China’s ‘Belt-and-Road Initiative’ is a comprehensive infrastructure plan of the Chinese Government, designed to shore up its international trading routes. While developing that plan, China has also constructed the Civil Code of the People’s Republic of China (‘Civil Code’) to consolidate its disparate civil law in a comprehensive code for the first time: An ‘electronic belt-and-road’, if you will.
This new law is the most extensive single piece of law in modern Chinese history, consisting of 84 chapters and 1,260 articles. It takes effect on January 1st, 2021.
One key element of the new law is data protection rules which implement many aspects of the EU’s ‘General Data Protection Regulation’ (‘GDPR’).
Here I set out the key elements of the new data protection law and what this may mean for civil discovery proceedings in China.
As with New Zealand’s latest data protection law changes, China is following the path of others in updating its data protection laws to line up more clearly with the GDPR. Key elements of the new data protection rules include:
– A new definition of “personal information” which is functionally similar to the definition of “personal data” in the GDPR: That is, any information that could identify an individual. It is worth noting that, due to the existence of social credit ratings in China, there is the potential for far more information to be held by organizations that could be personally identifying;
–Substantial rights for ‘data subjects’. Including a right to access information held by the ‘information processor’, a right to rectify any mistakes in the data held, and a right of erasure (the so-called ‘right to be forgotten’);
–Explicit principles for data processing. Compared to the GDPR, there appears to be a far greater emphasis on gaining the consent of data subjects prior to processing data. It remains to be seen which other lawful means of processing data may be introduced in subsequent laws.
While China does not have a traditional civil discovery process domestically, as China is a signatory to the Hague Convention, ‘Letters of Request’ may be sent from US courts to China’s Ministry of Justice to process a discovery request.
This means that, potentially, a China-based company might be required to produce information that contains protected personal data for discovery in a US court. In such cases, it may be necessary for the organization in China to:
– Ensure that any personal data is transferred out of China in accordance with data transfer processes in the Civil Code;
-Redact any personal information for the purposes of the discovery action, in line with the United States Federal Civil Procedure Rules and the guidance of the US Court in question.
China’s new Civil Code which comes into effect at the start of 2021 will have a substantial effect on any multi-national that carries out business in China. Any business with a China-based branch, subsidiary or other legal presence needs to consider how it will comply with the new data protection laws and any impending discovery actions.