最近，在中国建立本地数据中心似乎成了新趋势。5月最后一周，苹果宣布其在中国的第一个数据中心已正式投入运营——该中心的筹划要追溯到2017年，在当年新《网络安全法》对于“在中国收集的个人信息和重要数据必须保存在中国”的要求下，苹果和“云上贵州”公司展开合作，在贵州省筹建了第一家在华数据中心。
无独有偶，在同一周，特斯拉也宣布在中国建立数据中心，以实现数据存储本地化；紧接着，根据路透社报道，包括福特、宝马、戴姆勒在内的跨国车企都透露将采取类似举动，以符合《网络安全法》和最新出炉的《汽车数据安全管理若干规定(征求意见稿)》的要求。
在欧华律师事务所香港办公室合伙人Carolyn Bigg看来，跨国企业近期的举动和既往实践形成了鲜明对比。“早在5至10年前，便有不少跨国企业尝试在中国进行数据本地存储、设立数据中心，然而成功的机率微乎其微。”Bigg告诉ALB。
究其原因，“根据我们的经验，中国在互联网数据中心许可制度下对于跨国企业建立本土数据中心有着非常严格的要求”，Bigg指出。此外，对于相关企业的外资比例、组织架构和运营时间的要求；高额的基础设施投入，甚至与当局的友好联络程度，都给寻求建立数据中心的外企设立了不低门槛。
因此，Bigg观察到，过去两年中，“许多跨国企业开始将中国大陆产生的数据存储在香港、新加坡或东京的数据中心”，相较于设立自己的数据中心，大多数企业更偏向与中国本地的数据服务商，例如阿里云和腾讯云，寻求合作。在她看来， 实际上在监管压力之外，跨国企业本身“对于中国服务器、中国数据中心的态度已经非常开放”。
数据中心优势多
虽然外界对于跨国企业在华建立数据中心、企业后续对数据处理的独立性存在不少隐忧——《纽约时报》甚至在近期的一篇文章中直指苹果公司为了利润向监管者“妥协”，但在Bigg看来，从运营角度看，本地数据中心对跨国公司实际上存在诸多益处。
首先是本地数据中心能够让跨国企业实现在中国的监管框架内运营——这一框架包括了《网络安全法》《数据安全法》以及纷繁复杂的行政法规。“这会便利企业的合规管理，甚至成为企业的运营优势。”Bigg指出。
其次，在中国产生的大量数据对跨国企业拥有极大吸引力。“很有拥有大量数据的跨国企业都想在中国建立数据湖，以真正了解他们的中国客户。”Bigg补充说，“有些企业还在中国拥有研发中心，这些数据能够支持他们的产品研发。”
此外，在中国，甚至亚洲建立独立的数据中心对企业也有切实好处。基于全球对于数据合规的不同要求，“跨国企业很难建立统一的全球性数据合规政策”，Bigg说。
拿同时运营于亚洲和欧洲的企业来说，Bigg认为，亚洲地区的隐私文化更务实，这里的数据监管核心是保持透明度、事先取得用户同意，而 “在欧洲，企业建立数据中心的前提是数据的匿名，对个人数据的利用也十分有限”。在亚洲和中国，“消费者对于数据分析和AI的态度要开放得多，合规拥有数据中心意味着企业可以合理使用个人数据进行分析，从而为用户提供更有针对性的服务”。
因此，“如跨国企业愿意采用区域性的方式隔离数据，那么在中国、新加坡或其他亚洲国家建立数据中心也不失为未来的发展方向”，Bigg说。
未来趋势
那么未来在华数据中心是否会成为跨国企业的“标配”？对此Bigg持审慎态度。
她指出，至少考虑到数据中心所需的高额投入（苹果在贵州的数据中心投资高达10亿美元）和中国对于IDC许可的严格监管，“我不认为大多数跨国企业有能力做出这样的选择。”她说，“但那些已经建立了本地数据中心，且通过了所有合规及投资挑战的企业将面临巨大的机会。”
此外，她也看到“很多企业正寻求与中国数据中心、技术平台合作建立自己的SaaS 云平台来储存当地数据”。
从建立SaaS平台、设立在中国运营的应用程序，到设立能够在中国管理数据的新实体，欧华已经开始从各种角度帮助跨国企业客户实现他们和数据相关的中国运营目标。
在中国处理数据“涉及的可并不只是一两部法律，其中既有高位阶法律，还有一系列与技术标准等相关的措施、法规”，Bigg提醒道，“律师可以在此过程中协助企业评估运营、合约及监管合规风险，真正实现他们的商业目标”。
Required by law to open data centres in China, MNCs are beginning to realise the advantages
The past few months have seen a flurry of multinational corporations setting up data centres in China. The most high-profile among these is Apple, which at the end of May announced that its first data centre in China was officially under operation. The centre, dating back to 2017 and operated jointly with a local company in Guizou, was launched under the requirements of China’s Cybersecurity Law, which encourages and in some situations stipulates the collection, use and storage of personal information and important data in China.
