Security risks from new laws in China and Hong Kong have accounted for a significant proportion of recent requests and questions from clients.
This assessment was issued to clients of Dragonfly’s Security Intelligence & Analysis Service (SIAS) on 29 July 2021.
These include an anti-doxxing law proposal, mooted reforms to the Hong Kong National Security Law, and an anti-sanction law passed by China in June. Taken together with the authorities’ push to gradually expand control over online activity and data in the next few years, this legislation has wide-ranging implications for freedom of speech, press and an independent judiciary, even though the immediate impact of the laws would be limited.
China’s Anti-Foreign Sanctions Law passed on 10 June and formalises the legal basis by which the Chinese authorities can retaliate against measures from the US, EU and others. We doubt that China will use the law excessively this year or that the law increases already existing risks of being targeted by the authorities. A former diplomat on trade issues in China told us that the law ‘does not change much China’s arsenal to retaliate against Western governments and firms’ and that the government was in any case ‘able to use retaliatory measures over the past years also without legal basis if it wanted to’.
Nonetheless, the law will probably add complexity and significant compliance challenges for firms, particularly those owned or listed in the US, when conducting business globally in the long term. This is because it poses conflict-of-law as well as private litigation risks to firms. Based on the scope of existing sanctions, we anticipate that this would mainly affect firms in sectors central to US-China strategic competition, as well as those obligated to comply with sanctions. These include:
- Technology and defence sector firms complying with the US ban on selling high-tech products to listed Chinese entities in China;
- Firms that boycott business in Xinjiang;
- Banks or financial institutions complying with US sanctions by withholding services to listed entities or private persons in China.
It seems probable that the law would also be applicable in Hong Kong, although it is unclear exactly in what form, when or to what extent it would be implemented. It is another step towards what we assess to be China’s long-term goal; converging the region’s and mainland China’s legal system. Planned amendments on doxxing in The Personal Data (Privacy) Ordinance are another example of this. A diplomatic source we have spoken to believes that the presentation of the legislation drafting process by the authorities as Hong Kong-led is a ‘masquerade’, and indicative of how political culture has changed there.
The Privacy Ordinance will probably be introduced within months, and almost certainly before the LegCo election. As the Asia Internet Coalition (AIC) has advised, the new rules could leave social media employees exposed to criminal investigation or prosecution, and companies liable. In our analysis, however, the main objective is to increase the government’s targeted ability to crack down on and control opposition online, rather than a broad application. Opposition activists shared private information about police officers or government officials and their families during the 2019 pro-democracy protests.
On current indications, we doubt that the amended bill would directly impact many international firms that operate in Hong Kong. The only possible exceptions are for companies that operate social media and other online platforms where doxxing is most likely to occur. Even for these, the law is probably a challenge to be managed rather than a fundamental shift in the risk environment. This is also likely to be the case for possible reforms to the 2020 National Security Law. According to The Straits Times, Beijing is considering expanding the remit of that law to formally include more wide-ranging security offences.
There is no real precedent yet for foreign firms being targeted by the authorities in Hong Kong through the National Security Law. But uncertainty over the impact of new legislation on international firms will probably continue to increase. This is due to the broad phrasing of many of the new laws, which leave it down to the discretion of the Chinese authorities as to whether or when to apply these fully. In the long term, the authorities are very likely to use data privacy and other laws expansively, while still balancing this approach with avoiding significant reputational damage to Hong Kong as a major international business hub.
Image: The national flags of Hong Kong and mainland China stand together. Photo via Getty Images.
