周亮等：国际诉讼中，数据跨境传输如何做到合规？

近年来，随着业务的不断扩张，境内企业在海外开展业务时，难免会因为种种商业纠纷而卷入到境外诉讼中。来自外国法律冗杂的诉讼程序（例如英美法系中较为常见的证据开示）以及境内数据跨境传输的合规要求等往往会给境内企业造成巨大的应诉压力。

In recent years, Chinese domestic enterprises conducting business overseas are commonly known to be involved in foreign lawsuits raised by various commercial disputes due to the continuous expansion of their businesses. The complicated litigation procedures such as the discovery of documents in common law jurisdictions, plus the data compliance requirements on evidence cross-border transfer according to PRC laws and regulations make Chinese enterprises face overwhelming pressures in responding to their potential lawsuits.

我们近期经办的跨境诉讼中就涉及到处理证据传输数据合规问题。在项目期间，我们协助客户向境外司法机关等提供数据用于其参加诉讼。有鉴于此，我们将该流程及注意事项撰写此文进行分析，具体请详见下文。

We recently handled an international litigation case involving the cross-border transfer of evidence/data. When handling this case, we assisted our client in successfully transferring their electronic documents as case evidence to foreign judicial authorities for litigation purposes. In this article, we will share our insights on the procedures of cross-border data transfer and some matters that may require special attention in the international litigation/arbitration procedures of a Chinese company.

一、案例背景

I.Background Setting

A科技有限公司（以下简称“A公司”）是一家注册成立在中国境内的公司，主要负责研究与开发计算机软件等。由于其产品颇受欢迎，A公司开始不断扩张其海外市场。但是不久前，一家开曼群岛注册成立的B公司因业务纠纷将A公司诉到了开曼法院。根据开曼法律的规定，A公司需参加证据开示（Discovery of Documents）并将其在中国境内产生的所有案件相关证据全部提交至开曼法院。

Company A is a tech company incorporated under PRC laws, with its primary business scope of researching and developing computer software. Thanks to its widely renowned products, Company A began to expand its business in overseas markets. Company A received a claim as the defendant a few months ago, with the plaintiff being Company B, a tech company incorporated under the law of Cayman Island. According to the civil procedure laws of Cayman, Company A was required to participate in the process of discovery of documents and submit the evidence related to the case to the Grand Court of Cayman in its entirety.

二、证据如何跨境传输？

II.How to Transfer the Case Evidence Abroad?

在上述案例中，境内企业A公司需要向境外法院提交其在境内运营过程中产生的信息作为域外开庭的证据。根据中国法律规定及行业实践操作，境内企业向域外法院传送证据的场景主要分为以下两种：1. 境内主体主动向境外执法、司法机构提交；2. 应境外执法、司法机构请求被动提供。

In view of the case above, Company A needs to submit a giant amount of its domestically generated data to the court of Cayman for litigation purposes. According to PRC laws and general practices, there are mainly two scenarios for Chinese domestic entities to submit their electronic documents/case evidence to foreign judicial and law enforcement authorities: (1) the entity voluntarily submits the evidence to the authorities, and (2) the entity submits the evidence to the authorities upon requests.

1. 境内企业主动向域外司法机关提供

1. Voluntary Submission

主动提供，即数据处理者自愿向境外提供数据。在本案例背景中，若A公司依照开曼诉讼法的规定自发地向开曼法院提供其境内产生的数据以作证据开示之用，则属于境内企业主动向域外司法机关提供数据。

Voluntary submission means the data processors submit the domestically generated data at their own will without any passive demands. In our case, it would be assumed as a voluntary submission if Company A transfers its data to the court of Cayman spontaneously for the discovery of documents according to the civil procedure laws of Cayman.

