China’s State Council has laid out an ambitious road map outlining its AI vision, which includes creating a US$150 billion industry and becoming the world leader in AI by 2030.¹ Enormous state financial backing aside, a controlled tech industry,² huge data availability and relatively scant privacy protections mean that China is well placed to become a global AI leader; or, to be more accurate, a leader in the development of big-data-driven technologies. 

China’s online ecosystem is unique compared to Western equivalents. Unlike their Silicon Valley competitors, Chinese technology and internet companies typically design their products to include not just one, but various types of services. Tencent’s WeChat, for example, China’s most popular mobile chat application, is more than an instant messaging app: it’s an all-in-one superapp. A billion active WeChat users now use it to chat with their friends and families, communicate with supervisors and
work colleagues, play games, hail taxis, make online purchases and conduct financial investments.³ WeChat is now even used to handle sensitive government paperwork, such as visa applications, and could soon be used for entry into Hong Kong.⁴

Tencent vowed—openly and ambitiously—to become the fundamental platform for the Chinese internet: a platform ‘as vital as the water and electricity resources in daily life’.⁵ Alibaba’s Alipay, China’s Paypal-like e-payment service, has incorporated social functions through which it encourages users to share location data, personal information and purchasing habits with others. Combined with China’s real-name registration system,⁶ these consolidated functions enable the government and industry
to effortlessly profile individual users. In addition, even when an individual’s information has been anonymised, their identity can still be re-identified by any interested parties if they have access to two or more sets of data to find the same user in both. In other countries, such identification would attract public concern, but research indicates that there’s a lack of awareness and a willingness to trade off privacy for lower cost services among Chinese consumers.⁷ For example, research that compared global consumers’ views on sharing personal information online found that consumers in China had a more lackadaisical attitude towards privacy protection than consumers in most Western countries.⁸

Big data analytics offers invaluable insights to inform the use and delivery of public goods, including increased public safety, law enforcement, resource allocation, urban planning⁹ and healthcare systems.¹⁰ But how data is collected and used affects a country’s digital ecosystem and its citizens’ social and political participation. How China’s regulatory environment handles these interactions is analysed in the following section.

China is placing huge bets on big data, and a range of policies have been introduced over the past two years to flesh out the government’s vision. On October 18 2017, Chinese President Xi Jinping promoted the integration of the internet, big data and AI with the real-world economy in his 19th Party Congress report.¹¹ But China’s interest in big data can be dated to as early as the early 2010s. In July 2012, the State Council specifically mentioned the importance of ‘strengthening the development of basic software—especially those that are able to handle large volumes of data’—in a policy document in its 12th Five-Year Plan . The current administration has beefed up the conceptualisation of China’s big data vision.

Chinese Premier Li Keqiang, for example, proposed the concept of ‘Internet Plus’ (互联网+),¹² calling for the integration of mobile internet, cloud computing, big data and the ‘internet of things’ with modern manufacturing in his March 2015 Government Work Report.¹³

In the months following Li’s report, China’s central government released a number of top-down designs and guidelines on big data policies (Table 1). By the end of 2016, various government bureaucracies ¹⁴ and more than 20 provincial and municipal governments issued their own regulations and development plans for big data industries.¹⁵ Unsurprisingly, most of these government initiatives and policies have a special interest in developing and supporting big data technologies that can be applied to the security sector. Security experts argue that contribution to the emerging social credit system is likely as part of these related initiatives.¹⁶ Statistics from 2016 show that most of the government’s domestic government investment in big data industries has gone to public security projects.¹⁷

^{Table 1: Major big data policies issued by the Chinese Government}

a) 徐永华,陈怀宇, 陈亦恺, Anthony Marshall, 何志强,夏宇飞, 温占鹏,张龙,孙春华, ‘中国制造业走向2025 构建以数据洞察为驱动的新价值网络’,IBM商业价值研究院, 中国电子信息产业发展研究院, 13 October 2015 online.

b) 林巧婷, ‘我国首次提出推行国家大数据战略’ 中央政府门户网站, 3 November 2015 online.

