近年来，随着业务的不断扩大，国内企业在海外开展业务时，不可避免地会因各种商业纠纷而卷入海外诉讼。 来自国外法律的繁琐诉讼程序（例如，证据开示，这在普通法体系中更为常见）和中国数据跨境传输的合规要求，往往给国内企业应对诉讼带来巨大压力。
in recent years, chinese domestic enterprises conducting business overseas are commonly known to be involved in foreign lawsuits raised by various commercial disputes due to the continuous expansion of their businesses. the complicated litigation procedures such as the discovery of documents in common law jurisdictions, plus the data compliance requirements on evidence cross-border transfer according to prc laws and regulations make chinese enterprises face overwhelming pressures in responding to their potential lawsuits.
我们最近的一个跨境诉讼案件涉及证据转移的数据合规性问题。 在项目期间，我们协助客户向外国司法机关提供参与诉讼的数据。 考虑到这一点，我们写了这篇文章来分析过程和注意事项，详见下文。
we recently handled an international litigation case involving the cross-border transfer of evidence/data. when handling this case, we assisted our client in successfully transferring their electronic documents as case evidence to foreign judicial authorities for litigation purposes. in this article, we will share our insights on the procedures of cross-border data transfer and some matters that may require special attention in the international litigation/arbitration procedures of a chinese company.
一、案情背景。
i.background setting
A科技股份有限公司（以下简称“A公司”）是一家在中国注册成立的公司，主要负责计算机软件的研发。 由于产品的受欢迎程度，A公司开始拓展海外市场。 然而，不久前，一家在开曼群岛注册成立的公司B因商业纠纷向开曼法院起诉A公司。 根据开曼法律，对于在中国发生的所有案件，A公司必须参与文件的发现，并向开曼法院提交所有相关证据。
company a is a tech company incorporated under prc laws, with its primary business scope of researching and developing computer software. thanks to its widely renowned products, company a began to expand its business in overseas markets. company a received a claim as the defendant a few months ago, with the plaintiff being company b, a tech company incorporated under the law of cayman island. according to the civil procedure laws of cayman, company a was required to participate in the process of discovery of documents and submit the evidence related to the case to the grand court of cayman in its entirety.
二、证据如何跨境传递？
ii.how to transfer the case evidence abroad?
在上述案件中，境内企业A公司需要向境外法院提交其境内经营过程中产生的信息，作为域外**的证据。 根据中国法律和行业惯例，国内企业向外国法院移交证据主要有两种情况：1境内实体自愿服从境外执法和司法机关; 2.应海外执法和司法机关的要求被动提供。
in view of the case above, company a needs to submit a giant amount of its domestically generated data to the court of cayman for litigation purposes. according to prc laws and general practices, there are mainly two scenarios for chinese domestic entities to submit their electronic documents/case evidence to foreign judicial and law enforcement authorities: (1) the entity voluntarily submits the evidence to the authorities, and (2) the entity submits the evidence to the authorities upon requests.
1.国内企业主动向外国司法机关提供信息。
1. voluntary submission
主动提供，即数据处理者自愿向境外提供数据。 在本案中，如果A公司根据《开曼程序法》的规定，自愿向开曼法院提供在中国产生的用于证据开示的数据，则属于境内企业向外国司法机关自愿提供数据。
voluntary submission means the data processors submit the domestically generated data at their own will without any passive demands. in our case, it would be assumed as a voluntary submission if company a transfers its data to the court of cayman spontaneously for the discovery of documents according to the civil procedure laws of cayman.