为了更具象地认识到数据处理者跨境数据传输申报的工作流程，我们以A公司为例子展开。根据开曼诉讼法的规定，A公司应诉后，在证据开示环节需要将其案件有关的所有证据提交给案件原告即B公司。作为一家成立在中国境内的新兴科技型企业且涉及到即时通讯软件的开发，A公司的日常业务将会涉及大量的数据及个人信息的处理，且由于本次诉讼的根源亦与数据处理有关，故A公司必须将部分储存于境内的数据用于本次诉讼。

To understand the process of cross-border data transfer more vividly and concretely, we elaborate on the procedures through our case mentioned above. According to the law of Cayman, Company A would be obliged to disclose the relevant electronic documents and evidence to the counterparty (Company B) in the course of discovery of documents should it wish to attend the lawsuit. As a PRC law-incorporated new-tech company developing an instant messaging platform, Company A needs to handle an abundant amount of personal even sensitive personal information. More importantly, as the litigation was to some degree related to data processing, Company A has the duty to disclose certain parts of its data generated domestically.

有鉴于此，A公司需要根据《数据出境安全评估办法》（“《评估办法》”）的规定完成数据出境风险自评估工作并完成风险自评估报告。在评估过程中，A公司需要特别留意其将用于诉讼的数据的内容、种类及数量是否达到了法律规定的门槛，即自上一年1月1日起累计向境外提供10万人个人信息或1万人敏感个人信息，亦或是涉及重要数据等。

In that case, according to Measures for the Security Assessment of Outbound Data Transfer (“the Measures”), Company A would be obliged to complete a two-step assessment—the "security self-assessment" and the "regulatory authority assessment" before transferring the evidence to its counterparty in Cayman Island. During the assessment, it would require Company A special attention to note whether the document to be transferred abroad reaches the assessment threshold, specifically, transferring “Personal Information” abroad of over 1 million people, or “Sensitive Personal Information” of over 10,000 people cumulatively since January 1 of the previous year, or information containing “Important Data”, etc.

如果评估认为满足上述标准的，A公司必须在完成风险自评估后将评估报告及法律规定的其他文件提交至当地网信部门用于监管部门的二次评估审核。只有当A公司获得了网信部门的批文后，案涉数据才能够出境递交给B公司用于诉讼。

If the abovementioned threshold is reached, Company A should draft a self-assessment report concerning the risks of transferring data abroad based on its assessment result, and submit the report, together with other required paperwork to local cyberspace administration authorities (“CAC”) for regulatory authority assessment. Company A is only allowed to transfer its documents abroad once it has obtained permission from CAC.

如果A公司对评估结果有异议的，A公司可以向该部门申请复评一次。但需要注意的是，根据《评估办法》的规定，该复评结果仅为最终结果，且暂无其他救济途径。由于复评的终局性，根据《行政诉讼法》等的规定，A公司因此提起的行政复议及行政诉讼亦不会被受理。

If Company A has any objection to the assessment result provided by CAC, it may apply for a reassessment to the same authority. But note that the result of the reassessment is determined to be final and no further remedies are currently available according to the Measures. It therefore suggests that the finality of reassessment bans the applicant from further applying for administrative reconsideration even administrative litigation according to the Administrative Litigation Law of the PRC.

2. 应境外执法、司法机构请求被动提供

2. Submission Upon Requests by Foreign Authorities

若A公司在诉讼过程中收到了来自开曼法院的文书，请求其依照特定程序向开曼法院直接提交其在中国境内产生的数据的，属于应境外司法机构请求被动提供数据。

Conversely, if Company A receives court documents demanding a direct submission of its documents straightly to the court of Cayman rather than to Company B, it would then constitute a submission upon requests by a foreign judicial or law enforcement authority.

区别于主动提供，被动提供更多类似于一种司法协助程序，涉及到国家司法主权等一系列问题，故会受到更加严格的监管规则。

Differentiating from voluntary submission, submission upon request is more akin to international judicial assistance. Submission upon requests by foreign law enforcement or judicial authorities may involve a range of issues such as the judicial sovereignty of a country and thus subject to stricter regulatory rules.

