Governance of Cross-border Data Flow in China under the DEPA Framework: Challenges and Strategies

In the modern world, data is the lifeblood of the digital economy. Every time a person sends a message, makes an online purchase, or uses a cloud service, information travels across borders, moving from one country to another in a fraction of a second. This flow of information is no longer just a technical detail; it is a central issue in international trade and national security. However, there is no single set of rules that governs how this data moves around the globe. Different nations have different priorities. Some countries prioritize the free movement of data to help their tech companies grow, while others prioritize strict privacy protections or national security, sometimes requiring that data stay within their own borders. This lack of a unified system creates a fragmented landscape where businesses and governments struggle to navigate conflicting regulations. To address this, a new international agreement called the Digital Economy Partnership Agreement, or DEPA, was created. It is the first treaty dedicated entirely to the digital economy, offering a flexible and forward-looking framework to help nations agree on how to manage digital trade and data flows.

Researchers Yuanhong Shi and Jielun Lu from the China University of Political Science and Law have examined how China is preparing to join this agreement and what challenges it faces. China formally applied to become a member of DEPA in November 2021, signaling a desire to integrate more deeply into the global digital economy. The researchers analyzed the gap between China's current laws and the high standards set by DEPA. They found that while China has a robust system for managing data that focuses heavily on national security, it still needs to make significant adjustments to align with the agreement's requirements for open and transparent data movement. The study suggests that joining DEPA offers China a unique opportunity to refine its own rules, clarify who owns data, and build a more efficient system that balances security with economic growth.

The researchers began by looking at how different parts of the world currently handle cross-border data. They identified three main approaches. The first, often associated with the United States, prioritizes the free flow of data to support commercial interests and the growth of digital industries, though it still maintains some restrictions for specific security concerns. The second approach, linked to the European Union, places a heavy emphasis on protecting individual privacy and personal information, creating a strict legal framework to ensure data is handled safely. The third approach, which China has developed, seeks a middle ground. It aims to facilitate the movement of data to help the digital economy grow while keeping national security as the top priority. This system is a mix of laws and regulations that work together to control how data is used and shared.

DEPA introduces a new way of thinking about these rules. Unlike older trade agreements that might have touched on digital issues as a side note, DEPA is built specifically for the digital age. It uses a modular design, meaning countries can join different parts of the agreement as they are ready. The agreement encourages the free movement of data but allows for restrictions if they are necessary for legitimate public goals, provided those restrictions are fair and not used to hide trade barriers. It also sets standards for new technologies like artificial intelligence, insisting that they be transparent and fair. When compared to other major trade deals, DEPA is seen as having stricter and more detailed requirements for data flow than the Comprehensive and Progressive Agreement for Trans-Pacific Partnership, and it goes further than the Regional Comprehensive Economic Partnership by introducing specific tools like a "trustmark" to verify data protection standards and encouraging the use of regulatory sandboxes, which are safe environments for testing new technologies.

Despite the clear benefits of joining, the researchers identified several significant hurdles for China. The first major challenge is the concept of data sovereignty. This is the idea that a country has the right to control data that originates within its borders. While this protects national security, it can clash with the goal of letting data flow freely across borders. The study notes that if China's data restrictions are seen as too strict by other DEPA members, it could lead to disputes and higher costs for companies trying to operate in multiple countries. Another challenge is the difference in how "legitimate public policy" is defined. DEPA allows countries to restrict data flow for public policy reasons, but it does not clearly define what those reasons are. China will need to prove that its strict rules are necessary and reasonable when negotiating with other nations.

The researchers also pointed out that China's current systems for reviewing data exports are not yet fully standardized. While laws exist to protect data, the practical rules for how to review data before it leaves the country vary across different regions and industries. This lack of consistency makes it difficult for businesses to know what to expect. Furthermore, the technical ability to monitor data flows and detect risks is still developing. To meet DEPA standards, China needs to improve its ability to track data and spot problems without over-regulating and slowing down innovation. The study also highlighted emerging issues with new technologies like artificial intelligence. While DEPA promotes ethical AI, China must find a way to regulate these fast-moving technologies without stifling their development.

To overcome these challenges, the researchers proposed several strategies. First, China needs to clarify who owns data and what rights people and companies have over it. This involves creating a system that balances the need for data to be used for economic growth with the need to protect individual rights. Second, China should work to align its domestic laws with DEPA rules. This means being more transparent about why certain data restrictions exist and working with other countries to recognize each other's data protection standards. Third, the country needs to improve its data security management. This includes using pilot programs in special economic zones to test new ways of managing data flows safely before rolling them out nationally. Finally, the researchers suggest that China should actively participate in creating an open and transparent governance system. By using technologies like blockchain to track data and ensuring that rules are clear and fair, China can build trust with the international community.

The study concludes that joining DEPA is more than just a diplomatic move; it is a chance for China to reshape its own digital governance. By engaging with these high international standards, China can refine its laws, improve its security systems, and contribute to a more equitable global system for managing data. The researchers emphasize that this process requires a careful balance. China must protect its national interests while also embracing the openness that allows the digital economy to thrive. If successful, this alignment will not only help China's own digital industries grow but also allow it to play a leading role in shaping the future of global digital trade.