In the outline of the 13th Five-Year Plan, big data applications were listed as one of the eight major ‘informatisation’ projects. Informatisation (信息化)—the process by which the political, social and economic interactions in a society have become networked and digitised—cannot be overstated when analysing China’s big data vision, especially in the public security sector. Over the past two decades, the Ministry of Public Security has taken an adaptive approach to this trend. It has made continuous efforts¹⁸ to harness the advances of information and communications technologies for security operations—a process called ‘public security informatisation’ (公安信息化). At its core, public security informatisation relates to shifting police work from reactive to pre-emptive through the use of data collection and synthesis. “Security” is a broad concept when applied by the Chinese state and is sufficiently broad to enable the control and censoring of public debate in ways that may affect the power or standing of the ruling Chinese Communist Party.

A few statistics help put these concepts and policies in context. Across China, there’s a network of approximately 176 million surveillance cameras—expected to grow to 626 million by 2020¹⁹—that monitor China’s 1.4 billion citizens. Powered by big-data-driven facial recognition technology, these cameras are able to identify a person’s name, identification card number, gender, clothing and more. Meanwhile, Chinese police have reportedly been collecting DNA samples, fingerprints, iris scans, and blood types of all residents, using questionable methods, in places such as Xinjiang.²⁰

Backed by an oceanic amount of data and advanced analytic technologies, Chinese public security forces are emerging as a powerful and dominant intelligence and security sector.²¹ The interest from the public security forces in using big data to support government systems for faster and more extensive surveillance and social control largely explains the rapid rise of China’s big data industries.²²

Private companies are not only sharing users’ personal data with the authorities in compliance with China’s Cybersecurity Law,²³ the National Intelligence Law²⁴ and other relevant internet management regulations, but many of them—including the industry leaders²⁵—are building their business model predominantly around the needs of the state.

On the other end of the spectrum of the all-encompassing, data-driven analytic technologies are citizens’ de facto diminishing rights to privacy and growing challenges of protecting individuals’ data security. In contrast to the wide scope of central- and local-level policy initiatives and government-backed projects on big data collection and use, there’s no uniform law or a national authority to ensure or coordinate data protection in China. Privacy advocates have been striving to have a national privacy protection law passed since 2003.²⁶ Fifteen years later, the National People’s Congress, China’s highest legislative body, still has not included such uniform law in its agenda.²⁷

A number of articles in China’s recent Cybersecurity Law pertain to data collection and privacy protection. However, they take a state-centric approach, expanding the government’s direct involvement in companies’ operations. Missing in this approach is any support for an independent privacy watchdog or support for independent civil society organisations. For now, regulations on data protection remain largely domain-specific, such as those relating to telecommunications and online banking, which are issued by different ministries or local governments (Table 2 summarises the main relevant regulations in China).

Table 2: Chinese laws, regulations and guidelines on data collection

The lack of a legal framework on privacy protection has led to open disputes over who has access to user data. One of the most high-profile cases is the dispute between Tencent, China’s first internet giant to enter the elite US$500 billion tech club,²⁸ and Huawei, the Chinese telecom equipment and smartphone maker. Huawei was seeking to collect user data from Tencent’s WeChat, China’s most popular chat app, installed on its Honor Magic phone. The data would help Huawei advance its AI projects. Tencent was quick to object, claiming it would violate user privacy and demanded that the Chinese Government intervene.²⁹ Huawei argued that users have the right to choose whether and with whom their data is shared. The government suggested the two companies ‘follow relevant laws and regulations’,³⁰ but existing regulations fail to specify who can collect and process user data.³¹ It’s still unclear how the two settled the dispute—or even whether they’ve settled it.³²

Huawei and Tencent aren’t the first Chinese tech giants to rub shoulders other over access to data. In June 2017, Alibaba’s logistics arm, Cainiao, and China’s biggest private courier, SF Express, were in a month-long stand-off over access to consumer data. The fight was eventually resolved with the State Post Bureau’s intervention.³³ Cainiao and SF Express both cited noble-sounding reasons, such as ‘data security’ and ‘user privacy’, for refusing to share data with each other, but the dispute was really about protecting their commercial interests and determining who had access to merchant and shopper data on China’s US$910 billion online retail market.³⁴ In the case of Huawei versus Tencent, it’s about who may get to dominate the AI race with the help of massive amounts of data, including users’ chat logs. Due to a void in the current legal framework, it’s likely that disputes between companies over user data access will continue.

Most of the regulations are aimed at holding companies and individuals—rather than government bodies—accountable for data collection and protection. By contrast, government authorities now have access to more sensitive personal data than ever (through either court orders or surveillance). In addition, law enforcers are requiring companies to ensure a longer period of data retention and zero exemptions from real-name registration policies.