《个人信息保护法》第41条及《数据安全法》第36条均规定，中华人民共和国主管机关根据有关法律和中国缔结或者参加的国际条约、协定，或者按照平等互惠原则，处理外国司法或者执法机构关于提供存储于境内数据或个人信息的请求。非经主管机关批准，机构或个人信息处理者不得向外国司法或者执法机构提供存储于中国境内的数据或个人信息。不难看出，对境外执法、司法机关调取境内证据而言，中国法律作出了严格的限制。

Article 41 of the Personal Information Protection Law of China (“PIPL”) and Article 36 of the Data Security Law of China (“Data Security Law”) both provide that the competent authority of the PRC shall process a request for data from a foreign judicial or law enforcement authority in accordance with relevant laws and international treaties and agreements entered into or acceded to by China, or under the principle of equality and reciprocity. Without the approval of the competent authority, a domestic entity shall not provide data stored in the territory of China to any foreign judicial or law enforcement authority. As indicated, PRC laws impose strict restrictions on foreign law enforcement and judicial authorities accessing domestically generated evidence.

司法部于2023年3月30日对国际民商事司法协助作出了进一步说明，明确了外国司法机关调取境内证据的，应当按照《海牙民商事案件国外调取证据公约》（“《海牙公约》”）规定的途径向有关机关提出请求，经批准后由法院执行[1]。由此我们也能够推断出，境内企业不得应境外司法机关的请求直接向其提供存储于境内的数据，而应当通过指定渠道完成证据转递。

The Ministry of Justice made an additional clarification regarding international civil and commercial judicial assistance on 30 March 2023, stating that a foreign judicial or law enforcement authority is not allowed to obtain domestically generated or stored data unless requested through channels stipulated in Convention on the Taking of Evidence Abroad in Civil or Commercial Matters (“the Hague Convention”). The transfer of the evidence shall be executed by the competent court upon permission granted. Given these points above, we can also deduce that domestic entities are not allowed to transfer documents directly to foreign law enforcement or judicial authorities unless following the designated channels upon permission.

另外，境外执法、司法机构在境内取证时可能会遇到的部分问题，司法部均在问答中给予了详细说明，例如：

Besides, the clarification provided by the Ministry of Justice detailly elaborates on some potential scenarios that may be encountered by foreign authorities, for example:

• 外国司法机关或司法人员在中国境内调取证据材料的，需要根据《海牙公约》规定的途径，由外国具有提出取证请求资格的司法机关或个人向司法部提出调查取证请求。与中国未缔结相关条约国家或地区需要向外交部提出请求。请求经审批后由法院执行，结果由请求接收部门答复请求方。
• Foreign judicial authorities must follow the procedures specified in the Hague Convention should they seek to obtain evidence in China. The qualified requesting party needs to submit an evidence investigation and collection request to the Ministry of Justice. For countries or regions with which China has yet to enter into treaties, requests should be submitted to the Ministry of Foreign Affairs and executed by the competent court upon approval. The results of the collection request will be provided by the receiving authority.
• 由于中国在加入《海牙公约》时对第二章除第15条之外全部作出保留，故外国司法机关或个人不得直接询问（包括通过电话、视频等技术手段）位于中国境内的证人，仅允许通过条约规定途径向司法部，或通过外交途径向外交部提出取证请求，请求经审批后由法院执行。
• Due to China’s reservation made upon acceding to the Hague Convention on Chapter II in its entirety except for Article 15, foreign judicial authorities or relevant personnel are prohibited from directly questioning witnesses located within the territory of China, including technological methods such as phone calls or video. The only permissible method would be through the channels mentioned above.
• 根据《民事诉讼法》的规定，外国司法机关或相关人员除中国律师外不得委托任何境内其他人员协助调取证据或询问证人，且委托律师之前需经过法院批准才可执行。
• According to the Civil Procedure Law of China, except for qualified Chinese lawyers, foreign judicial authorities or relevant personnel are not allowed to engage any individuals within China to assist in obtaining evidence or questioning witnesses. Approval from the court is required before engaging the services of a Chinese lawyer for such purposes.

