Yan Luo advises clients on a broad range of regulatory matters in connection with data privacy and cybersecurity, antitrust and competition, as well as international trade laws in the United States, European Union and China. Ms Luo has significant experience assisting multinational companies navigating the rapidly evolving Chinese cybersecurity and data privacy rules. Her work includes high-stakes compliance advice on strategic issues such as data localisation and cross-border data transfer, as well as data protection advice in the context of strategic transactions. She also advises leading Chinese technology companies on global data governance issues and on compliance matters in major jurisdictions, such as the European Union and the United States. Ms Luo earned her LLM from Harvard Law School in 2011, her PhD from Queen Mary, University of London in 2009, her LLM, magna cum laude, from University of Groningen in 2003 and received her LLB from Fudan University in 2002.
Zhijing Yu is an associate in the firm’s Beijing office. His practice focuses on advising major multinationals and Chinese companies on a broad array of complex matters in connection with data privacy, cybersecurity, international trade and corporate transactions. Mr Yu has represented leading companies in multiple industries, including consumer products, banking, financial services, entertainment, healthcare, internet services and pharmaceuticals. Mr Yu received his LLM from Georgetown University Law Center in 2014. He received his LLB from Peking University in 2013.
1Â What is the current state of the law and regulation governing AI in your jurisdiction? How would you compare the level of regulation with that in other jurisdictions?
There are no laws or regulations specific to AI in China. However, the Chinese government has encouraged usage of AI in various industries in recent years to increase efficiency and enhance policy implementation, safety and law enforcement.
The Chinese government has set ambitious goals in the development of facial recognition technology, as evidenced by many policy documents issued by various government agencies. For example, the Ministry of Civil Affairs and the National Development and Reform Commission explicitly promoted the application of AI in civil affairs in the 13th Five-Year Plan for the Development of Civil Affairs. The National Development and Reform Commission also stipulated in the Notice on the Organization and Implementation of the New Generation of Information Infrastructure Construction Project, and the Internet Plus Major Project in 2017, that facial recognition infrastructure should be strengthened. The Ministry of Industry and Information Technology’s AI strategy, issued in 2017 (Three-Year Action Plan to Develop a New Generation of the Artificial Intelligence Industry), stated that, by 2020, the effective detection rate in complex dynamic scenarios should exceed 97 per cent and the correction rate should exceed 90 per cent.
Like other jurisdictions (eg, the European Union and the United States), China is in the early stages in developing legislation, although China has been more willing to encourage the use of AI technology and may strike a different balance when assessing how to regulate technology that may intrude on individual rights.
Using facial recognition as an example, while China has some generally applicable privacy rules, including the Personal Information Protection Law and a number of national standards that address the collection and use of biometric data, it is unclear whether these rules are enforceable in cases where government agencies or state-owned enterprises providing utilities and essential services are deploying the technology. Individuals usually have limited ability to opt out of such collection and use, and it is hard to obtain relief if there is misuse or harm. Despite the lack of use parameters and specific guidance, current Chinese rules governing use of facial recognition in the public sector generally encourage greater use and integration of the technology.
2Â Has the government released a national strategy on AI? Are there any national efforts to create data sharing arrangements?
The State Council released a national strategy on 8 July 2017, entitled the New Generation Artificial Intelligence Development Plan (the AI Development Plan). With respect to data sharing arrangements, the AI Development Plan generally encourages collaboration in the development of AI and AI infrastructure. For example, the AI Development Plan proposes open-source platforms that encourage sharing of algorithms and other tools to improve innovation in the field of AI, as well as establishing a national data sharing exchange platform to support data infrastructure. However, no specific programmes or initiatives were mentioned in the AI Development Plan, and the implementation of this plan is not clear. The Standardization Administration has released its Guidance for Building the National Standardization System for New Generation Artificial Intelligence, pursuant to its 2017 development plan to establish China as a leading AI power. The guidance calls on the Chinese government to develop more than 20 key AI standards by 2030, covering both hardware and software in 16 identified sectors.
