[nasr] Re: 回复: Re: Secure Routing Path Consideration- China Mobile-ietf120

[刘鹏辉 <[e-mail]>]

GDPR (General Data Protection Regulation) establishes basic principles for the cross-border flow and transmission of personal data, and stipulates the process of cross-border data transfer.

GDPR is an important regulation enacted by the European Union to protect personal data, and the provisions on cross-border data transfer are particularly critical. According to the provisions of GDPR, the cross-border transfer of personal data needs to meet certain conditions and procedures to ensure the protection and security of personal data. The following are some core points of GDPR on cross-border data transfer:

Adequate protection level : GDPR requires that personal data can only be transferred to these regions if the recipient country or region is recognized by the European Commission as providing an equal or higher level of personal data protection than the EU. Currently, some countries and regions, such as Andorra, Argentina, Canada, etc., have obtained the EU's adequacy recognition.

Cross-border data transfer paths : GDPR provides three main cross-border data transfer paths:

The recipient's country or region has obtained adequacy determination (‌Adequacy Decision‌), which is the whitelist mechanism.‌
We ensure appropriate safeguards during data transfer by signing the standard contractual clauses issued by the European Union.
In some cases, data can be anonymized to enable cross-border transfers.

Penalties for non-compliance : GDPR sets high penalties for non-compliant cross-border data transfers to ensure that companies comply with regulations. In recent years, with the increase in law enforcement cases, the amount of penalties has also continued to rise, which provides companies with an incentive to comply.

Standard Contract for the Export of Personal Information : The “Measures for the Standard Contract for the Export of Personal Information” and the “Standard Contract for the Export of Personal Information” issued by the Cyberspace Administration of China (CAC) provide specific guidance for Chinese companies to ensure compliance when transferring personal information across borders.

In summary, GDPR aims to ensure the protection and security of personal data by setting strict rules and conditions for cross-border data transfer, while promoting the legal cross-border flow of data. Companies and organizations need to have a deep understanding of and comply with these regulations to ensure the legality and security of their cross-border data activities.

Cross-border data flow requires companies to take corresponding measures according to the laws of different countries and regions. This usually includes:

Conduct a security assessment
Obtain user consent
Use of standard contractual clauses or internal company rules
Ensure that the recipient has adequate data protection measures in place


作者：Pangolin
链接：https://www.zhihu.com/question/659000073/answer/3534355750
来源：知乎
著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。















At 2024-08-01 17:25:13, "Liuchunchi(Peter)" <[e-mail]> wrote:

"Data no going abroad"

 

Especially when not authorized by data owners :)

 

From: Meiling Chen <[e-mail]>
Sent: Thursday, August 1, 2024 10:55 AM
To:刘鹏辉 <[e-mail]>
Cc: Luigi IANNONE <luigi.iannone=[e-mail]>; [e-mail]
Subject: [nasr] 回复: Re: Secure Routing Path Consideration- China Mobile-ietf120

 

Hi penghui,

 

"Data no going abroad" such regulations are quite common, like GDPR, CCPA and CPRA, TTDSG and so on.

 

Best,

Meiling

 

发件人： 刘鹏辉

发送时间： 2024-07-24 11:54

收件人： Meiling Chen

抄送： Luigi IANNONE; [e-mail]

主题： [nasr] Re: Secure Routing Path Consideration- China Mobile-ietf120

Hi Meiling,

 

Your case is very reasonable, clarifies what data rquired to be forwarded through the network characterized by the specific path selection requirement of NASR.

If we could provide one or more citations to prove the existence of this requirement "Data not going abroad", then this use case would be more convincing. 

 

There was once a news that the US government hoped to build a clean network plan where data would only pass through designated networks" clean path", see https://2017-2021.state.gov/the-clean-network/ .  Is this unamiable example used to prove this use case? NASR could sove this problem?  just my two cents, hope this helps....

 

 

 

 

 

 

At 2024-07-23 15:53:16, "Meiling Chen" <[e-mail]> wrote:

Hi Luigi,

 

Secure Routing Path Consideration, Please find my slides attached.

 

 

Best,

Meiling