---
title: "When the 'Right to Use Data' Goes External — Provision, Derivative Data, and the Erosion of Upstream Control"
author: "DCC Editorial"
published: 2026-06-08T02:00:00.000Z
url: https://datacompliancechina.com/posts/data-use-right-externalization/
description: "Part two of Hong Yanqing's (洪延青, 网安寻路人) study notes on China's 'separation of three rights' data-property framework turns to the Right to Use Data (数据使用权). The official definition (国家数据局, Common Data Terms Batch 2) makes the use right an *internal* power — 'I use my own data' to process, aggregate, analyse, and form derivative data — exercised on the premise of *not* providing data externally. So 'granting a use right to a downstream party' is not the use right travelling outward; it is the upstream party exercising its **operation right** to license, while the downstream party acquires a use right. That externalisation flips the downstream's legal position from PIPL **entrusted processor** (委托处理) to **provision** (提供) or **joint processing** — triggering notice and *separate consent* for personal information, and the Network Data Security Regulation's contracting duties. And because a strong use right lets the downstream form **derivative data** (衍生数据) — models, scores, indices, labels — value migrates downstream even though the raw data stays upstream. DCC's read for overseas counsel: in China data deals the use right is real but never self-bounding; whether a partner will grant an open, autonomous use right depends on its business model (control-dependent vs monetisation), and the default structure you should expect is *controlled use* (sandbox, privacy computing, federated modelling), not a clean copy."
tags: ["data-property-rights", "data-use-right", "data-economy", "three-rights-separation", "data-twenty-articles", "data-trading", "derivative-data", "privacy-computing", "academic-commentary"]
laws_cited: ["data-foundation-system-opinions", "common-data-terms-batch-2", "pipl", "dsl", "network-data-security-regulations", "data-property-rights-registration-guide-draft"]
domains: ["data-economy", "personal-information", "data-security"]
account: "wangan-xunluren"
original_title: "越自主，越难流通？数据使用权外部化的结构张力"
original_author: "洪延青"
original_publication: "网安寻路人"
original_url: "https://mp.weixin.qq.com/s/I0kxJci1Is4mM5XsTWWmeA"
source_language: "zh"
---
> *Editor's Note — DCC.*
>
> This is DCC's summary and analysis — not a translation — of
> 《越自主，越难流通？数据使用权外部化的结构张力》, the **second** study note by
> **Hong Yanqing (洪延青)** on his **网安寻路人** channel in a series on China's
> "separation of three rights" (三权分置) data-property framework. Part one,
> on the Right to Hold Data, is on DCC as
> [Two Paths for the "Right to Hold Data"](/posts/data-holding-right-two-paths/);
> the third, on the Right to Operate Data, is
> [Why Upstream Won't Operate Its Data](/posts/data-operation-right-why-upstream-wont-share/).
> The piece is legal theory, but a consequential one — it goes to how a Chinese
> data partner can and cannot license data, and therefore how data-use deals,
> AI-training-data supply, and data-as-asset structures should be built. The
> original is linked at the foot; the framing for overseas counsel is ours.

## Where the use right sits

China's *Opinions on Building the Basic Data Systems* — the **"Data Twenty
Articles" (数据二十条)** — split data property into the **Right to Hold Data
(数据持有权)**, the **Right to Use Data (数据使用权)**, and the **Right to Operate
Data (数据经营权)**. Part one argued the holding right is thin. This note argues
the use right has *more* real content — and that precisely this content makes its
externalisation structurally fraught.

The official definition is narrow in an easily-missed way. The National Data
Administration's **Common Data Terms (Batch 2)** defines the use right as the
right to "process, aggregate, and analyse data to optimise operations, deliver
services, and **form derivative data**" — and stresses that, *as a rule*, the use
right is exercised **on the premise of not providing data to the outside**
(不对外提供数据). The right to provide data externally is the separate
**operation right**.

The consequence Hong draws: the paradigmatic use right is **internal** — "I use
my own data," not "I let someone else use my data." So when people speak of
"upstream granting a use right downstream," that is *not* the upstream simply
exercising its use right. Strictly, the upstream is exercising its **operation
right** to license; the downstream is *acquiring* a use right. The single act has
two faces — upstream operation, downstream use — and it is in this externalised
form that personal-information compliance, data security, derivative-data
ownership, and loss of upstream control all surface at once.

## Externalisation moves the downstream from "entrusted processor" to "provision"

Granting a use right outward first changes the downstream party's **legal
position** under PIPL.

