Clinical follow-up data leaving for Boston
Shanghai-based MedCare Devices makes infusion pumps and runs a post-market follow-up app used by 62 hospitals. Since 1 January this year the app has enrolled 38,000 patients; 11,400 of those records contain cardiac rhythm readings, implant serial numbers and national ID numbers. MedCare's Boston parent wants the full dataset in its US R&D environment and a copy in a Frankfurt cloud region. Separately, the parent's HR team wants the Workday records of MedCare's 2,600 China employees uploaded to the global tenant, including salary, ID numbers and performance ratings. MedCare's IT director plans to sign the standard contract for everything and start the transfer on 1 June. No notification to patients has been drafted and no impact assessment has been completed. The legal team also asks whether the anonymised telemetry from 300,000 pumps is in scope.
1. Which cross-border transfer route applies to the patient dataset, and why is the standard contract the wrong choice?
Read the worked answer
The standard contract is not available here; MedCare must go through the cyberspace administration security assessment.
The thresholds in the security assessment rules are cumulative from 1 January of the current year:
- personal information of more than 1,000,000 individuals; or
- sensitive personal information of more than 10,000 individuals; or
- any important data; or transfer by a critical information infrastructure operator, or by a handler processing personal information of more than 1,000,000 individuals.
MedCare has 11,400 records containing cardiac rhythm data, implant serial numbers and ID numbers since 1 January. Cardiac and implant data is medical health information and ID numbers fall within the sensitive category under Article 28. That exceeds the 10,000 sensitive-person threshold, so the security assessment route is mandatory.
Two further points:
- The 38,000 total is under the 100,000 figure, and the relaxation for lower-volume exporters is framed around non-sensitive personal information. It does not rescue a transfer that already crosses the sensitive-data threshold.
- MedCare should also check the health-sector catalogue for important data. If post-market clinical data on implanted devices is classified as important data, the assessment is required regardless of headcount.
Practical consequence: the 1 June go-live is not achievable on the standard contract path; the filing, assessment and rectification cycle must be planned for.
2. Besides choosing the route, what must MedCare complete before any patient data leaves China?
Read the worked answer
Three cumulative obligations sit on top of the transfer mechanism.
- Article 39 notice and separate consent. MedCare must tell each patient: the name and contact details of the overseas recipient (Boston parent and the Frankfurt cloud provider, as applicable); the purpose and method of processing; the categories of personal information transferred; and how the patient can exercise rights against the recipient. It must then obtain separate consent - a distinct act, not a line in a combined hospital consent form. Because the data is sensitive, Article 29 also applies, and Article 30 requires notice of necessity and impact on rights.
- Article 55 impact assessment. A personal information protection impact assessment is mandatory before cross-border provision, covering the purpose and method, the volume and sensitivity, the risks to individuals, the recipient's security capability, and the enforceability of the contractual safeguards. Under Article 56 the report and processing record must be kept for at least three years.
- Article 38 conditions in practice. The chosen route must be documented, and where the contract route is used it must be filed with the provincial cyberspace administration. For the clinical data, the assessed route also requires that the parent's US environment accept the data-protection obligations and that onward transfers to the Frankfurt region are covered - a transfer within the same corporate group is still a transfer.
Also check: hospital co-processing arrangements. If any of the 62 hospitals independently determined the purpose, they are handlers too and their own consent and assessment duties are engaged.
3. How should MedCare treat the employee HR dataset and the 300,000-device telemetry?
Read the worked answer
Employee HR data - a different answer from the clinical data.
2,600 employees is far below the 100,000-person threshold, and ID numbers, salary and performance ratings are not sensitive personal information in the Article 28 sense (financial account data is sensitive; a payroll record as such is not). On the numbers alone, the standard contract route or certification is available, and the standard contract would need to be filed with the provincial cyberspace administration.
But the route is not the whole answer:
- Article 39 still applies: notice plus separate consent for the transfer, or another Article 13 basis if the transfer is genuinely necessary for the employment relationship - a contested position worth documenting rather than assuming.
- Article 55 impact assessment is required before the transfer, and the group must record why the global tenant needs performance ratings rather than a minimised subset.
- Onward use must be limited to HR administration; using China performance data for global succession decisions is a different purpose and needs fresh notice.
Telemetry from 300,000 pumps. Anonymised data is outside the scope of the law under Article 4, but only if the anonymisation is irreversible and re-identification is impossible in combination with other data. Pump serial numbers linked to hospital and implant records routinely break anonymisation. MedCare must test the dataset against the Article 73(4) standard, remove or hash serial numbers, aggregate at device-model level where possible, and document the test. If the data can be re-linked, it is personal information and the full transfer regime applies.