The National Standardization Administration, Office of the Central Cyberspace Affairs Commission, National Development and Reform Commission, Ministry of Science and Technology, and Ministry of Industry and Information Technology released the Guideline for Establishing the National New Generation Artificial Intelligence Standards Mechanism on 8 August 2021. The Guideline sets out fundamental principles for drafting national standards, industry standards and organisation rules about AI. According to the Guideline, the goal is to complete initial steps and formulate standards for key issues such as data, algorithms, systems and services by 2023.
3Â What is the government policy and strategy for managing the ethical and human rights issues raised by the deployment of AI?
The AI Development Plan notes that the continued development of AI will necessitate policies that include:
- research on AI ethics;
- an ethical framework that incorporates collaboration between human beings and computers in the decision-making process; and
- the establishment of an ethical code of conduct for AI products.
In response, government-backed trade associations started issuing self-regulatory guidance. For example, the Payment and Clearing Association of China released the Self-Regulatory Conventions for Facial Recognition Within the Offline Payment Sector (trial) (the Facial Recognition Conventions) on 20 January 2020, which applies to all entities that facilitate payments via facial recognition. Importantly, the Facial Recognition Conventions incorporate consumer protection provisions, from general cybersecurity protections, such as physical and network security that satisfy security requirements under national and finance-specific regulations, to preservation of user rights, which include channels for complaint and disclosure of use for collected facial information.
Under the Facial Recognition Conventions, entities facilitating payments via facial recognition are required to notify consumers of the purpose, methods and scope of the data collection and to obtain consent. In addition, stored original facial recognition data must be encrypted.
4Â What is the government policy and strategy for managing the national security and trade implications of AI? Are there any trade restrictions that may apply to AI-based products?
We are unaware of specific policies or strategies of Chinese regulators regarding national security and trade implications of AI. However, AI has been frequently mentioned in the ongoing trade discussions between the United States and China.
5Â How are AI-related data protection and privacy issues being addressed? Have these issues affected data sharing arrangements in any way?
The Supreme People’s Court released the Provisions of the People’s Court on Several Issues Concerning the Application of Law in the Trial of Civil Cases Involving the Processing of Personal Information Using Facial Recognition Technology in July 2021, which serves as guidance for judges hearing civil cases involving personal information processing activities using facial recognition technology.
In order to protect the interests of individuals and entities, the Cyberspace Administration of China released a draft Administrative Provisions on Recommendation Algorithm of Internet Information Services for public comment in August 2021 to regulate network information service providers using recommendation algorithms.
The Personal Information Protection Law, which took effect on 1 November 2021, requires the Cyberspace Administration of China to coordinate relevant departments to formulate specialised rules and standards for the protection of personal information in regard to new technologies and applications, such as facial recognition and AI.
Biometric data is listed as an example of sensitive personal information in the Personal Information Protection Law. However, the law does not define what should be considered to be biometric data. Controllers can only process sensitive personal information when the processing has a specific purpose and is necessary, and they must adopt strict protection measures. Meanwhile, before processing sensitive personal information, the Personal Information Protection Law requires the controller to (1) obtain separate consent from individuals; (2) inform individuals of the necessity of processing and impacts on the individuals’ rights and interests (unless otherwise provided by the law); and (3) carry out a personal information protection impact assessment.
6Â How are government authorities enforcing and monitoring compliance with AI legislation, regulations and practice guidance? Which entities are issuing and enforcing regulations, strategies and frameworks with respect to AI?
Since the Personal Information Protection Law just took effect, there are no instances of enforcement. However, the first dispute about facial recognition technology in China was resolved in 2021. In that case, the defendant, a zoo, admitted annual pass members to using facial recognition, without notifying members of the change. The plaintiff claimed that this was a breach of contract and a fraud. The Intermediate Court opined that biometric information is sensitive personal information and the controller should be more cautious in retaining such data.
In April 2021, the Ningbo City Administration for Market Regulation imposed administrative fined three real estate companies. The companies installed facial recognition devices at sales centres, which captured facial images of their clients and uploaded images to their systems.
7Â Has your jurisdiction participated in any international frameworks for AI?
