Governmental Authority in Accessing Private Information of Internet Users in China

by Davis Wright Tremaine LLP

The revelation of the U.S. mass data collection program PRISM has triggered a worldwide discussion about the government’s access to the private communications of Internet users.

In most countries, including China, Internet companies carrying out business operations must comply with applicable local laws and regulations. Specifically, such companies must provide specific information to the authorities under certain circumstances, such as ones involving national security and criminal investigations.

In this advisory, we will focus our analysis on China and discuss the regulatory background regarding governmental authority in accessing the private information of Internet users.

1. Introduction
In China, there is no law that specifically addresses the government’s authority in accessing private information of Internet users. However, the general provisions regarding the investigation or supervisory power of governmental agencies are still applicable. To summarize, the government or judicial authority may access electronic personal information under the circumstances of national security, criminal investigations and trials, civil suitcases, and administrative management. In all of these situations, because of the lack of definition and detailed judicial interpretation, upon receiving requests from the authorities, it is difficult for Internet companies to challenge the legitimacy of such requests. The expansive nature of governmental authorities in accessing private information of Internet users in China makes any effort in protecting privacy rights volatile.

2. National security
According to the National Security Law of China, when a national security agency investigates a matter related to national security and collects related evidence, any citizen or organization involved must furnish the required information in good faith upon receiving the request and may not refuse to do so.

The above rule seems to have restricted the agencies’ investigative power in accessing data to matters related to national security only. However, because there is no clear definition of “national security” under the law or any judicial interpretation of what matters specifically are considered “related to national security,” in practice the national security agencies might conveniently choose to interpret the phrase broadly, since they have every incentive to obtain the maximum amount of data they are able to acquire.

Furthermore, there is no provision under the law that allows the parties being investigated to file a complaint or challenge the legitimacy of such requests. What it means in day-to-day practice is that if an Internet company receives a request from the agency for some customer data, the company has no choice but to conform to such request. Thus, the national security agencies appear to have sole control over what data they want to collect, and whom they want to collect from.

3. Criminal investigations and trials
According to the Criminal Procedure Law of China, courts, procuratorates, and public security agencies have the authority to collect information or require submission of evidence from the relevant entities and individuals. Such entities and individuals involved, upon receiving such requests, must turn in the evidence in good faith.

Under the Criminal Procedure Law, the courts, procuratorates, and the public securities are each guaranteed rights and power to investigate in their course of duty respectively. Similar to the situation with national security matters as discussed above, the investigative power vested in governmental agencies in criminal proceedings remain intact and cannot be challenged either, since there is no provision authorizing the party being investigated to file complaints.

4. Civil lawsuits
According to the Civil Procedure Law of China, during a civil lawsuit, a court shall investigate and collect any evidence which a party and its litigation representative are unable to collect for “objective reasons,” in addition to evidence which the court deems necessary for trying a case. Courts shall have the authority to investigate and make requests to collect evidence from entities and individuals involved, and the entities and individuals involved shall not refuse to conform to such requests.

Whether a court should be vested investigative power in the first place is still under dispute in China. Some critics believe allowing courts to investigate a case will compromise the impartiality of the justice system. To make things worse, under this law there is no clear definition as to what constitutes an “objective reason” and how to decide on whether something is “necessary” for trying a case. Again, the courts may as well choose to exercise broad discretion in deciding the scope of investigation. In today’s e-commerce field, it is very difficult for any individual or entity to successfully obtain private information from the Internet companies, as such information is often protected under privacy rules and mutual contracts. Thus, technically any individual or entity who has an interest in some private information but is unable to obtain it due to “objective reasons” can simply ask the court to collect the information for them, as long as they are involved in a civil lawsuit. As a result, personal privacy interests are at greater risks of being violated in the foreseeable future.

5. Administrative management and supervision
As to the administrative management and supervision, the Decision on Strengthening Protection of Information on Networks, promulgated by the Standing Committee of the National People’s Congress in 2012, provides a broad authority to all administrative authorities with the right to access customers’ information during their performance of duties. According to this Decision, relevant authorities shall, within the scope of respective functions and responsibilities, perform their duties according to the law, and adopt technical measures and other necessary measures to guard against, prevent, investigate, and prosecute unlawful or criminal acts of stealing or otherwise illegally obtaining, selling, or illegally providing to others citizens personal electronic information, as well as other unlawful and criminal acts concerning network information. When relevant authorities perform their duties according to the law, network service providers shall provide cooperation and technical support.

The Ministry of Industry and Information Technology of China, as the main governmental agency responsible for regulation of the Internet industry, has recently adopted and announced the Rules Regarding Protection of Personal Information of Telecommunication and Internet Users, which will take effect on Sept. 1, 2013. The Rules provide that, when a telecom authority exercises supervision or inspection, it may require the telecom business operators or Internet information service providers to furnish relevant materials, or enter into their operational sites to investigate matters itself. The telecom business operators and internet information service providers must cooperate or provide support, if necessary.

Thus, it appears that the power of the administrative branch in accessing personal information is also very broad. Legally speaking, any administrative agencies, when deeming a matter as related to its powers, may require Internet companies to cooperate in its investigation or evidence-collecting process. In addition, as previously mentioned, it is difficult for internet companies to object to or refuse such requirements.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Davis Wright Tremaine LLP | Attorney Advertising

Written by:

Davis Wright Tremaine LLP

Davis Wright Tremaine LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.