为了更好地理解数据处理者跨境数据传输申报的工作流程，我们以A公司为例。 根据《开曼群岛诉讼法》的规定，A公司应诉后，需要在证据开示过程中向本案原告（即B公司）提交与其案件有关的所有证据。 作为一家在中国成立并涉足即时通讯软件开发的新兴科技型企业，A公司的日常业务将涉及大量数据和个人信息的处理，由于本次诉讼的根本原因也与数据处理有关，因此A公司必须将部分存储在中国的数据用于本次诉讼。
to understand the process of cross-border data transfer more vividly and concretely, we elaborate on the procedures through our case mentioned above. according to the law of cayman, company a would be obliged to disclose the relevant electronic documents and evidence to the counterparty (company b) in the course of discovery of documents should it wish to attend the lawsuit. as a prc law-incorporated new-tech company developing an instant messaging platform, company a needs to handle an abundant amount of personal even sensitive personal information. more importantly, as the litigation was to some degree related to data processing, company a has the duty to disclose certain parts of its data generated domestically.
有鉴于此，A公司应按照《数据出境安全评估办法》（以下简称“《评估办法》”）的规定完成风险自评估，并完成风险自评估报告。 在评估过程中，A公司需要特别注意诉讼中使用的数据的内容、类型和数量是否达到法律规定的门槛，即自上一年1月1日起，在境外提供了10万人的个人信息或1万人的敏感个人信息， 或者它涉及重要数据。
in that case, according to measures for the security assessment of outbound data transfer (“the measures”),company a would be obliged to complete a two-step assessment—the "security self-assessment" and the "regulatory authority assessment" before transferring the evidence to its counterparty in cayman island. during the assessment, it would require company a special attention to note whether the document to be transferred abroad reaches the assessment threshold, specifically, transferring “personal information” abroad of over 1 million people, or “sensitive personal information” of over 10,000 people cumulatively since january 1 of the previous year, or information containing “important data”, etc.
如果评估认为符合上述条件，A公司必须在完成风险自评估后，将评估报告和法律要求的其他文件提交当地网信管理部门进行第二次评估和监管部门审查。 只有在获得国家网信办的批准后，A公司才能将涉案资料提交B公司提起诉讼。
if the abovementioned threshold is reached, company a should draft a self-assessment report concerning the risks of transferring data abroad based on its assessment result, and submit the report, together with other required **work to local cyberspace administration authorities (“cac”) for regulatory authority assessment. company a is only allowed to transfer its documents abroad once it has obtained permission from cac.
如A公司对评审结果有异议，A公司可向部门申请重新评审。 但需要注意的是，根据《评估办法》的规定，重新评估结果仅为最终结果，没有其他补救措施。 由于复评终局性，根据《行政诉讼法》的规定，A公司提起的行政复议和行政诉讼不予受理。
if company a has any objection to the assessment result provided by cac, it may apply for a reassessment to the same authority. but note that the result of the reassessment is determined to be final and no further remedies are currently **ailable according to the measures. it therefore suggests that the finality of reassessment bans the applicant from further applying for administrative reconsideration even administrative litigation according to the administrative litigation law of the prc.
2.应海外执法和司法机关的要求被动提供。
2. submission upon requests by foreign authorities
如果A公司在诉讼过程中收到开曼群岛法院的文件，并要求其按照特定程序直接向开曼群岛法院提交在中国产生的数据，则视为应境外司法机关的要求被动提供数据。
conversely, if company a receives court documents demanding a direct submission of its documents straightly to the court of cayman rather than to company b, it would then constitute a submission upon requests by a foreign judicial or law enforcement authority.
与主动提供不同，被动提供类似于司法协助程序，涉及国家司法主权等一系列问题，因此将受到更严格的监管规则的约束。
differentiating from voluntary submission, submission upon request is more akin to international judicial assistance. submission upon requests by foreign law enforcement or judicial authorities may involve a range of issues such as the judicial sovereignty of a country and thus subject to stricter regulatory rules.