China, via its China Electronics Standardization Institute, has been an active member of the ISO/IEC JTC 1/SC 42 subcommittee that develops international standards for the AI industry. In addition, Chinese regulators have established the Artificial Intelligence Industry Alliance, which seeks to develop industry standards for certification of AI products and services. China is not a signatory to the OECD or its published Principles on Artificial Intelligence.
8Â What have been the most noteworthy AI-related developments over the past year in your jurisdiction?
In 2021, China released its first comprehensive privacy law, the Personal Information Protection Law. While the law does not contain specific AI requirements, it requires regulators to develop detailed personal information protection rules for AI. Also, the 14th Five-Year Plan (2021–2025) for National Economic and Social Development of the People’s Republic of China encourages AI research and investment, emphasizing the innovation and utilisation of AI technologies in the digital economy, national security, national defence and cybersecurity.
 9 Which industry sectors have seen the most development in AI-based products and services in your jurisdiction?
In China, AI-based products involving processing of facial recognition and biometric data have developed most rapidly. The Chinese government, in recognition of the efficiency gains from facial recognition in both the public and private sectors, has attached great importance to research and development, deployment and commercialisation, of these technologies. As a result, facial recognition touches upon almost every aspect of an individual’s life in China – for example, facial recognition was widely used in containing covid-19 by verifying identity without person-to-person contact.
10Â Are there any pending or proposed legislative or regulatory initiatives in relation to AI?
While there are no pending or proposed AI legislative or regulatory initiatives at the national level, the AI Development Plan explicitly states that, as the field of AI evolves, China aims to develop laws, regulations and ethical norms that promote the development of AI, while maintaining accountability, such as with privacy protections and an ethical code of conduct for AI products. The Personal Information Protection Law also requires regulators to adopt AI and facial recognition related personal information protection rules. The Guideline for Establishing the National New Generation Artificial Intelligence Standards Mechanism aims to adopt national standards for key AI issues by the year of 2023. At the local level, Shenzhen released a draft regional AI Industry Promotion Regulation in July 2021 for public comment.
 11 What best practices would you recommend to assess and manage risks arising in the deployment of AI?
It is important to monitor national strategies and pending legislation in China, particularly as AI is being deployed at a rapid rate. While no legislation specific to AI has been promulgated as yet, companies should adhere to more broadly applicable laws and regulations, such as China’s Personal Information Protection Law, and establish technical and operational controls with respect to personal information.
The Inside Track
What skills and experiences have helped you to navigate AI issues as a lawyer?
At Covington, we take a holistic approach to AI that integrates our deep under- standing of technology and our global multi-disciplinary expertise. We have been working with clients on emerging technologies for decades and we have helped clients navigate evolving legal landscapes, including at the dawn of cellular technology and the internet. We draw on this experience and our deep understanding of technology, and leverage our international and multi-disciplinary approach. We also translate this expertise into practical guidance that clients can apply in their transactions, public policy matters and business operations.
Which areas of AI development are you most excited about and which do you think will offer the greatest opportunities?
The development of AI technology is affecting virtually every industry and has tremendous potential to promote the public good, including to help achieve the UN Sustainable Development Goals by 2030. For example, in the healthcare sector, AI may play an important role in mitigating the effects of covid-19, and it has the potential to improve outcomes while reducing costs, including by aiding in diagnosis and policing drug theft and abuse. AI also has the potential to enable more efficient use of energy and other resources, and to improve education, transportation, and the health and safety of workers. We are excited about the opportunities presented by AI.
What do you see as the greatest challenges facing both developers and society as a whole in relation to the deployment of AI?
AI has tremendous promise to advance economic and public good in many ways and it will be important to have policy frameworks that enable society to capitalise on these benefits while safeguarding against potential harms. Also, as this publication explains, several jurisdictions are advancing different approaches to AI. One of the great challenges is to develop harmonised policy approaches that achieve desired objectives. We have worked with stakeholders in the past to address these challenges with other technologies, such as the internet, and we are optimistic that workable approaches can be crafted for AI.
