Fragmenting data governance – Europe needs a strategy to live with China

In the third of a series of articles about China’s role in shaping the future of the internet, Rebecca Arcesati says cutting all data flows in the name of EU security is no answer.    

The future of data flows between Europe and China is anything but certain. By prioritizing national security in its data governance regime, China is interfering with the free, efficient and safe transmission of data across borders the world has come to know. US policymakers are responding to this danger, even if calls for bans on China-based internet platforms risk fracturing the digital economy even further. European policymakers are not responding, but might have better solutions, if only they widened their focus from data privacy.

The good news is that China is not turning into a data fortress. A small but important sign came in January, when a joint cancer-treatment study by researchers in Beijing and Amsterdam became the first project to pass the strict new data export assessment by the Cyberspace Administration of China. This shows that Beijing is working to ensure that China’s economy, society, and innovation system keep benefiting from cross-border data exchange.

The bad news is that the country’s data economy is coming to resemble an island whose government tightly controls which ships get to dock and – more worryingly – get to leave. New laws, regulations and policies are meant to hold large amounts of data within China’s borders in pursuit of digital sovereignty. The leadership is fixated on the risk that foreign governments might undermine national security by exploiting Chinese data—from strategic industrial data to people’s taxi rides and information found in academic studies.

Beijing wants access to data for social and economic control

In parallel to “nationalizing” data, the Chinese Communist Party wants preferential access to it. It has pushed privately-owned tech giants from Apple to Ant Group to share consumer data with authorities. It continues to strive to integrate the reams of personal information it harvests from citizens to perfect social and political control. And it’s seeking to collect overseas data for public opinion monitoring, intelligence gathering and obtaining foreign tech. No wonder Washington is keen on limiting the transfer of sensitive data to China.

The Biden Administration has empowered the Department of Commerce to examine risks associated with the appropriation of US citizens’ data by “foreign adversaries”. Calls for banning Chinese video-streaming platform TikTok are mounting in Washington –  so much so that it is unclear whether the company’s plan to appease the American national security community will win enough hearts and minds. The US has canceled or re-routed four subsea cable projects to Hong Kong – and online information exchange could be a similar casualty.

But China’s data island won’t disappear any time soon. Instead of making the situation worse by resorting to a total disconnect, democracies can surely approach the problem more reasonably to find ways of living with it. For example, a TikTok ban would be seen as an overreaction in Brussels. After all, malign actors can buy US citizens’ data from the country’s unregulated data brokers and US social media are a tried-and-tested targets for Beijing.

The EU’s often-derided technocratic approach may have real advantages in this instance. Its slow reaction to TikTok and the company’s foot-dragging about opening a European data center has made headlines. But the risk of TikTok manipulating information is arguably much greater than its mishandling of data. Once the EU’s Digital Services Act is properly implemented, all online platforms, irrespective of where they are based, will have to show how their algorithms push content. Enforced transparency should ensure better governance.  

Europe lags behind in treating data as a national security issue

But before Europe makes use of its strengths, it has to understand its weaknesses. It still lags both China and the US when it comes to thinking through the national security and strategic implications of data. The Polish Academy of Sciences marked a notable exception, when in 2021 it decided to cancel a partnership to create a genomic map of Poland with BGI Group, which reportedly collaborates with the Chinese military on genetic research. Other examples of potential data exfiltration abound, while China’s Data Security Law and other rules compel Chinese organizations to collaborate with state security and intelligence if approached.  

The EU also needs to consider ethical issues. European researchers have in the past collaborated with Chinese police on scientific studies that used DNA harvested from the persecuted Uyghur and Tibetan minorities. These samples were likely taken without consent and some remain stored in an online repository in Germany. The question is whether policymakers should be concerned with data privacy only when it pertains to Europeans.

The EU and its member states need a comprehensive strategy to deal with China in the data space. They should review risks linked to Chinese firms’ activities in Europe and incentivize researchers to prioritize data ethics in collaborations with Chinese counterparts. They should boost cyber defenses, critical infrastructure protection, investment screening and research security against Beijing’s efforts to acquire data and information. As social media and open-source intelligence techniques make some data harvesting unavoidable, technical solutions should come into play – like new AI methods to counter disinformation and cyber-attacks.

European companies will still have to find their own ways to navigate China’s data island. They will have to decide whether they are comfortable with Beijing’s push to access corporate data and letting state-backed interfaces administer cross-border data transfers. Beyond business, Beijing’s bid for digital sovereignty is already reshaping what the world knows about China. What leaves the data island is increasingly for the state to decide.