Data disclosure requirements
12. Are there any local laws that would require a cloud service provider to disclose the data it hosts to any third parties in any circumstances (including regulatory or law enforcement authorities)?

Yes.

  • Procedural laws and regulations, such as the PRC Civil Procedure Law, the PRC Criminal Procedures Law, the PRC Administrative Litigation Law and the Rules Concerning Several Issues Relating to Evidence in Administrative Procedure may give the people's courts, the people's procuratorate (public prosecutor), the national security bureaus and the public security bureaus statutory the power to request that a cloud service provider that is domiciled in China produce certain data (including financial institution data, if requested) as evidence in civil, criminal and administrative litigation and other legal proceedings. The cloud service provider will generally be obliged to accommodate such requests, unless it has reasonable grounds to assert that the authorities are abusing their powers or otherwise unlawfully demanding disclosure of the data.
  • The PRC Administrative Penalties Law, the PRC Anti-Terrorism Law and the Cybersecurity Law give PRC administrative authorities the ability to request disclosure of data (including financial institutions' data stored on the cloud service provider's servers) on legitimate grounds. A cloud service provider that is domiciled in China is obliged to cooperate with such request.

Conversely, according to the PRC Data Security Law, any organization or individual (such as a cloud service provider) in China is prohibited from providing any data it hosts within China to any foreign judiciary or law enforcement authority before it has obtained approval from the competent authority. The detailed procedure for obtaining such approval from the Chinese authority has not been announced.