- If the downstream merely processes data **on the upstream's instructions and for
  the upstream's purposes**, it looks like an **entrusted processor** (受托处理人).
  PIPL's entrusted-processing rule confines it to the agreed purpose and method,
  bars processing beyond what was agreed, and requires it to return or delete the
  data when the engagement ends — it may *not* retain the data.
- A genuine **use right** is different in kind: its core is that the downstream may
  process, aggregate, analyse, and exploit the data **for its own purposes**. Once
  it does that, it is no longer a service provider to the upstream. If the data is
  personal information, the downstream can become an **independent personal
  information handler** (个人信息处理者), and the upstream's act falls into
  **"providing personal information to another handler"** (提供) — or, where the two
  jointly decide purpose and means, **joint processing** (共同处理).

That distinction carries a compliance load. Under PIPL, providing personal
information to another handler requires telling the individual the recipient's
name and contact details, the purpose, the method, and the categories of personal
information involved — and obtaining **separate consent** (单独同意); the recipient
must then process only within that scope. So externalising a use right over
personal information is not just a property-allocation question; it is a
personal-information-compliance event.

For **non-personal data**, the load is different. The **Data Security Law**
applies — lawful sourcing, no theft or illegal acquisition, classification and
grading, important-data and cross-border controls, transaction compliance — but
there is no general "separate consent before providing to another processor"
rule. Externalising a use right therefore lands in very different places depending
on the data type: a heavy provision/joint-processing burden for personal
information; a data-security-and-transaction-compliance structure for everything
else.

## Derivative data: why value migrates downstream

The most consequential feature of the use right is not "provision" but
**production**: a use right includes forming **derivative data (衍生数据)**.

The official definition is specific — derivative data is data that a processor,
exercising a use right, transforms through "professional processing, model-based
analysis, and key-information extraction" such that its **content, form, and
structure are substantially changed and its value markedly increased**. So a use
right is not a bare right to read or query; it is a right that can **create new
value**. A downstream party with a strong use right can turn upstream data into a
new label system, scoring model, risk index, customer profile, market forecast,
set of model parameters, training result, industry report, or data-API service.

And here is the pivot: **absent a clear agreement, derivative data is generally
claimed by the party that actually created it** — the downstream — because it is
not a copy of the raw data but the product of the downstream's own algorithms,
models, scenarios, and cleaning-and-processing work. The result is a structural
leak: the upstream still *holds* the raw data, but a portion of its **value** has
already moved downstream, embodied in models, parameters, scores, labels, indices,
or predictive capability.

Hong is careful that this is not a statutory command — "derivative data severs the
chain of succession from its source" is a *scholarly inference* from "a processor
holds an interest in what it produces," still bounded by contract, PIPL, trade
secrets, IP, the DSL, anti-unfair-competition law, and the public interest.
Parties *can* contract around it — derivative-data ownership, grant-back licences,
revenue sharing, bans on external operation or model-training, no-fusion clauses,
deletion duties, audit and output-review rights. But contract does not erase the
**cost** of discovery, proof, tracing, and recovery. Once a derivative result is
further aggregated, modelled, de-identified — or genuinely anonymised — it becomes
much harder for the upstream to prove it came from a specific dataset and to assert
control. What the upstream truly fears is not that the downstream *sees* the data,
but that it **absorbs the data's value** and fixes it into its own systems.

## Two upstreams: controlled use vs. monetisation

Whether an upstream will grant a strong use right turns less on the data's value
than on its **business model** — does it rely on data to sustain a competitive
relationship, or does it sell and license data products for a living?

- **Control-dependent upstreams** — platforms, holders of core user data, owners of
  high-value industrial data or irreplaceable training data — typically will *not*
  hand over a complete, autonomous, derivative-data-capable use right. They prefer
  **controlled** structures: API calls, **data sandboxes**, trusted execution
  environments, **privacy-preserving computation**, result delivery, joint
  modelling, co-development. The downstream may "use" the data, but the use is
  tightly bounded by technical measures and contract. For them, the question is not
  whether data can generate transaction value, but whether the transaction will
  **erode their durable advantage** — so the more open the use right, the more they
  compress its autonomy.
- **Monetisation upstreams** — data brokers, dataset licensors, sellers of
  industry data products, some AI-training-data licensors — do *not* aim to retain
  control. They productise and license, taking a one-off or recurring price; once
  the price and the contract cover the risk of weakened control, granting a strong
  use right is the rational choice. Their concern is price, licence scope, liability
  caps, compliance warranties, breach remedies, sub-licensing, exclusivity, term,
  and field-of-use.