In June 2016, for example, China’s Cyberspace Administration issued the Provisions on the Administration of Mobile Internet Applications Information Services (移动互联网应用程序服务管理规定),³⁵ which require, among other things, that:

• app providers and app stores cooperate with government oversight and inspection
• app providers keep records of users’ activities for 60 days
• app providers ensure that new app users register with their real names by verifying users’ mobile phone numbers, other identifying information, or both.

In September 2016, Chinese authorities issued new regulations stating explicitly that user logs, messages and comments on social media platforms such as WeChat Moments—a feature that resembles Facebook’s timeline feed—can be collected and used as ‘electronic data’ to investigate legal cases.³⁶ Cases of WeChat users being arrested for ‘insulting police’³⁷ or ‘threatening to blow up a government building’³⁸ on Moments indicate that the feature may be subject to monitoring by the authorities or the company.

Observers have raised concerns over authorities’ use of big-data-driven and AI-enabled technologies such as facial recognition and voice recognition, which may lead to an all-seeing police state. iFlytek, a Chinese information technology company designated by the Ministry of Science and Technology to lead the country’s speech recognition development, has partnered with the Ministry of Public Security to develop a joint research lab. According to a report by the company, it has also partnered
with local telecommunication companies in eastern Anhui Province to establish a surveillance system that ‘notifies public security departments as soon as a suspicious voice is detected’.³⁹ In the highly restricted Xinjiang region, local authorities are reportedly collecting highly sensitive personal information, including DNA samples, fingerprints and iris scans.⁴⁰

A case that demonstrates ongoing tensions between big data applications and privacy concerns in China is the building of a national social credit system 社会信用体系 (SCS), which is the subject of a forthcoming ICPC policy brief by Samantha Hoffman. The SCS, currently planned for a full launch by 2020, aims to aggregate data on the country’s 1.4 billion citizens and assign each person a credit rating based on their socioeconomic status and online behaviour.⁴¹ So far, there’s little detail on exactly
how the system will unfold. Some companies and local governments have created their own systems (such as Tencent’s Tencent Credit,⁴² Alibaba’s Sesame Credit⁴³ and many other social credit products developed by smaller players).⁴⁴ While a final reward and punishment mechanism remains uncertain, existing reports show some consistent themes. For example, based on their social credit score and behaviours that affect one’s credit, a citizen’s access to aeroplane or express train travel will be denied and their privileges, such as faster visa approval and easier access to apartment rentals, will be restricted if the person has a bad social credit score.

The justifications for this scheme include the idea that it’s a remedy for the deficit of trust in society.⁴⁵ Southern Metropolis Daily, a Guangzhou-based liberal-leaning newspaper, surveyed 700 people on their attitudes towards China’s social credit system in 2014.⁴⁶ It found that even though 40% of the respondents expressed privacy concerns, 80% were in support of this national program because ‘it helps build a society of trust’ and ‘provides a safer and more reliable environment for business’. Yet, the complete lack of transparency and clarity on data protection raise the alarming prospect of big-data-enabled mass surveillance in China and other authoritarian states.

Both Alibaba⁴⁷ and Tencent⁴⁸ have rolled out their own versions of social credit systems, which offer a holistic assessment of character based on vaguely defined categories and non-transparent algorithms.⁴⁹ According to material collected by researchers at the University of Toronto’s Citizen Lab, the chief credit data scientist of Alibaba’s Ant Financial, Yu Wujie, has said, ‘If you regularly donate to charity, your credit score will be higher, but it won’t tell you how many payments you need to make every month … but [development] in this direction [is undertaken with] the hope that everyone will donate.’⁵⁰ Tencent has revealed little about its credit system thus far, but the company already has access to a huge amount of users’ social data, including chat logs, via WeChat, QQ and many of its gaming products.

