"The measures are the first associated with implementation of the 2016 Cybersecurity Law to have been issued in final form, notwithstanding that the law comes into effect 1 June. They leave open as many questions as they answer. The law will require operators of 'critical information infrastructure' to undertake security review in relation to purchases of network products and services that 'may affect national security'. What counts as 'critical information infrastructure' and what specific products and services are likely to be regarded as affecting national security? These threshold questions still await guidance from regulators."

"The core regulatory regime governing internet services in China has been extensively re-engineered over the past two years. Many of the provisions, such as the real-name registration and information security requirements, bring the 2005 rules into line with that regime. Others, such as the expansion to cover new media channels and technologies, capture apps which historically have occupied a grey area in the law. Moreover, the requirements to separate editorial functions and cite sources represent new material steps in a trend toward tightening control over editorial content and clamping down on the viral spread of stories the authorities consider 'fake news'."

"The CBRC notice will promote competition in the banking industry by facilitating the business of foreign-invested banks in China. In the short term, it will not significantly impact China's banking industry since current foreign-invested banks account for a small percentage of China's total banking assets. In the long term, however, as the financial demands of Chinese enterprises expand globally, domestic banks will face challenges from international banks, which have a global network and are more sophisticated in universal banking business."

"The provisions are the first procedural rules issued under the 2016 Cybersecurity Law and aim to standardise the administrative law enforcement activities with respect to internet information content. The provisions contain detailed procedural requirements and template documents that will enhance the transparency and efficiency of the enforcement process. That said, it remains to be seen how effectively the provisions will be implemented by the local CAC offices."

"In addition to providing much needed definitions for the key terms in Article 253 of the 1997 Criminal Law, the interpretation sets forth more clearly the conviction and sentencing criteria for the infringement of personal information. The sentencing criteria in general have been lowered to crack down on the rampant leaking of personal data. In particular, companies that violate Article 253 will be fined and senior management and other persons directly responsible will be sanctioned."