Circular on the public request for comments on the Law of the People ' s Republic of China on Cybersecurity (a further draft of the amendments)

Law of the People ' s Republic of China on Cybersecurity (The revised draft is re-opposed) 1. Amend article 59 to read as follows: “If a network operator fails to comply with its obligations under article 21 and article 25 of this Act, the competent authorities shall order the correction and warning of a fine of not less than $10,000 and not more than $50,000; if he refuses to correct or causes harm to the safety of the network, he shall be liable to a fine of not less than $50,000 and not more than half a million and to a fine of not less than $100,000 on the person directly responsible. If the operator of a critical information infrastructure fails to comply with his or her obligations under articles 33, 34, 36 and 38 of this Law, the competent authorities shall order the correction and warning to be punishable by a fine of between $50,000 and $100,000; if he or she refuses to correct or results in a breach of the safety of the network, he or she shall be liable to a fine of between $100,000 and $1,000,000 and the person directly responsible. In the first two cases, the authorities concerned are liable to a fine of between $500,000 and 2 million dollars for serious harm to the safety of the network, including the disclosure of data and the loss of local functions in the critical information infrastructure. They may also order the suspension of the relevant operations, the closure of the operation, the closure of websites or applications, the revocation of the relevant business licence or the revocation of the business licence. They are also liable to a fine of between 50,000 and 200,000 yuan for those directly responsible and other persons directly responsible; in the case of particularly serious harm to the security of the network, such as the loss of primary functions in the critical information infrastructure, they are liable to a fine of between 2 million and 10 million yuan for those responsible and to a fine of between 200,000 and 1 million yuan for those directly responsible. (2) Add a new article as article 61: “In violation of article 23 of this Law, the sale or supply of network-critical equipment and products that do not meet the requirements for security clearance or security clearance shall be corrected or suspended by order of the competent authority, warning shall be given and the proceeds of the offence shall be confiscated; more than $100,000 of the proceeds of the offence shall be liable to a fine of more than twice and less than three times the proceeds of the offence; and if there is no illicit proceeds or less than $100,000 of the proceeds of the offence, to a fine of between $30,000 and $100,000. (3) Add a new article as article 64: “Where there are acts of article 60, paragraph 1, 2, and article 63 of this Law causing consequences under article 59, paragraph 3, of this Law, the penalty shall be imposed.” (4) Replace article 65 with article 67, amended to read: “The operator of a critical information infrastructure, in violation of article 35 of this Law, using a network product or service that is not subject to a security review or security review, is ordered by the competent authority to correct or eliminate the effects of national security for a period of time, and is liable to a fine of not less than 10 times the amount of the procurement of the person directly responsible and other persons directly responsible, and not to impose a fine of not less than $110,000 on the person who, in accordance with article 50 of this Law, prohibits the issuance or transmission of information, the taking of disposal measures, the maintenance of the relevant records, as provided for in article 69, is ordered by the competent authority to correct the person, to notify the person who, in violation of article 47 of this Law, the person who, prohibits the publication or transmission of information which is not subject to a direct notification of a fine of not less than $50,000, or to suspend the person whose If the network operator has an offence under the preceding paragraph, which has particularly serious consequences and consequences, the competent authorities shall impose a fine of more than $2 million and less than $10 million, and may order the suspension of the relevant business, the closure of a website or application, the revocation of the relevant operating licence or the revocation of the operating licence, and a fine of more than $200,000 and less than $1 million on those directly responsible. (b) Violations of the right to legal protection of personal information in violation of articles 22 (3), 41 to 43 of this Law; Add a new article 7 to read as article 72: “In the case of a network operator who voluntarily eliminates or mitigates the harmful consequences of an offence, commits a minor offence and promptly corrects it without causing a harmful consequence or a first violation, with minor consequences and with prompt correction, the administrative penalty shall be light, reduced or waived in accordance with the provisions of the Administrative Punishments Law of the People's Republic of China. The competent authorities shall, by virtue of their duties, establish the corresponding discretionary basis for administrative penalties and regulate the exercise of discretionary powers for administrative penalties. 8. Amend part of the text to read as follows: (i) Replace article 61 with article 62 and article 62 with article 63 and replace the words “closure of the website” with the words “closure of the website or application”. (b) Replace article 64, paragraph 2, with article 66. In addition, the number of the article has been adjusted accordingly.

