The Sovereignty Exception: China's State-Centric Approach to National Security in Cross-Border Data Flows

This study examines China's broad application of the national security exception governing cross-border data flows. We trace the development of the exception from being the "constructive ambiguity" in the General Agreement on Tariffs and Trade (GATT) Article XXI exception, to an exception subject to limited judicial review. By examining the distinctive Chinese legal framework on data flows enforced through its Cybersecurity Law, Data Security Law and Personal Information Protection Law (PIPL), we identify a Chinese legal concept of "data sovereignty." A case study of the Didi Chuxing cybersecurity review serves to illustrate how this state-centric regulation of data flows works in practice. In light of the EU's rights-centric and US's power-centric normative approach to data flows, China's legal safeguards for cross-border data flow reveal fundamental tensions in global data governance. We argue that, while internally coherent, the Chinese approach creates serious uncertainty for multinational firms, challenges global norms of international trade law and is a leading contributor to the phenomenon of "digital decoupling".