To produce a data privacy framework it is imperative to know: what personal data is required for the business, where it will be stored, processed and for how long, whether it needs to be sent offshore and what security measures (including encryption) will be applied along the way.

Peter Bullock, Pinsent Masons, Hong Kong

The risk analyst perspective

The wolf close to the door is more dangerous than the wolf in the woods. While Chinese data privacy laws appear lenient, the Chinese authorities do know your office address and could be there in minutes if they chose to be.

Data privacy in Asia is all about actions and training rather than about words and policies. In China specifically, there is, as of 2015, no comprehensive data privacy regime or even comprehensive mandatory requirements, but there are definite signs that this will change. There are requirements which focus more on aggressive marketing and spam filtering, for instance, if you used illegal means to obtain individuals' personal information and used this as a means of telemarketing.

Encryption

One way of protecting employees' data from security breaches is the use of encryption. It has been said that encryption is a mere 'sunscreen' protection of electronic data, and that it gives a false sense of security while not offering real protection. But that is not entirely true. A good system involving file level encryption of data can stop unauthorised use of information by third parties with which you are frequently dealing and protect those very important documents, connections and customer details. However, it is not acceptable to just import a forensic encryption product as this is limited in China by the Office of the State Commercial Cryptography Administration (OSCCA). OSCCA will require an import permit for use of a foreign encryption product. There are, however, several types of encryption software which are already approved by the Chinese government.

Third parties

The second way in which data privacy becomes an issue is obviously when dealing with third parties. If you need to share customer information with a vendor, supplier or channel partner, you will not have the benefits of a technical protection such as encryption. Practically speaking, you will need to ensure you can discover that the partner is going to use the same standards of information governance as yourself, or that if it does not follow your organisation's high standards, it is aware of the issues and does not have other potential incentives or bad motivations. For this process it is necessary to look beyond the interactions with the company directly, and to ask questions in the marketplace regarding the reputation of that partner company. How do they get things done? Why are they the leader in this area? What other side businesses or government relationships do key employees have which could present conflicts of interest?

Employee conduct

Data privacy is still an issue you must consider when things go wrong in another way. If you find that an employee or partner is not following the rules (especially in the case of an employee), you will be able to conduct a covert investigation of their conduct. But the domestic Chinese rules of evidence under the notary system require great care to be taken in the collection of evidence if there is any chance of domestic litigation or criminal accusations being filed about the employee's conduct. For example, if an employee is accused of defrauding the company and is dismissed as a result, there may be evidence on laptops and phones owned by the company that corroborate the employee's guilt, should there be any counter-claim or accusation by that out-going employee. But collecting this evidence will require a notary to be present at the time of handover of these devices to verify they belonged to that employee. Furthermore, the copying of evidence via computer forensics would typically involve the taking of a forensic image of those devices. In China, a notary must be present and able to record the imaging of those computers and phones, and a copy left with the notary or the authenticity of the evidence could be called into question.

Often compliance in fraud cases in China is more about soft approach than hard law. For example, even if an employee was accused of stealing from the company, once the data on the company computer is copied, the employee may ask that certain personal things were on his computer which should not be examined, such as personal bank account dealings, wedding photos, holiday trips and social media discussions. It will be a matter of judgment in the case whether those items could possibly contain evidence that might verify the illegal activity. If they could not possibly contain the evidence, it will normally be best to copy these and give them back to the employee, and to state these will not form part of the investigation.

This overview provides what is more an attitude to dealing with data than with legal compliance. Protect your employees' and customers' important data, but have a strong idea about what forms your company's core trade secrets, client connections and goodwill. Lock away your crown jewels, not your garbage.

Dmitri Hubbard, Control Risks, Hong Kong