear provisions on the responsibilities of e-commerce platform operators and business owners on these platforms. It stipulates that e-commerce operators with a dominant share of the market should not abuse their position to eliminate or limit competition, so that fair competition is maintained. The Law on the Protection of Consumer Rights and Interests (2013 Revision) established a seven-day unconditional return policy for online shopping, to reinforce the primary responsibility of online business operators in consumer rights protection. The Law Against Unfair Competition (2017 Revision) has separate provisions regarding the internet, to ban unfair competition that takes advantage of technology. The Measures on the Supervision and Administration of Online Transactions, enacted in 2021, contain detailed provisions on the relevant regulations in the Electronic Commerce Law, to strengthen online trading supervision. In 2021, the Anti-monopoly Commission under the State Council issued the Anti-monopoly Guidelines for Platform Economy, to strengthen and improve anti-monopoly supervision based on the status, characteristics, and development of the platform economy. In 2022, the Anti-monopoly Law was amended to improve the anti-monopoly framework for the platform economy, banning operators from abuse of a monopoly position by leveraging their strengths in data and algorithms, technology, capital, and platform rules.

— Regulating new business forms and models of the digital economy. The rapid rise of new business forms and models in the digital economy created social and economic impetus and potential, and also posed new challenges for social governance and industrial growth. Focusing on problems unique to the new forms and models in certain areas, China has advanced legislation in both the comprehensive and special laws to prevent and defuse risks.

The Civil Code improved the rules on the conclusion and execution of electronic contracts, and brought data and virtual assets under legal protection, giving a boost to the digital economy. To expand the legal framework for governing Internet Plus services, China has introduced an array of regulations, including the Interim Measures on the Administration of Online Taxi Booking Services, Regulations on the Administration of Algorithmic Recommendations for Internet Information Services, Regulations on the Administration of Blockchain Information Services, Interim Measures on the Administration of Business Activities of Intermediary Agencies for Online Lending, and Interim Regulations on the Administration of Online Tourist Services.

3. Safeguarding Cybersecurity by Law

Cybersecurity is a new component of national security, and an issue of paramount importance. By formulating the National Security Law, Cybersecurity Law, and Data Security Law, China has defined the legal institutional framework for cybersecurity, to boost its defenses against cyber threats and effectively respond to cybersecurity risks.

— Setting rules for cybersecurity. The Regulations on the Security and Protection of Computer Information Systems was released in 1994, designed to safeguard and supervise computer information system security. In 2000, the Standing Committee of the National People's Congress issued the Decision on Ensuring Internet Security, detailing security requirements in operation and information, and establishing a framework of responsibilities for cybersecurity composed of civil, administrative and criminal liabilities.

The Cybersecurity Law specifies the systems for ensuring security of network operation, online products and services, data, and information. Some of its provisions are further elaborated in the Measures on Cybersecurity Review and the Regulations on the Management of Security Loopholes of Online Products. After years of effort, China now has a complete set of legal rules on cybersecurity, and greater capacity for ensuring cybersecurity through institutional development.

— Ensuring security for critical information infrastructure. Critical information infrastructure is the nerve center of socioeconomic operation, and the top concern for cybersecurity. Its security is central to maintaining cyber sovereignty and national security, guaranteeing sound socioeconomic development, and protecting the public interest and the legitimate rights and interests of individual citizens.

In 2021, China released the Regulations on the Security and Protection of Critical Information Infrastructure, with provisions defining what constitutes critical information infrastructure and the principles and goals of protection. The procedures for identifying critical information infrastructure were improved, and the operators' responsibility for cybersecurity was clarified. There were also provisions on improving the mechanisms for network security and protection, setting up special security management agencies, conducting safety monitoring and risk assessment, and regulating the purchase of online products and services. The Regulations provide the legal ground for upgrading the country's capacity for safeguarding critical information infrastructure.

— Developing the legal framework for data security management. Proceeding from reality and focusing on the outstanding problems in data security, China has strengthened its capacity for data security through legislation. The Data Security Law has clear provisions on establishing mechanisms for categorized and classified data protection, risk monitoring and early warning, emergency response, and data security review; it also contains measures to facilitate data security and development and provisions for the security and openness of government data.

4. Improving Regulation for a Sound Cyber Environment

Cyberspace is a public space for internet users. A clean and sound cyber environment is in accord with the people's expectations. Out of a strong sense of responsibility towards society and the people, China has introduced laws and regulations for comprehensive cyberspace governance, to clean up the cyber environment with a focus on online information and content.

— Regulating the orderly dissemination of online information. To strengthen online information governance, a global challenge, China formulated the Civil Code, Cybersecurity Law, and Administrative Measures on Internet Information Services, to define the rules for the dissemination of online information and the liabilities of relevant subjects. These laid the legal groundwork for tackling illegal information that threatens national security, harms the public interest, and infringes upon the legitimate rights and interests of individuals.

— Sharpening the legal weapons against cyberterrorism. China stands firm against the threat of cyberterrorism. The Criminal Law, Criminal Procedure Law, and Anti-Money Laundering Law contain provisions on criminal liability for terrorist activities and judicial proceedings in the investigation of terrorist crimes, as well as on monitoring the money for funding terrorist activities. The Counterterrorism Law promulgated in 2015 has separate provisions on the targets, measures and mechanisms for combating terrorism in cyberspace.