In the same week, Tesla also announced the building of a data centre in Shanghai to localise its data storage. According to Reuters, other carmakers like Ford, BMW and Daimler have all revealed that they will take similar steps to comply with the Cybersecurity Law and the newly released draft regulations on Vehicle Data Safety Management.
For Carolyn Bigg, a partner at DLA Piper’s Hong Kong office, these recent moves are in stark contrast to past practice. “It remains really hard for international businesses to set up data centres in China. Lots of companies may have tried to do this five to ten years ago by effectively sub-licensing local data centre’s regulatory licenses to do so, but there's been a real crackdown on that,” says Bigg.
Speaking of the reasoning behind this, one reason is “the very strict licensing requirements in China under the IDC license regime,” Bigg notes. In addition, restrictions on foreign ownership and organisational structures, the high cost of infrastructure, and even liaising with government authorities, all made the establishment of data centres challenging.
According to Bigg’s observation, “many international businesses have been trying to keep the data from mainland China in a data centre in Hong Kong, Singapore or Tokyo”. However, in addition to the regulatory pressure, “nowadays, most international businesses are very open to having Chinese servers or a data centre in China.” Rather than setting up their own data centres, most seek partnerships with local data centre providers like Alibaba Cloud or Tencent Cloud.
MORE ADVANTAGES
Many have raised concerns over building data centres in China and question the independence of the data being processed. For example, a recent New York Times story said that Apple “compromised” to China’s censorship and surveillance in order to maximise its profits. However, from an operational point of view, Bigg believes there are many benefits to MNCs setting up local data centres.
Firstly, a local data centre would allow MNCs to operate within China's regulatory framework, which includes the Cybersecurity Law, the Data Security Law and a myriad of other administrative regulations. “It is great from a compliance management point of view, and it's actually an operational advantage,” Bigg adds.
Secondly, the sheer volume of data produced in China is a big draw for MNCs. “A lot of international businesses with large data sets want to set up data lakes in China to really understand their customers there,” says Bigg. “Some of them also have R&D centres in China, so the data analytics would support product development.”
Additionally, there are real benefits for MNCs to set up separate data centres in China or in Asia. Given the different requirements for data compliance in each region or country, “it can be hard for international businesses to have one global approach to data compliance,” Bigg says.
Take companies that operate in Asia and Europe for example. Bigg points out that the culture towards data privacy in Asia is more pragmatic. It focuses on being transparent and requesting consent in the first place, as well as focusing on the goal of eliminating the worst abuses. In Europe, “data effectively has to be anonymous before you can run complex data analytics, and from a compliance perspective, what you are able to do with that data is very different.”
In contrast, “consumers in China and across Asia are more open to the use of data analytics and AI to provide a customised experience, so companies can use identifiable individual data to offer more tailored services,” Bigg says. “So, if MNCs are willing to adopt a regional approach by segregating data, the opportunities in places like China or Singapore are much greater.”
FUTURE TRENDS
Will having data centres in China become the norm for MNCs in the future?
Bigg is cautious on this point. Given the high cost of data centre infrastructure (Apple invested $1 billion in its Guizhou data centre) and the strict regulatory hurdles to obtain an IDC license, “I don't think this is going to be an option for most international businesses. But I think there are huge opportunities for those that do take that step,” Bigg notes.
Meanwhile, she notes that many MNCs “are looking to partner with existing China data centres and tech platforms to launch SaaS platforms to host local data.”
“In China, handling data doesn’t only involve one or two laws,” Bigg points out. “There are high-level laws, and many detailed regulations concerning what you need to do in practice in terms of technical standards etc.”
“As lawyers, what we do is help international businesses to assess the operational, contractual risks, as well as the regulatory compliance risks in order to realize the opportunities of building or operating data centres,” Bigg adds.
To contact the editorial team, please email ALBEditor@thomsonreuters.com.
