A new pathway to data protection

When an enterprise’s commercial data is accessed by another entity, disputes may arise. A draft article under the anti-unfair competition law would set legal boundaries on data protection and sharing

Data has become one of the top five factors in market allocation alongside land, labour, capital and technology. The Opinions of the CPC Central Committee and State Council on Constructing a Basic Systems for Data and Putting Data Factors of Production to Better Use, released in December 2022, further highlights the vital role of data in economic development, and envisages, among other things, a data property rights system, circulation, trading system and revenue distribution system.

The realisation of the data resources’ value requires legal delimitation of behaviour. The introduction of the Dedicated Article on Data (article 18) in China’s Anti-Unfair Competition Law (Draft Revision for Public Opinion) provides a clearer path to regulate data-related civil disputes.

Article 18 is a timely summary of the existing judicial practice, and establishes the legal boundaries for data collection and use in the context of big data. This article proposes practical recommendations on data protection and the use of commercial data based on the draft article.

ANALYSIS OF THE ARTICLE 18

The Dedicated Article on Data establishes a commercial data protection system at the legislative level for the first time

In the absence of a provision on the content and legal nature of data in the Civil Code, article 18 clarifies, for the first time, that operators have rights and interests in their commercial data that deserve protection under the Anti-Unfair Competition Law.

However, it should be noted that the data specified in the draft article is limited to commercial data, and includes no public data. Specifically, commercial data is that of commercial value collected by operators legally and managed with appropriate technical measures.

The definition of commercial data in the said article echoes judicial and actual practices in identifying data as competitive assets. At the same time, the behavioural law model, based on interests rather than rights, offers the possibility of balancing the protection of private property with the sharing of data in circulation.

The Dedicated Article on Data classifies common data infringements into two dimensions: behavioural and consequential, with both factors being complementary

• Section 1 of article 18 addresses improper access to data such as data access via tampering with technical management measures by means of theft, coercion, fraud, electronic intrusion, etc. As such means are notably culpable, they constitute unfair competition if they “unreasonably increase the operating costs of other operators and affect the normal operation of other operators”.
• Section 2 deals with unauthorised data capture and use. If data activities substantially substitute for the relevant products or services provided by other operators, they constitute unfair competition. The “substantial substitution” provision indicates that article 18 tolerates operators’ data capturing for non-competitive business in certain circumstances, leaving room for the court’s discretion on an individual basis.
• Section 3 focuses on improper use of data. Under this provision, disclosing, transferring or using data resulting in substantial substitution may constitute unfair competition, even if no improper data obtaining has occurred. Again, the “substantial substitution” outcome standard reflects a balance between private property protection, and data circulation and sharing.
• Section 4 is a miscellaneous provision, addressing data acquisition and use behaviour that “breaches good faith and business ethics” and leads to “harming the legitimate rights and interests of other operators and consumers, and disrupting the fair competition of the market”, making room for the development of regulations on unfair data competition in the future.

The Dedicated Article on Data exception provision restricts excessive data protection, reflecting a policy orientation to facilitate data circulation

With reference to trade secret legislation, section 3 of the Dedicated Article on Data sets up an exception provision for data circulation facilitation, that is, the acquisition, use or disclosure of the same data as the information available to the public without charge is not considered an improper acquisition or use of commercial data of other operators.

SUGGESTIONS FOR ACTUAL PRACTICE

Based on the provisions of the Dedicated Article on Data and current judicial practice, the following suggestions are made to data controllers/source parties and data users:

• For data controllers such as platform operators, to ensure their rights and interests in data under the Anti-Unfair Competition Law, they should legally collect the data and take appropriate technical management measures for it. For the former, in judicial practice, defendants often challenge the plaintiffs’ right to control data, thus claiming that plaintiffs do not have legal rights and interests over the data. Therefore, platforms should obtain users’ consent through service agreements and other means to ensure the justification of data control rights. For the latter, prior protection measures are a prerequisite for distinguishing commercial data as protected data from public data. Common means include limiting access to the platform data to registered users, restricting users’ data crawling through the Robots Exclusion Protocol (REP) or IP addresses, and other technical measures.
• Data users should pay attention to the legal compliance of their data acquisition methods. In principle, data users should not violate the REP of the platforms or websites where the crawled data is available, or obtain data by bypassing IP restrictions, cracking encryption algorithms, or other means that avoid or destroy the technical measures of the websites to scrape data. When using others’ commercial data, users should do so in a transformative manner to avoid direct substitution for the data controllers’ business.

Jiang Hainan, a former associate at the firm, also contributed to the article