Note on the Law of the People ' s Republic of China on Cybersecurity (draft of amendments for further comments)

The party centre attaches great importance to the maintenance of national cybersecurity. General Secretary Xi has repeatedly given important instructions emphasizing that “there can be no national security without cybersecurity, no stable economic and social functioning, and the interests of the population at large cannot be guaranteed”. The 20th and 20th Plenums made important deployments to strengthen focus areas, emerging areas, legislation in the foreign sphere and to strengthen its systemic, holistic, synergistic, time-bound nature. In order to follow up on the Party ' s central decision-making and to implement the Legislative Plan of the Standing Committee of the XIV National People ' s Congress and adapt to the new situation of cybersecurity, my Office, together with the relevant authorities, has drafted the Law of the People ' s Republic of China on Cybersecurity (the revised draft re-advisory draft) (hereinafter referred to as the " Cybersecurity Act " ). Information is provided below. I. Modification of the background Since its introduction in 2017, the Cybersecurity Act has provided strong legal safeguards for the protection of cyberspace sovereignty and national security, the public interest and the legitimate rights and interests of citizens, legal persons and other organizations. Cyber-security risks are further highlighted as networks and information technologies become increasingly integrated into productive life. Since 2021, legislation relating to cybersecurity, such as the Law of the People ' s Republic of China on Data Security (hereinafter referred to as the Law on Data Security), the Law of the People ' s Republic of China on the Protection of Personal Information (hereinafter referred to as the Law on the Protection of Personal Information), has been enacted and implemented. The Law of the People ' s Republic of China on Administrative Penalties (hereinafter referred to as the Law on Administrative Penalties) has been amended. The Law on Cybersecurity needs to be adapted to the situation and harmonized with the newly enacted laws, with a view to optimizing the scientific aspects of the legal liability regime and further ensuring cybersecurity. In September 2023, the Legislative Plan of the Standing Committee of the Fourteenth National People's Congress was published, expressly including the “Law on Cybersecurity (Amendment)” in the first category of “Projects: more well-established draft laws to be submitted for consideration during the term of office”. In March 2025, the report on the work of the Standing Committee of the National People ' s Congress included amendments to the Cybersecurity Act in the legislative mandate for 2025. Since the beginning of the revision process, I have been working closely with the relevant authorities to promote the revision of the Cybersecurity Act, which has led to research, the drafting of draft amendments, the consultation of relevant units of the central and State authorities and the public consultation process. On the basis of careful consultation with interested parties, the Cybersecurity Act (a revised draft re-advisory draft) was developed. II. Modification of thought During the drafting of the Cybersecurity Act (the revised draft for further comments), the following points were highlighted:- Yes.Guided by Xi's new Chinese-style socialist ideology, Xi Jinping's rule of law philosophy and Xi's Secretary-General's important thinking on the power of the Internet.Two.In keeping with the orientation of the issue, emphasis is placed on strengthening the legal responsibility for cybersecurity and increasing penalties for violations.Three.The institutionalization of the system and the strengthening of the institutionalization of relevant laws, such as the Law on the Protection of Personal Information and the Law on Administrative Penalties, of the Law on Data Security, provide for reasonable arrangements regarding the type, scope and extent of administrative penalties.Four.Maintaining the legal responsibility for various types of violations, such as classification, the scientific establishment of network operations security and the security of network information. III. Main elements of the changes (i) Legal liability for the safety of network operations.In combination with the consequences of harming network security in practice, increase the number of particularly serious harms to network security, such as massive data leakage, loss of local functionality of critical information infrastructure and loss of primary functions of critical information infrastructure, and adjust the current fine of article 59 of the Cyber Security Act to take into account the Data Security Act, increasing the corresponding penalties; increase the legal liability for new sales or the provision of uncertified safety tests or security clearances, network critical equipment and network safety-specific products that do not meet requirements; and clarify the penalties applied by operators of critical information infrastructure for the disposal of non-adopted network products or services. (ii) Legal responsibility for cybersecurity.In order to prevent the risk posed to national and political security by the security risks posed by the security of the content of Internet information in the new situation, taking into account recent practice in enforcing the content of online information, taking into account the new changes in the legal liability regime of the relevant legislation abroad, to improve the situation of violations referred to in articles 68 and 69 of the current Cyber Security Act, to adjust the legal liability for failure to report to the competent authorities, and not to comply with the requirements of the authorities concerned, situations in which the transmission of information, which is prohibited by law or administrative regulations, is suspended or is eliminated, and to clarify the penalties for violations of the law, which have particularly serious consequences. (iii) Legal responsibility for personal information and security of vital data.In view of the new special provisions on penalties for offences relating to personal information and vital data under article 64, paragraph 1, and article 66 of the existing Cybersecurity Act, which are expressly transposed to applicable provisions, relevant laws and administrative regulations, such as the Personal Information Protection Act of the Data Security Act. (iv) In cases of mitigating, mitigating or denying administrative punishment.Taking into account the application of the Cybersecurity Act and the Code of Administrative Penalties, a new connecting provision has been added to make it clear that Internet operators who actively eliminate or mitigate the harmful consequences of an offence, act in a minor and timely manner and do not cause the harmful consequences, or act in the first instance, and act in a light, light or non-punishable manner, in accordance with the law; and that the competent authorities establish, in accordance with their responsibilities, the appropriate criteria for determining administrative penalties.

Reproduced from “Webcom China” (Webcom Public)