《个人信息保护法》第41条、《数据安全法》第36条规定，中华人民共和国主管机关应当依照有关法律和中国缔结或者加入的国际条约、协定，或者按照平等互惠原则，处理外国司法机关、执法机关要求提供存储在中国境内的数据或者个人信息的请求。 未经主管机关批准，机构或者个人信息处理者不得向境外司法机关、执法机关提供存储在中国境内的数据或者个人信息。 不难看出，中国法律对境外执法和司法机关收集国内证据有严格的限制。
article 41 of the personal information protection law of china (“pipl”) and article 36 of the data security law of china (“data security law”) both provide that the competent authority of the prc shall process a request for data from a foreign judicial or law enforcement authority in accordance with relevant laws and international treaties and agreements entered into or acceded to by china, or under the principle of equality and reciprocity. without the approval of the competent authority, a domestic entity shall not provide data stored in the territory of china to any foreign judicial or law enforcement authority. as indicated, prc laws impose strict restrictions on foreign law enforcement and judicial authorities accessing domestically generated evidence.
2023年3月30日，司法部发布关于民商事国际司法协助的进一步说明，明确境外司法机关在中国境内取证的，应当按照《海牙民商事案件境外取证公约》（《海牙公约》）规定的渠道向有关部门提出请求， 法院经批准后予以执行[1]。由此也可以推断，国内企业不得应境外司法机关的要求直接向境外司法机关提供存储在中国境内的数据，而应通过指定渠道完成证据移送。
the ministry of justice made an additional clarification regarding international civil and commercial judicial assistance on 30 march 2023, stating that a foreign judicial or law enforcement authority is not allowed to obtain domestically generated or stored data unless requested through channels stipulated in convention on the taking of evidence abroad in civil or commercial matters (“the hague convention”).the transfer of the evidence shall be executed by the competent court upon permission granted. given these points above, we can also deduce that domestic entities are not allowed to transfer documents directly to foreign law enforcement or judicial authorities unless following the designated channels upon permission.
此外，司法部在问答中对境外执法和司法机关在中国取证时可能遇到的一些问题进行了详细解释，例如：
besides, the clarification provided by the ministry of justice detailly elaborates on some potential scenarios that may be encountered by foreign authorities, for example:
境外司法机关或者司法人员在中国境内取证的，需要由具有资格的外国司法机关或者个人按照《海牙公约》规定的渠道向司法部提出调查取证请求。 未与中国缔结相关条约的国家或地区，需向***提交申请。 请求获得批准后，由法院执行，结果由请求方由收到请求的部门答复。
foreign judicial authorities must follow the procedures specified in the hague convention should they seek to obtain evidence in china. the qualified requesting party needs to submit an evidence investigation and collection request to the ministry of justice. for countries or regions with which china has yet to enter into treaties, requests should be submitted to the ministry of foreign affairs and executed by the competent court upon approval. the results of the collection request will be provided by the receiving authority.
由于中国在加入《海牙公约》时对除第十五条以外的第二章有所保留，因此外国司法机关和个人不得直接（包括通过技术手段）询问位于中国的证人，只能通过条约规定的渠道通过外交途径向司法部或司法部提出取证请求。 该请求将在批准后由法院执行。
due to china’s reservation made upon acceding to the hague convention on chapter ii in its entirety except for article 15, foreign judicial authorities or relevant personnel are prohibited from directly questioning witnesses located within the territory of china, including technological methods such as phone calls or video. the only permissible method would be through the channels mentioned above.
根据《民事诉讼法》的规定，除中国律师外，外国司法机关或者有关人员不得委托中国境内的其他人协助取证或者询问证人，指定律师必须经法院批准后方可执行。
according to the civil procedure law of china, except for qualified chinese lawyers, foreign judicial authorities or relevant personnel are not allowed to engage any individuals within china to assist in obtaining evidence or questioning witnesses. approval from the court is required before engaging the services of a chinese lawyer for such purposes.