我们理解，由于涉及国家司法主权，故立法者通常都会对境外机关直接调取境内证据设定较为严苛的程序。恣意允许外国机关调取证据的，不但会破坏一国的司法主权，更可能会涉及到国家秘密的泄露，危害国家安全。因此，《数据安全法》对未经法定程序即向境外司法机关提供境内数据的增设了沉重的法律责任，例如警告、停业整顿、吊销营业执照以及最高达到数百万元的罚款等行政处罚[2]。境内企业切不可忽视上述规定，依照法律规定向境外提供数据，否则将会面临沉重的法律责任。

We understand that legislators are purposefully imposing strict procedures on foreign judicial authorities obtaining domestically generated evidence because it may relate to the judicial sovereignty of a country. Arbitrarily allowing foreign authorities to obtain evidence not only undermines judicial sovereignty but also threatens national security. Therefore, Data Security Law imposes heavy legal responsibilities for straightly providing domestically generated data to foreign authorities without following the prescribed legal procedures such as warning, suspension of business for overhaul, revocation of business license, or fines up to millions of CNY. Thus, it is crucial that Chinese entities do need to comply with designated procedures before transferring their data abroad, especially to judicial or law enforcement authorities. Otherwise, a heavy legal burden may be imposed if disobeying the law.

三、实操的建议

III.Recommendations on General Practices

企业在运转过程中，难免产生敏感信息，这些信息的产生无疑使得企业在域外应诉中困难重重。有鉴于此，为了帮助境内企业维护自身合法权益，我们作出如下建议。

It is almost inevitable for enterprises to generate sensitive information while operating, and such information would no doubt impose burdens on responding to lawsuits. In view of the above and for the sake of helping domestic enterprises safeguard their legitimate rights and interests, we would make the following suggestions.

1. 对信息进行匿名化处理

1. Information Redaction

根据《个人信息保护法》第4条的规定，经匿名化处理的信息不属于该法定义的“个人信息”。因此，在主动向境外提供的情况下，企业可以根据实际情况对数据作出评估，情况允许的，可对部分信息进行匿名化处理，以规避网信部门的审核。

Article 4 of PIPL provides that information being redacted and anonymized does not belong to the “Personal Information” defined under PIPL. Therefore, under the circumstance of voluntary submission, domestic entities can redact their documents, depending on the actual situation if permissible, to circumvent the requirement of CAC assessment.

2. 向有关部门如实申报

2. Truthful declaration

在主动提供的情况下，如涉及重要数据或实践情况下不允许匿名化处理的个人信息及重要数据等，我们建议企业严格按照法律规定完成安全自评估及网信部门安全评估，在获得监管部门的许可后再跨境传输。在收到被动请求提供的情况下数据处理者应当第一时间向当地有关部门报告，按照规定程序完成境内证据调取，以免因此错过期间而有损自身权益。

Under the circumstances of voluntary submission, if the documents to be transferred abroad contain data such as unredacted personal information and important data, we recommend domestic entities strictly abide by PRC laws on performing security self-assessment and regulatory authority assessment duly. The evidence can be transferred abroad only when permission is granted from regulatory authorities. Under the circumstances of submission upon requests, we recommend the domestic entities contact relevant local authorities immediately after receiving foreign court orders and transfer the evidence following the prescribed channels.

数据跨境传输无小事。随着对外开放不断扩大，中国企业参与的境外诉讼或仲裁会只增不减，因此而涉及到的跨境数据传输也会越来越多。为维护自身合法权益，保障诉讼程序如期推进，我们建议企业应当按照法律的规定对跨境传输的数据完成必要的风险评估工作，履行相关备案申报程序，确保数据跨境合法合规。

As Chinese enterprises are continuously expanding their involvement in international trading, the number of overseas litigations or arbitrations is expected to be increasing in the following years. Consequently, the volume of cross-border data transfer associated with the cases is likely to grow as well. To safeguard legitimate rights and ensure the smooth progress of litigation procedures, it is suggested that PRC companies should conduct necessary risk assessments for cross-border data transfer as per legal requirements. PRC companies are also advised to fulfill relevant declaration obligations to ensure that data transfer is conducted in a legal and compliant manner to avoid its potential legal responsibilities.

特别声明：

大成律师事务所严格遵守对客户的信息保护义务，本篇所涉客户项目内容均取自公开信息或取得客户同意。全文内容、观点仅供参考，不代表大成律师事务所任何立场，亦不应当被视为出具任何形式的法律意见或建议。如需转载或引用该文章的任何内容，请私信沟通授权事宜，并于转载时在文章开头处注明来源。未经授权，不得转载或使用该等文章中的任何内容。