Authors: Harry Liu, Weixin Qiu, Dispute Resolution group, King & Wood Mallesons
For over a decade, western countries led by the United States have exercised long-arm jurisdiction to conduct criminal and administrative investigations and enforcement actions against multinational enterprises and individuals. These activities have had profound impact on international relations and created significant challenges to the operation, asset protection and personal safety of domestic and international companies located in many countries including China. The recent promulgation of the Data Security Law of the People’s Republic of China installed the last safety valve to protect China’s national security and Chinese companies from illegal suppression by foreign governments. It also created rules and principles to regulate cross-border judicial and administrative investigations by foreign governments. This article aims to present Chinese laws, rules and principles related to cross-border investigations, and to help enterprises to better understand, from a Chinese law perspective, the legal framework and respond appropriately when facing investigations conducted by foreign governments.
1. The International Criminal Judicial Assistance Law of the People’s Republic of China
Judicial and administrative investigations conducted by foreign governments against Chinese companies and individuals have become increasingly extensive and more impactful on geopolitics, increasingly beyond the scope of law enforcement. These actions have created significant challenges for the operations, assets protection and personal safety of Chinese companies and entrepreneurs and have attracted the attention of the Chinese government. In response to the changes and the development of cross-border investigations, the International Criminal Judicial Assistance Law of the People’s Republic of China (“ICJAL”) was adopted at the 13th Session of the Standing Committee of the Sixth National People’s Congress of the People’s Republic of China on October 26, 2018 for the purpose of protecting the rights and interests of Chinese enterprises and individuals from what the Chinese government views as illegal infringement.
Article 4.3 of the ICJAL imposes restrictions on foreign investigations and evidence collection in China:
“Without the approval of competent authorities of the People’s Republic of China, no foreign institution, organization or individual may conduct criminal proceedings prescribed by this law within the territory of the People’s Republic of China, and no institution, organization or individual within the territory of the People’s Republic of China may provide evidentiary materials or assistance prescribed by this law to foreign countries.”
The legislative purpose and other provisions of the ICJAL make clear that for criminal matters the only path to obtain evidential materials for a cross-border investigation is through “government-to-government” judicial mutual assistance. The ICJAL also provides competent authorities the discretion to approve or deny a request for mutual assistance.
Before the ICJAL, even though the document review and cross-border data transfers in cross-border investigations was challenging, the focus of most parties was ensuring that state secrets, personal information, trade secrets and other information protected by PRC law was not unlawfully transferred overseas during cross-border investigations. For data and information stored in China, Chinese lawyers, after reviewing documents and redacting sensitive information, may transfer data or information overseas to foreign non-governmental professionals (e.g., foreign lawyers and auditors) and even foreign governments, enforcement agencies or judicial bodies.
For witness interviews in China, although some foreign lawyers would entrust Chinese lawyers to conduct witness interviews to avoid being deemed to practice law in China, actual practice varies widely. The primary focus of most parties was the confidentiality of the interview and attorney-client privilege. Often, to avoid potentially violating Chinese laws, foreign law enforcement officers or foreign lawyers would request that individuals located in China travel to Hong Kong or to other countries for the interview.
These practices have fundamentally changed following the ICJAL. The ICJAL prohibits foreign governments from directly conducting investigation activities and evidence collection in China for use in criminal matters. It also prohibits domestic organizations and individuals from providing evidence overseas without the approval of Chinese authorities.
Although the ICJAL was promulgated just a few years ago and there are no implementation rules, Chinese companies have begun to refer to the ICJAL in response to foreign court requests for document production. In December 2017, the US Attorney for the District of Columbia served subpoenas on three Chinese banks in connection with a grand jury investigation into a Hong Kong company regarding its alleged violation of US sanctions against North Korea. The subpoenas demanded that the three Chinese banks produce certain bank records between the Hong Kong company and a North Korea state-run entity. All three Chinese banks refused, arguing that the production of the documents would violate the ICJAL and urging the US government to request evidence through the Agreement on Mutual Legal Assistance in Criminal Matters (“MLAA”) signed by US and China in June 2000. The Federal District Court of Columbia rejected the Chinese banks’ arguments and ordered them to comply with the subpoenas, because the court determined that there was no evidence of penalties being imposed for violating the ICJAL and the court considered the argument “pure speculation”. The court also found that the MLAA has not been effective in the past in terms of its enforcement efforts. On April 10, 2019, the District Court judge found the banks to be in civil contempt and imposed a fine of $50,000 per day on each bank until it complied with the subpoenas. The banks immediately filed an appeal, but the D.C. Circuit Court of Appeal affirmed the court order issued by the Federal District Court.
2. The Securities Law of the People’s Republic of China
While the ICJAL regulates criminal proceedings or investigations conducted by foreign governments in China, the Securities Law of The People’s Republic of China (“Securities Law”) adopted at the 15th Session of the Standing Committee of the Thirteenth National People’s Congress of the People’s Republic of China on December 28, 2019, expands the rules for investigation activities conducted in China by overseas securities regulators.
Item 2 of Article 177 of the Securities Law restricts overseas securities regulators from investigating or collecting evidence in China:
“Overseas securities regulatory bodies are not allowed to directly conduct investigations and evidence collection within the territory of the People’s Republic of China. Without the approval of the securities regulatory authorities under the State Council and various competent departments of the State Council, no entity or individual in China may provide documents and/or materials related to securities business activities overseas.”
