Welcome everyone to another edition of my China Tech Law Newsletter! We are back talking data regulations, once again. Recently, an article I wrote with other colleagues at R&P came out on the data-related challenges in conducting a cross-border internal investigation. Specifically when you’re not sure as a company what data you’re allowed to use and whether you are allowed to send it back to HQ in your home country.
The article is good, but dense and lengthy. I’m just as guilty as others as saying too often here is a deep dive on this topic or that topic when I publish something, but seriously this article was 12 pages with an estimated reading time of 14 minutes.
So, long story short, I’m going to take this blog opportunity to draw out some of the key points:
- If you read this blog, you likely know China came out with its own personal data privacy framework in 2021 called the Personal Information Protection Law (PIPL).
- PIPL often requires consent for processing and exporting personal information out of the country.
- A dilemma arises when a company has an investigation internally within the company as to an employee or employees’ wrongdoing.
- On the one hand, it needs to engage in damage control - quickly and diligently comprehending what happened, how did it happen, who is involved, what remedial actions need to be taken, and whether the episode needs to be reported to outside authorities. This is what an internal investigation is all about.
- But the internal investigation will very easily touch on an employee’s (and even third parties’) personal information. As you analyze or process that information, do you need that individual’s consent, as is so often the case for processing information under PIPL? What if you maintain command and control of that investigation outside of China, such as back at HQ in the home country? Do you have that individual’s consent to export their personal information?
- Well of course, especially in the beginning that individual may not know he or she is under investigation (and you’d like to keep it that way!). Do you have to interrupt the secrecy of the investigation to get their consent? Seems a bit counter-productive and counter-intuitive, right?
The upshot then of the first half of the article is that:
- You can and should try to get a blanket consent for processing and export during the onboarding process for each employees,
- That may not be sufficient (and may be seen as involuntary), and in fact employees always have a right to withdraw consent (with limitations),
- So you can argue (probably successfully) that investigations are analogous to performance evaluations and covered under the “human resources management” exception for processing and export, and
- Not argue that a statutory obligation exception (such as for Sarbanes Oxley or FCPA) would require the information (this has been argued before but is not recognized as a legitimate carveout in China).
Still with me?
- The upshot of the second half of the article is to be cognizant of the type of data you are exporting (i.e. “important data” = may harm national security, economic operations, social stability, public health or security), and whether you have done a security assessment (see earlier blog post here)
- Finally, consider further the sensitivity of the information and the Chinese government side’s perspective and whether any increasing number of “blocking statutes” are in place that may prevent you from exporting the data, full stop.
All of this is, suffice it to say, not a fun exercise to do in a time crunch and stressful situation. Especially when early and full disclosure of issues is stressed so much these days by the U.S. Department of Justice and other enforcement agencies in the US.
Luckily there are experienced legal and other compliance professionals to help you manage this process. And in this regard, my team and I have the necessary experience.
OK that’s all for this edition, please subscribe if you haven’t already and see you back here in two weeks time!
*This blog may be considered attorney advertising. It is for informational purposes only and does not constitute legal advice.