Applying China’s Personal Information Protection Law to U.S. Discovery Requests
July 24, 2024
On August 20, 2021, the Standing Committee of the National People’s Congress promulgated China’s Personal Information Protection Law (PIPL), which became effective from November 1, 2021. Chapter 1 of the PIPL contains general rules, Chapter 2 outlines rules for handling personal information, and Chapter 3 addresses cross-border transfer of personal information. Chapters 4, 5, and 6 address individual rights, obligations of personal information handlers, and authorities performing personal information protection duties, respectively. Chapter 7 clarifies legal liability, and Chapter 8 contains supplementary provisions.
The PIPL governs the handling of personal information of natural persons within China and the sending of such information abroad. In recent cases (previously discussed here and here at TLB), U.S. courts have rejected the PIPL as a barrier to U.S. discovery by considering Article 13(3) as an exception. Article 13(3) allows the handling of personal information without an individual’s consent when “the processing is necessary for the performance of statutory duties or obligations.”
In Cadence Design Systems, Inc. v. Syntronic AB (2022), the magistrate judge held that the PIPL did not bar compliance with the court’s discovery order because Article 13(3) applies to all obligations provided by law including obligations under foreign laws such as discovery requests. In Owen v. Elastos Foundations (2023), the district judge relied on the opinion in Cadence and reached the same conclusion.
In this post, we explain that these courts’ interpretation of the PIPL is mistaken. Article 41 of the PIPL specifically addresses requests for information from foreign judicial or law enforcement authorities, requiring approval of such requests by competent authorities of the People’s Republic of China. Article 13 creates an exception only to the consent requirements in the PIPL, not to other provisions such as Article 41. Fortunately, China and the United States are both parties to the Hague Evidence Convention, which provides a mechanism for discovery requests consistent with the PIPL.
How Article 13 Fits into the PIPL
Article 13, which is the first provision of Chapter 2, sets out the lawful bases for processing personal data, stating that “[a] personal information processor can process personal information of an individual only if one of the following circumstances exists.” The first basis requires an individual’s consent. The other six bases establish exceptions to this consent requirement, and the last paragraph of Article 13 provides that these exceptions apply whenever the PIPL requires individual consent. The exception on which U.S. courts have relied is Article 13(3), which permits the handling of personal information where “the processing is necessary for the performance of statutory duties or obligations.”
It is not crazy to think that Article 13(3) applies to requests for evidence. In fact, Chinese courts apply Article 13(3) as a basis for requesting evidence from parties when Chinese law imposes such “statutory duties or obligations.” For example, in Xu Han v. Shenzhen Fengchao Technology Co. (2022京0491民初19686号), and Ni Mingyang v. Chongqing Pengjiang Food Co., Ltd. (2022渝04民终197号), Chinese courts held that the Civil Procedure Law of the PRC imposes such statutory duties.
The key question is whether Article 13(3) also applies to requests for evidence for use in foreign courts. The U.S. courts in Cadence Design Systems and Owen concluded that it does because the text of Article 13(3) is not expressly limited to Chinese law. The problem with this reasoning is that it overlooks the PIPL’s Article 41, which specifically addresses requests by foreign judicial or law enforcement authorities for personal information stored within China. Article 41 has no individual consent requirement to which Article 13(3) can apply.
Article 41
Chapter 3 of the PIPL deals with cross-border transfers of personal information. Article 38 addresses cross-border transfers in general, Article 39 requires notice to the individual and separate consent, Article 40 imposes additional requirements for certain information handlers, and Article 41 covers “foreign judicial or law enforcement authorities’ requests.”
Article 41 states:
The competent authorities of the People’s Republic of China shall handle foreign judicial or law enforcement authorities’ requests for personal information stored within China in accordance with relevant laws and the international treaties and agreements concluded or acceded to by the People’s Republic of China, or under the principle of equality and reciprocity. Without the approval of the competent authorities of the People’s Republic of China, no organization or individual [“personal informational handler” in the original Chinese text] shall provide data stored in the territory of the People’s Republic of China for any foreign judicial or law enforcement authority.
The last sentence of Article 41 is categorical. Without the approval of competent authorities of the PRC, personal information handlers may not provide personal information to foreign judicial or law enforcement agencies. Article 13(3) is not an exception to this provision. It is an exception only to requirements for individual consent, and Article 41 has no consent requirement.
China’s Data Security Law has a provision similar to Article 41 in its Article 36. As Katie Kramer has previously explained at TLB, some U.S. courts have held this provision to be inapplicable because U.S. discovery requests are made by the parties to the litigation rather than by the court itself. But this argument seems weak. Parties typically seek discovery of evidence so that it can be presented to a court, in which case Article 41 would have to apply in the end. And even if Article 41 were deemed not to apply on the basis of such an argument, Article 38’s general requirements for cross-border transfers would apply and Article 13(3) would not provide an exception. Article 38 requires government approvals unless the parties are following a treaty or international agreements.
The Hague Evidence Convention
The Guidance and Explanations of the PIPL (《〈中华人民共和国个人信息保护法〉导读与释义》) published in 2022 and edited by Heqing Yang (杨合庆), the Deputy Director of the Economic Law Office of the Law Commission of the Standing Committee of the National People’s Congress (NPC), explains:
when handling the requests from foreign judicial or law enforcement agencies for the personal information stored in the territory of PRC, it should be handled by the competent authorities concerned in accordance with the relevant laws and the international treaties and agreements to which PRC has entered into or to which it has acceded.
China and the United States are both parties to the Hague Evidence Convention. Article 2 of the Convention states that “a Contracting State shall designate a Central Authority which will undertake to receive Letters of Request coming from a judicial authority of another Contracting State and to transmit them to the authority competent to execute them.” So, a letter of request issued by a U.S. court and transmitted through China’s Central Authority (its Ministry of Justice) will likely be found legitimate under Article 41 when it involves personal information. This process would satisfy Article 41’s requirement for approval of the “competent authorities,” in this case China’s Central Authority under the Convention.
The Ministry of Justice’s “Frequently Asked Questions on International Judicial Assistance in Civil and Commercial Matters” (国际民商事司法协助常见问题解答) posted on the website of Ministry of Justice of the People’s Republic of China on March 2023 provide more proof of how this problem is supposed to be dealt with under Chinese law. Question 5 asks “how can foreign judicial authorities or judicial personnel obtain evidentiary materials located in China?” The answer says:
a request for investigation and evidence collection shall be submitted to the Ministry of Justice by a foreign judicial authority or individual qualified to make a request for evidence collection in accordance with the channels provided for in the treaty. If no relevant treaty has been concluded with China, a request shall be made to the Ministry of Foreign Affairs. The request shall be executed by the people’s court after examination and approval, and the result shall be answered by the department receiving the request.
This process aligns with Article 41 of the PIPL.
Conclusion
Since the Supreme Court’s decision in Societe Nationale Industrielle Aerospatiale v. U.S. District Court (1987), U.S. courts have developed a comity test to determine whether to require litigants to resort to Hague Evidence Convention procedures before initiating discovery under the Federal Rules. Under this test, U.S. courts often order the production of evidence even if it violates foreign law.
However, as Ingrid Brunk has noted, the PIPL is genuinely designed to protect the privacy of personal information, not merely to obstruct U.S. court proceedings. The Hague Evidence Convention provides an internationally accepted alternative for handling cross-border evidence requests. Therefore, it is suggested that U.S. courts should first resort to Convention procedures when faced with PIPL restrictions during discovery, rather than immediately applying the Aerospatiale comity analysis. This approach respects the PIPL and aligns with international protocols.