1. General Principles on Privacy Protection

（i） Telecommunications Carriers

It is a general principle under the Constitution Law of the PRC （《中华人民共和国宪法》） that the freedom and privacy of communication for citizens in the PRC shall be protected by law, and no individual or organization may infringe any freedom or privacy of communication of any citizen except due to the reasons of protecting national security or conducting criminal investigations, in which case the public security authority or public prosecutor shall conduct the investigations on the communications in accordance with the legal procedures^〔11〕（for further details of the legal procedures, please refer to paragraph 2 below）. In addition, it is stipulated in the Temporary Regulations on Confidentiality of Telecommunications （《电信通信保密暂行规定》） that the telecommunications carriers shall maintain the confidentiality of the personal data of the telecommunications users and the contents and records of the communications of the telecommunications users as recorded in their telecommunications networks^〔12〕. In the event that any telecommunications carrier contravenes the said regulation, it may be ordered to rectify its wrongful act, its illegal income may be forfeited and a fine of not less than the amount of the illegal income but less than three times of the illegal income may be imposed. In case that the amount of illegal income is less than RMB10,000, a fine of more than RMB10,000 but less than RMB100,000 may be imposed. Further, in case that the circumstance is serious, the telecommunication carrier may be ordered to cease business operation for internal restructuring^〔13〕.

（ii） Internet-related Service Providers

It is stipulated in Article 4 of the Administrative Measures on the Security Protection Technology （《互联网安全保护技术措施规定》） that Internet-related Service Providers shall not, except it is otherwise stipulated in the laws and regulations, disclose any information of users obtained by them during the registration process. Further, the Internet-related Service Providers shall take protective security measures to ensure the safety of the Internet and shall not abuse the Internet security measures to infringe the rights of freedom and privacy of communications of their users. In the event that an Internet-related Service Provider contravenes the said requirements, it may be ordered to rectify itswrongful act, its illegal income may be forfeited and a fine of not less than theamount of the illegal income but less than three times of the illegal income maybe imposed. In case that the amount of illegal income is less than RMB10,000, a fine of more than RMB10,000 but less than RMB100,000 may beimposed. Further, in case that the circumstance is serious, the Internet-relatedService Provider may be ordered to cease business operation for internal restructuring^〔14〕.

1. Delivery/Disclosure of Information

There is no explicit law or regulation in the PRC which allows the law enforcement authorities the ability or right to gain access to any data stored by telecommunications carriers or Internet-related Service Providers remotely or in a particular format, or deliver data to the law enforcement authorities on a regular basis. However, as we have mentioned in the above, the public security authority, the national security authority or public prosecutor may conduct the investigations on the contents of telecommunications in accordance with the legal procedures due to the reasons of protecting national security or conducting criminal investigations. Pursuant to Article 8 of National Security Law （《国家安全法》） and Article 43 of Criminal Procedure Law of the PRC（《刑事诉讼法》）, the policemen, prosecutors, official of national security authority and courts may, after showing their relevant identification documents, access the files and documents for the purpose of protecting national security or conducting criminal investigations. With regard to the obtaining of any information from the telecommunications carriers or Internet-related Service Providers, it is stipulated in Article 215 of the Procedures on Investigate Crime of Police （《公安机关办理刑事案件程序规定》） that the emails of the suspects may, after a Retention Notice（扣押通知书）has been issued by the relevant official in the public security authority above provincial level , be retained by the public security authority. In case that the emails of the suspect are no longer required to be retained by the public security authority, a Release of Retention Notice（解除扣押通知书）will be issued by the relevant official in the public security authority above provincial level and a notification will be sent to the relevant telecommunications carrier or Internet-related Service Provider accordingly^〔15〕.

In addition, it is stipulated in Article 8 of the of Administrative Measures on Security Protection for International Connections to Computer Information Networks （《计算机信息网络国际联网安全保护管理办法》） that any organization or individual engaging international internet business shall be subject to the supervision, investigation and guidance of the public security authority, and shall disclose information, materials and data documents to it, to assist it to investigate illegal criminal acts which are conducted through Internet networks. There are also provisions under the Implementation Rules of National Security Law （《国家安全法实施细则》）^〔16〕 and the Criminal Procedure Law of the PRC（《刑事诉讼法》）^〔17〕 which require organization and citizens to provide assistance to public security authority, national security authority, courts and public prosecutor to collect evidence for national security purpose.

Except otherwise stated in the above, there is no explicit law or regulation which governs the procedures that the public security authority, national security authority, court or prosecutor shall comply with in case that any of the said authorities require the telecommunications carriers or Internet-related Service Providers to disclose any data to it. However, we understand that, in practice, the public security authority, national security authority, court or prosecutor will usually issue an "Investigation Assistance Notice" , which will be affixed with the stamp of the relevant authority, to the telecommunications carriers or Internet-related Service Providers in case that it wishes to gain access to any data or information retained by them, and the telecommunications carriers or Internet-related Service Providers will usually provide the data or information as requested.

1. Storage of Data Within or Outside the PRC

There is no express law and regulation in the PRC which prohibits or restricts a telecommunication carrier or Internet-related Service Provider to store the data of the users in overseas; however, in case that the telecommunication carriers and Internet-related Service Providers disclose any contents of communications and records of their users to the third parties, unless such disclosure is legally allowed under the PRC laws, the telecommunication carrier or Internet-related Service Provider may face the risk of breaching the legal confidentiality obligations owed by it to the users, if it remits and stores the data in any servers belong to third parties in overseas^〔18〕. For your information, based on the result of anonymous verbal consultations with an official in MII, an affiliate or subsidiary of the telecommunication carrier or Internet-related Service Provider may be regarded as a third party in this regard.