Due to the lack of data protection laws, few, including state regulators, have an understanding of what kinds of data a private company can access and use.⁵¹ It’s also unclear whether online comments and activities deemed undesirable by the government would negatively affect a person’s creditworthiness. The scheme is wide open to abuse by government authorities, including in tracking dissidents and exerting chilling effects on ordinary citizens.⁵²

The tensions between privacy protection and data collection will be felt not only in China. In recent years, companies and governments in both authoritarian and democratic countries have vowed to develop big-data-based surveillance technologies and tighten internet management in the name of public and national security.⁵³

At the international level, cross-border transfers of personal information, courtesy of the increasingly interdependent global economy in the age of big data, have become a pressing issue for private and state actors. Following the enactment of the Cybersecurity Law, which sets data localisation requirements, China has released administrative documents and guidelines detailing the conditions companies need to meet for data export (Table 3).

Table 3: Regulations on cross-border data transfer or data export

Under these regulations, foreign companies will have to either invest in new data servers in China that may be subject to monitoring by the government or incur new costs to partner with a local server provider, such as Tencent or Alibaba. Apple’s recent decision to migrate its China iCloud data to Guizhou Big Data and Amazon’s sell-off of its China cloud assets to its local Chinese partner are just two examples of how China’s tightening rules on data retention and transfers may affect foreign companies. By requiring data localisation, the Chinese Government is bringing data under Chinese jurisdiction and making it easier to access user data and penalise companies and individuals seen as violating China’s vaguely defined internet laws and regulations.

Meanwhile, Chinese-manufactured tech devices and applications that have taken over large portions of overseas markets are raising questions about data security. The Australian Defence Department has recently banned staff and serving personnel from downloading WeChat, China’s most popular social media app, onto their work phones.⁵⁴ The heads of six top US intelligence agencies, including the Federal Bureau of Investigation, the Central Intelligence Agency and the National Security Agency, told the Senate Intelligence Committee in February that they would not advise Americans to use products or services from Chinese telecommunications companies Huawei and ZTE. In April 2018, the tension escalated into a seven-year ban imposed by the US Commerce Department, prohibiting American companies from selling parts and software to ZTE, although at the time of publishing it’s unclear whether this ban will be enforced or overturned.⁵⁵ In December 2017, the Ministry of Defence in India issued a new order to the Indian armed forces requiring officers and all security personnel to remove more than 42 Chinese apps, including Weibo, WeChat and UC Browser, which were classified as ‘spyware’.

This paper highlights the conflict between the fast-developing big data technologies and citizens’ diminishing rights to privacy and data security in China. A review of major Chinese big-data-related policy initiatives shows that many of those policies reflect special interest from Chinese authorities, its public security forces in particular, in potentially using data-driven analytic technologies for more effective and extensive surveillance and social control.

Compared to the growing number of regulations and national plans that support the research and development of big data technologies, there’s a lack of data protection laws and guidelines to hold relevant parties, especially the government, accountable for the collection and use of personal data. The ambivalent legal framework of data security and privacy protection, which enables state use of collected data, has led to multiple incidences of commercial disputes over access to users’ data. It’s likely we’ll see more such cases in the future.

Addressing these conflicts and advocating for the protection of users’ rights to privacy in China—where the state dominates every sector of society and suppresses civil society—is not easy. The Chinese state’s approach is a reminder to users, both in China and elsewhere, of the importance of protecting personal privacy and online security.

Using China as a case study also offers a number of takeaways for policymakers in other countries. International developments, such as ongoing privacy issues with Facebook data, show that tension between governments, businesses and users in the age of big data is not unique to any country. To that end, the EU’s General Data Protection Regulation has set a good example for containing companies’ exploitation of personal data.

There’s a trend, in China and elsewhere, for governments to use the excuse of ‘protecting user privacy’ to justify a more powerful state and more state involvement in private companies’ and organisations’ operations. Civil society groups, whenever and wherever possible, should assume a stronger role in addressing these challenges and raising awareness . A US-based study released in April 2018, for example, highlighted consumer misconceptions about privacy while using popular browsers, including that they would ‘prevent geo-location, advertisements, viruses, and tracking by both the websites visited and the network provider’.⁵⁶ Further work and support are needed to equip users with sufficient knowledge to understand how data-related technologies work and what those technologies mean to them in everyday life.

The attractiveness of the Chinese state’s surveillance and social control systems to other authoritarian states means we may see other states adopt them, unless the negative aspects of these approaches are made more transparent. The consequences of reduced personal freedom combined with greater state control of societies and individuals are disturbing for advocates of the vitality and strength of open societies. Beyond these concerns, the strategic consequences of the tight integration of the
Chinese tech sector with the Chinese state is an area for further analysis.