On November 15, the Cyberspace Administration of China ("CAC") issued the Administrative Regulations on Internet Data Security (Draft for Comment) (the "Draft for Comment") to solicit public opinions. Solicitation has ended by this date.

The Draft for Comment reiterates that China shall establish a category- and class-based data protection system. The data will be classified into common data, important data, and core data on account of its importance to national security, public interests, as well as the legitimate rights and interests of relevant individuals or organizations. Different protection measures will be imposed depending on the classifications. China will provide key protection for personal information and important data and strict protection for core data. The Draft for Comment further specifies that data processors shall conduct risk assessment regarding the necessity and security when they perform personal identification by means of biometric features, and shall not take biometric data, such as face, gait, fingerprint, iris and vocal print, as an exclusive method for personal identification to coercively collect personal biometric information.

(Source: Cyberspace Administration of China)