The Securities Law further regulates cross-border investigations conducted by foreign governments. In a recent case, a US-listed Chinese company was investigated by the SEC of the United States for financial fraud, being the first US-listed Chinese company investigated by the SEC since the new Securities Law took effect. The SEC issued subpoenas to the Chinese company and requested the production of documents. In response, the company argued that the Securities Law explicitly forbids any entity or individual to provide documents and materials concerning securities business activities overseas without the approval of Chinese securities regulatory authorities and other departments of the State Council and requested that the SEC seek approval through the channels mandated by Chinese law. Subsequently, the SEC initiated a formal request for assistance to the China Securities Regulatory Commission (“CSRC”) in accordance with the Securities Law and the CSRC procedures. The documents were eventually delivered from the CSRC to the SEC after review by Chinese lawyers.
The case illustrates how the Securities Law regulates investigations conducted by foreign securities administrative bodies, which aims to protect Chinese companies but also illustrates the commitment by Chinese regulators to demonstrate that these regulatory channels for judicial assistance are viable when lawful requests are made.
3. The Data Security Law of the People’s Republic of China
While ICJAL regulates cross-border criminal matters and the Securities Law regulates cross-border securities business investigations, the Data Security Law of the People’s Republic of China (“Data Security Law”) adopted at the 13th Session of the Standing Committee of the 29th National People’s Congress of the People’s Republic of China on June 10, 2021 adds a final element of data protection that impacts cross-border investigations and evidence collection.
Article 36 of the Data Security Law restricts the provision of data to foreign courts or law enforcement agencies without approval from Chinese regulators:
“[T]he competent Chinese administrative agencies shall, under the provisions of laws and treaties or agreements concluded or participated in by the PRC, or under the principle of equality and comity, handle the request for the production of data by foreign judicial or law enforcement agencies. Without the approval of the competent Chinese administrative agencies, no organizations or individuals in China may provide data stored within the territory of China to foreign judicial or law enforcement agencies.”
Article 3 of the Data Security Law defines “data” as any record of information in electronic or other forms. According to this definition, any information or document stored in an electronic means or on paper falls within the scope of the Data Security Law.
Article 48(2) specifies the liabilities for providing data to foreign judicial or law enforcement agencies without the approval of the competent Chinese authorities:
“[W]here Article 36 of this Law is violated by providing data to an overseas judicial or enforcement agencies without the approval of competent agencies, competent agencies may impose warnings, and impose a fine from 100,000 RMB to 1,000,000 RMB, and may impose fines to directly responsible managers and other directly responsible personnel in charge from 10,000 RMB to 100,000 RMB; when any serious consequence is caused, a fine from 1,000,000 RMB to 5,000,000 RMB may be imposed, and the cease of relevant operations, suspension of operations for rectification, cancellation of relevant business permits or licenses may be ordered, and fines to directly responsible managers and other directly responsible personnel in charge from 50,000 RMB to 500,000 RMB may be imposed.”
With the Data Security Law, the restrictions on cross-border investigations apply not only to cross-border criminal matters (e.g., subpoenas issued by the grand jury or DOJ) and investigations conducted by overseas enforcement agencies (e.g., the SEC investigations), but also may apply to cross-border investigations related to civil litigations and administrative actions. In such process, documents and information collected during the investigation, and even witness interviews, will be regulated by the Data Security Law.
The promulgation and implementation of the ICJAL, the Securities Law, and the Data Protection Law (“New Investigations Laws”) highlight the rapid development of China’s legal system in terms of responding to foreign long-arm jurisdiction and the extraterritorial application of foreign laws. When facing cross-border investigations and responding to the request of overseas judicial or enforcement agencies for producing data and documents stored in China, multinational companies and domestic corporations should communicate with the competent Chinese authorities to obtain the requisite approvals and ensure compliance with Chinese laws when endeavoring to comply with foreign laws.
4. Elements of cross-border investigations that are not yet regulated or are still to be clarified by Chinese laws
The New Investigations Laws govern cross-border investigations conducted by foreign governments and judicial bodies; they do not restrict internal investigations initiated by multinational companies. We currently hold the view that internal investigations initiated by multinational companies for reasons other than those specified in the New Investigations Laws, e.g., receipt of a whistleblower report, may still proceed as usual. Documents produced during the internal investigation may still be transferred overseas provided the transfer complies with the State Secrets Protection Law, the Cybersecurity Law, and other laws which regulate cross-border data transfers.
Where the data is already stored overseas, even if the data originates from China, the parent company in a foreign country will not violate the New Investigations Laws if it provides information and documents to judicial or enforcement agencies where the parent company is located after receiving subpoenas from such judicial or enforcement agencies. However, the New Investigations Laws are not clear on how they may impact circumstances where the parent company in a foreign country receives a subpoena from a foreign government or judicial body and then collects data in China through its internal investigation and provides the data to foreign government or judicial bodies.
Allied with this discussion is the impact of the New Investigations Laws on international dispute resolution proceedings. Arbitration is a non-judicial means of dispute resolution and therefore is not a judicial act of a foreign country. The production of documents to an arbitral institution, the other parties to the arbitration, or the arbitral tribunal does not fall within the scope of Article 36 of the Data Security Law. However, the production of documents to a foreign court in civil litigation in a foreign country is more likely to fall within the scope of Article 36.
Finally, the regulation of assistance provided by organizations or individuals in China arises from the application of Chinese laws to Chinese persons and persons located in China. Chinese organizations or individuals are not exempt from the New Investigations Laws if they provide regulated judicial assistance outside of China. It is still illegal for Chinese organizations or individuals to provide assistance overseas without the approval of the competent Chinese authorities.