Further, in case that any data remitted by the telecommunication carriers and Internet-related Service Providers which may be regarded as containing "State Secret" of the PRC^〔19〕, the telecommunications carriers and Internet-related Service Providers have an obligations to keep the "State Secret" in strict confidence, and any remittance of the data containing "State Secret" to overseas may be regarded as illegal disclosure of "State Secret". It is also stipulated in Article 26 of the State Secret Protection Law of the PRC （《保守国家秘密法》） that, unless approval is obtained from the relevant supervisory authority, any transmission or postage of any documents, materials or goods containing "State Secret" to overseas is strictly prohibited. Under Article 111 of the Criminal Law of the PRC （《中华人民共和国刑法》） , if a person has been successfully charged with obtaining "State Secret" for overseas institutions, organizations or people, he/she may be imposed with a retention or an imprisonment of 5 years to 10 years, or if the circumstance is very serious, he/she may be imposed with a retention or an imprisonment of more than 10 years, or if the circumstance is light, he/she may be imposed with a retention, an imprisonment, a supervision or suspension of political rights of less than 5 years. Therefore, if a telecommunication carrier or Internet-related Service Provider wishes to remit and store data in the servers outside the PRC and such data may contain any information which may be regarded as "State Secret", there is a risk that it may be alleged to have disclosed "State Secret" to third parties illegally.

Lastly, based on our anonymous verbal consultations with an official of MII as to whether there is any legal requirement as to whether the data of users shall be stored within or outside the PRC, the official in charge advised that he believes that the data shall be stored by the telecommunications carriers and Internet-related Service Providers within the PRC, otherwise it is hard for the relevant governmental authority to verify whether the telecommunications carriers or Internet-related Service Providers have complied with their obligations of taking appropriate security measures to protect the confidentiality of the data obtained by them from the users. However, the said official could not comment further on the possible consequences in case that the data is stored by the telecommunications carriers or Internet-related Service Providers in overseas, instead of within the PRC.

We trust the above is of help. Please do not hesitate to contact us if you have any queries.

注　释

〔1〕Articles 12 and 94 of Business Rules on Fixed Telephony of Ministry of Post（《邮电部关于市内电话业务规程》）．

〔2〕Appendices 1.1.2 , 2.1.9 , 4.1.7 6.7 and 7 of the Telecommunication Services Rules（电信服务规范）．

〔3〕Articles 8, 10 and 13 of the Provisions on Internet Security Protection Technology Measures（《互联网安全保护技术措施规定》）．

〔4〕Article 7 of the Provisions on Internet Security Protection Technology Measures（《互联网安全保护技术措施规定》）．

〔5〕Article 7 of the Internet Email Service Administration Measures（《互联网电子邮件服务管理办法》）．

〔6〕Articles 14 and 15 of the Provisions on Internet Bulletin Board System Service（《互联网电子公告服务管理规定》．

〔7〕Article 14 of the Regulations on Internet Information Service Administration（《互联网信息服务管理规定》）．

〔8〕Articles 8 and 10 of the Provisions on Internet Security Protection Technology Measures（《互联网安全保护技术措施规定》）．

〔9〕Article 10 of the Administrative Measures on Security Protection for International Connections toComputer Information Networks（《计算机信息网络国际联网安全保护管理办法》）, Articles 9 and 10of the Administrative Measures on the Security Protection Technology （《互联网安全保护技术措施规定》）, Article 16 of the Internet Regulations on Information Service Administration（《互联网信息服务管理办法》） , Article 13 of the Provisions on Internet Bulletin Board System Service（《互联网电子公告服务管理规定》and Article 20 of the Regulations on Internet News Information Service Administration（《互联网新闻信息服务管理规定》）．

〔10〕The Internet-related Service Provider （i） may be ordered to rectify its wrongful act within a specified period, or a warning may be issued and its illegal income may be confiscated by the public security authority; or （ii） if the wrongful act is not rectified within the specified period, a fine of up to RMB 5,000 may be imposed on the principal persons responsible and on other persons directly responsible for the wrongful act, and a fine of up to RMB 10,000 on the unit; or （iii） in serious circumstances, its network connection may be suspended for a maximum period of six months and its business may be suspendedso that restructuring can be done in the company. If necessary, the relevant regulatory authority may alsorecommend that the original certificate examination, approval and issuing authority revoke the Internet-related Service Provider's business license or cancel its network connection qualifications．

〔11〕Article 40 of the Constitution Law of the PRC（《中华人民共和国宪法》）．

〔12〕Articles 5, 9 and 10 of the Temporary Regulations on Confidentiality of Telecommunications（《电信通信保密暂行规定》）．

〔13〕Article 71 of the Telecommunications Regulations of the PRC（《电信条例》）．

〔14〕Article 71 of the Telecommunication Regulations of the PRC（《电信条例》）．

〔15〕Article 216 of the Procedures on Investigate Crime of Police （《公安机关办理刑事案件程序规定》）．

〔16〕Article 25 of the Implementation Rules of National Security Law（《国家安全法实施细则》）．

〔17〕Article 45 of the Criminal Procedure Law of the PRC（《刑事诉讼法》）．

〔18〕Articles 5 and 9 of Temporary Regulations on Telecommunication Confidential（《电信通信保密暂行规定》）．

〔19〕It is stipulated in Article 2 of the State Secret Protection Law of the PRC（《保守国家秘密法》）that state secrets means any matters that are related to the security and interest of the State, which shall be known to a limited scope of persons within a limited period of time, in accordance with the legal procedures．