The revelation of the U.S. mass data collection program PRISM has triggered a worldwide discussion about the government’s access to the private communications of Internet users.
In most countries, including China, Internet companies carrying out business operations must comply with applicable local laws and regulations. Specifically, such companies must provide specific information to the authorities under certain circumstances, such as ones involving national security and criminal investigations.
In this advisory, we will focus our analysis on China and discuss the regulatory background regarding governmental authority in accessing the private information of Internet users.
1. Introduction
In China, there is no law that specifically addresses the government’s authority in accessing private information of Internet users. However, the general provisions regarding the investigation or supervisory power of governmental agencies are still applicable. To summarize, the government or judicial authority may access electronic personal information under the circumstances of national security, criminal investigations and trials, civil suitcases, and administrative management. In all of these situations, because of the lack of definition and detailed judicial interpretation, upon receiving requests from the authorities, it is difficult for Internet companies to challenge the legitimacy of such requests. The expansive nature of governmental authorities in accessing private information of Internet users in China makes any effort in protecting privacy rights volatile.
2. National security
According to the National Security Law of China, when a national security agency investigates a matter related to national security and collects related evidence, any citizen or organization involved must furnish the required information in good faith upon receiving the request and may not refuse to do so.
The above rule seems to have restricted the agencies’ investigative power in accessing data to matters related to national security only. However, because there is no clear definition of “national security” under the law or any judicial interpretation of what matters specifically are considered “related to national security,” in practice the national security agencies might conveniently choose to interpret the phrase broadly, since they have every incentive to obtain the maximum amount of data they are able to acquire.
Furthermore, there is no provision under the law that allows the parties being investigated to file a complaint or challenge the legitimacy of such requests. What it means in day-to-day practice is that if an Internet company receives a request from the agency for some customer data, the company has no choice but to conform to such request. Thus, the national security agencies appear to have sole control over what data they want to collect, and whom they want to collect from.
3. Criminal investigations and trials
According to the Criminal Procedure Law of China, courts, procuratorates, and public security agencies have the authority to collect information or require submission of evidence from the relevant entities and individuals. Such entities and individuals involved, upon receiving such requests, must turn in the evidence in good faith.
Under the Criminal Procedure Law, the courts, procuratorates, and the public securities are each guaranteed rights and power to investigate in their course of duty respectively. Similar to the situation with national security matters as discussed above, the investigative power vested in governmental agencies in criminal proceedings remain intact and cannot be challenged either, since there is no provision authorizing the party being investigated to file complaints.
4. Civil lawsuits
According to the Civil Procedure Law of China, during a civil lawsuit, a court shall investigate and collect any evidence which a party and its litigation representative are unable to collect for “objective reasons,” in addition to evidence which the court deems necessary for trying a case. Courts shall have the authority to investigate and make requests to collect evidence from entities and individuals involved, and the entities and individuals involved shall not refuse to conform to such requests.
Whether a court should be vested investigative power in the first place is still under dispute in China. Some critics believe allowing courts to investigate a case will compromise the impartiality of the justice system. To make things worse, under this law there is no clear definition as to what constitutes an “objective reason” and how to decide on whether something is “necessary” for trying a case. Again, the courts may as well choose to exercise broad discretion in deciding the scope of investigation. In today’s e-commerce field, it is very difficult for any individual or entity to successfully obtain private information from the Internet companies, as such information is often protected under privacy rules and mutual contracts. Thus, technically any individual or entity who has an interest in some private information but is unable to obtain it due to “objective reasons” can simply ask the court to collect the information for them, as long as they are involved in a civil lawsuit. As a result, personal privacy interests are at greater risks of being violated in the foreseeable future.
5. Administrative management and supervision
As to the administrative management and supervision, the Decision on Strengthening Protection of Information on Networks, promulgated by the Standing Committee of the National People’s Congress in 2012, provides a broad authority to all administrative authorities with the right to access customers’ information during their performance of duties. According to this Decision, relevant authorities shall, within the scope of respective functions and responsibilities, perform their duties according to the law, and adopt technical measures and other necessary measures to guard against, prevent, investigate, and prosecute unlawful or criminal acts of stealing or otherwise illegally obtaining, selling, or illegally providing to others citizens personal electronic information, as well as other unlawful and criminal acts concerning network information. When relevant authorities perform their duties according to the law, network service providers shall provide cooperation and technical support.
The Ministry of Industry and Information Technology of China, as the main governmental agency responsible for regulation of the Internet industry, has recently adopted and announced the Rules Regarding Protection of Personal Information of Telecommunication and Internet Users, which will take effect on Sept. 1, 2013. The Rules provide that, when a telecom authority exercises supervision or inspection, it may require the telecom business operators or Internet information service providers to furnish relevant materials, or enter into their operational sites to investigate matters itself. The telecom business operators and internet information service providers must cooperate or provide support, if necessary.
Thus, it appears that the power of the administrative branch in accessing personal information is also very broad. Legally speaking, any administrative agencies, when deeming a matter as related to its powers, may require Internet companies to cooperate in its investigation or evidence-collecting process. In addition, as previously mentioned, it is difficult for internet companies to object to or refuse such requirements.
