Criminal Exposure Related to the Countering Foreign Sanctions Law and the Data Security Law – Key Concepts

The Countering Foreign Sanctions Law was implemented on June 10, 2021, and the Data Security Law will be implemented from September 1, 2021. These two noteworthy laws, both issued on June 10, 2021, deserve the attention of every institution and individual engaged in cross-border related business. In this client briefing, we briefly highlight the key provisions of the two laws involving criminal liabilities.

[Key Concept 1] Criminal Exposure Related to National Security

1. Prohibiting domestic organizations and individuals from illegally providing data to foreign judicial or law enforcement agencies

Article 4, paragraph 3 of the Criminal Judicial Assistance Law stipulates that without the approval of the competent authority of the People's Republic of China (PRC), foreign institutions, organizations and individuals shall not conduct criminal proceedings in the territory of the PRC. Institutions, organizations, and individuals within the territory of the PRC shall not provide evidence materials and assistance, as prescribed by this law, to foreign countries. On this basis, Article 36 of the Data Security Law further stipulates that in response to foreign judicial or law enforcement agencies’ requests to provide domestic data, the competent authorities of China shall handle requests for data from foreign judicial or law enforcement bodies in accordance with the relevant laws and international treaties and agreements concluded or acceded to by China, or in accordance with the principle of equality and reciprocity. Without the approval of the competent authorities of China, organizations and individuals within the territory of China shall not provide foreign judicial or law enforcement agencies with data stored in the territory of China where an overseas judicial or law enforcement agency asks for the retrieval of data stored within China. It is worth noting that the Data Security Law does not limit the scope or subject matter concerning foreign judicial or law enforcement agencies. The Data Security Law stipulates the administrative liabilities for violating the provisions of this article, but it does not, in our reading, exclude the occurrence of criminal liabilities.

In addition to the Data Security Law, in the case of a foreign country that violates international law and the basic norms of international relations, and uses some excuse or justification according to its own laws to contain or suppress China, a Chinese citizen and other relevant persons may be subject to criminal liabilities if he/she endangers national security or discloses state secrets prohibited by the Criminal Law of the PRC (“Criminal Law”) in facilitation of a foreign country conducting investigations, collecting evidence, deciding sanctions, or enforcing sanctions against the PRC.

2. Cooperative obligations and reporting obligations of relevant organizations and individuals

Article 13 of the Countering Foreign Sanctions Law stipulates that in addition to the provisions of this Law, relevant laws, administrative regulations, and departmental rules may provide for the adoption of other necessary countermeasures for acts that endanger the national sovereignty, security, and development interests of China.

Article 35 of the Data Security Law stipulates that public security organs and state security organs collecting data as necessary to lawfully preserve national security or investigate crimes shall follow relevant state provisions and complete strict approval formalities to do so, and relevant organizations and individuals shall cooperate. 

Therefore, if China investigates and collects evidence on discriminatory restrictions in foreign countries and takes countermeasures, and these measures involve China’s national security issues, in the process of such investigation and evidence collection, pursuant to Article 77 of the National Security Law of the PRC, citizens and organizations shall perform the following obligations to safeguard national security:

(1)They shall comply with the provisions of the Constitution, laws, and regulations in relation to national security;

(2)They shall timely report the clues of activities endangering national security;

(3)They shall truthfully provide the known evidence involving activities endangering national security;

(4)They shall facilitate or provide other assistance to national security work.;

(5)They shall provide necessary support and assistance to national security authorities, public security authorities, and the relevant military authorities;

(6)They shall keep state secrets they have accessed;

(7)Other obligations prescribed by laws and administrative regulations.

Individuals and organizations must not act to endanger national security, and must not provide any kind of support or assistance to individuals or organizations endangering national security. 

[Key Concept 2] Criminal Exposure Related to Civil Damages

Article 12 of the Countering Foreign Sanctions Law stipulates that if any organization or individual infringes upon the lawful rights and interests of Chinese citizens or organizations due to providing assistance in enforcing foreign restrictive measures, those Chinese citizens or organizations may initiate litigation in the people’s court, requesting cease the infringement and compensate losses.

At the same time, the first paragraph of Article 52 of the Data Security Law stipulates that anyone who violates the provisions of this law and causes damage to others shall assume civil liability pursuant to laws.

When the infringed/damaged party initiates civil litigation and the people’s court decides in their favor, the responsible organization or individual shall cease the relevant activities and shall compensate losses. Under these circumstances, if the organization or individual continues cooperating with foreign restrictive measures for commercial reasons, continues violating data-related legal requirements,  refuses to pay compensation, or otherwise refuses to execute the effective judgment of the court, then it may constitute a refusal to execute judgments or rulings prohibited by Article 313 of the Criminal Law, and therefore be subject to corresponding criminal liabilities.

[Key Concept 3] Violation of Regulations on Countering Foreign Sanctions and Data Security

Compared to the criminal liabilities arising from illegal activities specifically mentioned in paragraph 2 of Article 52 of the Data Security Law (see above), Article 14 of the Countering Foreign Sanctions Law stipulates that any organization or individual who fails to implement or cooperate with the implementation of countermeasures shall be investigated for legal liabilities pursuant to laws. We understand that the “legal liabilities” stipulated in this article does not exclude the possibility of criminal liabilities. In addition, it remains to be seen whether China will issue further detailed regulations, interpretations, policies, or official interpretations on the relevant contents of this article in the future.