我们理解，由于涉及国家司法主权，立法者通常会为外国当局直接收集国内证据设定更严格的程序。 任意允许外国机关收集证据，不仅会损害一国的司法主权，还可能涉及泄露国家秘密，可能危害******因此，《国情法》对未经法律程序向外国司法机关提供国内数据的行为，如警告、停业整改等行政处罚、 吊销营业执照，并处以最高百万元的罚款[2]。国内企业不得无视上述规定，依法向境外提供数据，否则将面临沉重的法律责任。
we understand that legislators are purposefully imposing strict procedures on foreign judicial authorities obtaining domestically generated evidence because it may relate to the judicial sovereignty of a country. arbitrarily allowing foreign authorities to obtain evidence not only undermines judicial sovereignty but also threatens national security. therefore, data security law imposes he**y legal responsibilities for straightly providing domestically generated data to foreign authorities without following the prescribed legal procedures such as warning, suspension of business for overhaul, revocation of business license, or fines up to millions of cny. thus, it is crucial that chinese entities do need to comply with designated procedures before transferring their data abroad, especially to judicial or law enforcement authorities. otherwise, a he**y legal burden may be imposed if disobeying the law.
3.实用建议。
iii.recommendations on general practices
企业在经营过程中，不可避免地会产生敏感信息，这无疑使企业难以应对境外的诉讼。 有鉴于此，为帮助国内企业维护自身合法权益，我们提出以下建议。
it is almost inevitable for enterprises to generate sensitive information while operating, and such information would no doubt impose burdens on responding to lawsuits. in view of the above and for the sake of helping domestic enterprises safeguard their legitimate rights and interests, we would make the following suggestions.
1.对信息进行匿名化处理。
1. information redaction
根据《个人信息保护法》第4条，匿名信息不属于该法中“个人信息”的定义。 因此，在自愿境外提供的情况下，企业可以根据实际情况对数据进行评估，如果情况允许，可以对部分信息进行匿名化处理，以避免网信办的审查。
article 4 of pipl provides that information being redacted and anonymized does not belong to the “personal information” defined under pipl. therefore, under the circumstance of voluntary submission, domestic entities can redact their documents, depending on the actual situation if permissible, to circumvent the requirement of cac assessment.
2.如实向有关部门报告。
2. truthful declaration
在自愿提供的情况下，如涉及重要数据或个人信息和实践中不允许匿名化的重要数据等个人信息和重要数据，我们建议企业严格依法完成网络安全自评估和网信办安全评估，并在跨境传输前征得监管部门许可。 收到被动请求的，数据处理者应当尽快向当地有关部门报告，并按照规定程序完成国内证据的收集工作，以免错过期限，损害自身权益。
under the circumstances of voluntary submission, if the documents to be transferred abroad contain data such as unredacted personal information and important data, we recommend domestic entities strictly abide by prc laws on performing security self-assessment and regulatory authority assessment duly. the evidence can be transferred abroad only when permission is granted from regulatory authorities. under the circumstances of submission upon requests, we recommend the domestic entities contact relevant local authorities immediately after receiving foreign court orders and transfer the evidence following the prescribed channels.
数据的跨境传输不是一件小事。 随着对外开放的不断扩大，中国企业参与的境外诉讼或仲裁数量只会增加，涉及的跨境数据传输也将增加。 为保障企业合法权益，保障诉讼程序如期进行，建议企业依法约定完成对跨境数据的必要风险评估，并履行相关备案申报程序，确保跨境数据合法合规。
as chinese enterprises are continuously expanding their involvement in international trading, the number of overseas litigations or arbitrations is expected to be increasing in the following years. consequently, the volume of cross-border data transfer associated with the cases is likely to grow as well. to safeguard legitimate rights and ensure the smooth progress of litigation procedures, it is suggested that prc companies should conduct necessary risk assessments for cross-border data transfer as per legal requirements. prc companies are also advised to fulfill relevant declaration obligations to ensure that data transfer is conducted in a legal and compliant manner to **oid its potential legal responsibilities.
特别声明：大成严格遵守保护客户信息的义务，本文涉及的客户项目内容均取自公开信息或已征得客户同意。 本文所表达的内容和意见仅供参考，并不代表大成的任何立场，也不应被视为发布任何形式的法律意见或建议。 如需**或引用文章的任何内容，请私信传达授权并在文章开头注明**。 未经授权，您不得**或使用此类文章中的任何内容。