The same problem, two solutions: control-dependent upstreams convert a strong use
right into **controlled use**; monetisation upstreams **price** the control loss
into the deal. Crucially, **compliance risk and value-control risk are separate
layers.** "Provision" mainly creates compliance duties (notice, separate consent,
recipient-scope control; and, for personal information and important data, the
**Network Data Security Regulation**'s requirement to fix purpose, method, scope,
and security duties by contract and to supervise the recipient). Value-control risk
is the other layer — the downstream forming derivative data, model parameters, and
predictive capability. The two can come apart: you can have a formal "provision"
relationship locked down tightly by contract and technology, *or* no
personal-information "provision" burden at all (non-personal data) yet still suffer
value outflow. And **anonymisation is not a clean escape** — true anonymisation may
take data out of the personal-information category, but most "anonymisation" in
practice is mere **de-identification**, which remains personal information.

## The use right is real — but its boundary comes from outside

Hong's synthesis: the controlled-access arrangements above *prove* the use right is
being traded — contracts allocate and limit it, sandboxes enforce its boundary,
APIs constrain the manner of use, privacy computing controls visibility, output
review decides what may leave. What can be licensed, limited, and enforced is
exactly the interest in **using data**.

The problem is that the use right **does not carry its own complete boundary**.
Purpose, term, scope, whether outputs may be downloaded or models trained, whether
third-party data may be fused, who owns derivatives, whether sub-licensing or
external operation is allowed — all of this must be fixed by contract, technical
measures, compliance rules, and revenue arrangements. But, Hong argues, a right
whose boundary and enforcement come from outside is **not therefore empty** —
ownership itself depends on tort law, contract, registration, land-use and traffic
and environmental rules, yet no one calls ownership "nominal." A property right
that needs external rules to be made concrete is the normal case. The use right
answers *"what kind of interest is this"* — the interest in processing,
aggregating, analysing, and internally exploiting data. *"How far it can be used,
what may be output, who owns the product, whether it can be re-used or externally
operated, how breach is detected and remedied"* — those are answered by the
external rules. **The right type supplies the language of the deal; the external
rules supply the boundary.**

## Why overseas counsel should care

- **"Granting use" of personal information is a PIPL provision event.** If a Chinese
  partner lets you process its personal-information dataset for *your own* purposes,
  you are likely an independent handler and the transfer is **provision** (or joint
  processing) — requiring notice and **separate consent** from individuals, with the
  recipient confined to the disclosed scope. Diligence the consent basis *before*
  the data moves; a "data use licence" does not cure a missing separate consent.
- **Expect controlled use, not a copy.** A control-dependent Chinese counterparty
  will usually offer a **sandbox, privacy-computing, or API** structure rather than a
  raw dataset — the same "use without holding" pattern flagged in
  [part one](/posts/data-holding-right-two-paths/). Design your project around
  outputs and model results, and negotiate output-review and grant-back terms
  explicitly.
- **Pin down derivative-data ownership in the contract.** China's default tilts the
  ownership of models, scores, and labels toward the party that builds them. If you
  are upstream, write derivative-data ownership, no-train/no-fusion, and deletion
  terms; if you are downstream, confirm your right to retain and operate what you
  build — silence will be litigated later.
- **Map the compliance layer separately from the value layer.** Treat
  personal-information **provision** duties (PIPL) and the **Network Data Security
  Regulation**'s contracting-and-supervision duties as one workstream, and the
  commercial control of derivative value as another; the deal can fail on either.

## DCC sources

- **Original:** Hong Yanqing (洪延青), 《越自主，越难流通？数据使用权外部化的结构张力》,
  on the 网安寻路人 channel —
  [mp.weixin.qq.com](https://mp.weixin.qq.com/s/I0kxJci1Is4mM5XsTWWmeA).
- **Series on DCC:** part one —
  [Two Paths for the "Right to Hold Data"](/posts/data-holding-right-two-paths/);
  part three —
  [Why Upstream Won't Operate Its Data](/posts/data-operation-right-why-upstream-wont-share/);
  part four —
  [Data "Parallel Property Rights"](/posts/data-parallel-property-rights/).
- **Cross-references on DCC:** the [Data Twenty Articles](/laws/data-foundation-system-opinions/)
  (source of the three-rights structure) · the
  [Common Data Terms, Batch 2](/laws/common-data-terms-batch-2/) (the official
  definitions of the use and operation rights and of derivative data) · [PIPL](/laws/pipl/)
  (provision, separate consent, entrusted processing) · the [Data Security Law](/laws/dsl/) ·
  the [Network Data Security Regulation](/laws/network-data-security-regulations/) · the
  [draft Data Property Rights Registration Guidelines](/laws/data-property-rights-registration-guide-draft/).
- Part of the [data-economy](/domains/data-economy/) domain on DCC.

> This is an editorial summary and analysis of Hong Yanqing's commentary, written
> in DCC's own words for overseas readers — not a translation of his article, and
> not a reproduction of it. Quoted phrases are short and attributed; the full
> argument is his, at the link above. **Not legal advice.**