Cross-border Transfer of Personal and Industrial Data between the European Union and China – A Comparative Analysis of Data Protection Laws and Export Regulations

Kurzfassung

Cross-border data transfers between the European Union and People's Republic of China are crucial for international research, innovation, and international trade. However, navigating the complex regulatory landscapes of those jurisdictions – especially amid their technological competition – poses significant challenges. This Article provides a high-level comparison of personal and industrial data protection, focusing on the general conditions under which transfers are legitimate under EU law. We examine constitutional and statutory data protection laws, export restrictions on industrial data, and cybersecurity requirements for both types of data. Our analysis shows that while China's personal data protection laws are increasingly aligning with European standards in commercial contexts, the risk of interference by administrative bodies remains relevant where national security interests are concerned. The protection of industrial data presents challenges, particularly in IP enforcement, reciprocity in technology transfers, and localization requirements. Nevertheless, maintaining trade relations while safeguarding individual rights and industrial data sovereignty is achievable through thorough risk assessments and the adoption of both conventional and innovative data and cybersecurity strategies.