China's New Cybersecurity Rules Could Expose US Trade Secrets, Experts Say
Most companies that operate in China were already wary of losing their grip on intellectual property assets. Now, in light of the new, far-reaching rules, doing business in China is likely to be more challenging, privacy and information security lawyers say.
October 08, 2018 at 04:44 PM
5 minute read
In just a few weeks, U.S. companies that do business in China are going to confront a host of challenges related to the enactment of a fresh batch of cybersecurity rules that could also force open the locks on trade secrets and other sensitive information.
Most U.S. companies that operate in China were already wary of losing their grip on intellectual property assets, said David Katz, a partner at Nelson Mullins Riley & Scarborough in Atlanta who specializes in privacy and data security. Now, in light of the new, far-reaching rules, doing business in China is likely to be “more challenging and potentially perilous,” he said.
The latest regulations are set to take effect Nov. 1 and would give Chinese authorities the power to peruse a company's records and remotely access corporate networks that may endanger Chinese national security, public safety, network security risks or social order. Under the rules, which are part of sweeping new cybersecurity regulations that were enacted earlier this year, any information that is collected during a search is supposed to be “strictly confidential.”
“The information obtained by the public security organs and their staff in fulfilling their duties of internet security supervision and inspection can only be used to maintain the needs of network security and must not be used for other purposes,” the regulations state.
But that language probably won't be enough to convince outside companies that Chinese police agencies will be safeguarding their proprietary information. “It's business beware,” Katz said. He added that the new rules give the government “quite a bit of power,” which could be used punitively as a retaliatory weapon against U.S. tariffs on imported Chinese goods.
“You should understand that there's the possibility that you'll be required to completely submit to the authority of Chinese regulators when it comes to your network infrastructure, your critical infrastructure,” he said. “That's an awful lot of reliance to be placing on a regulator. There are a lot of risks in relying on the regulatory graces of the Chinese government.”
Edward McNicholas and Yuet Ming Tham, both partners at Sidley Austin who focus on privacy and data security, wrote in a March expert opinion article that China's new regulations will apply to any company that can be defined as a “network operator.” The term, they said, casts a wide net and includes “owners and administrators of an information network and network service providers.”
They added that China's rules differ from the European Union's General Data Protection Regulation—primarily because China's rules are built on the “distinct notion of 'cybersovereignty.'”
The concept “refers to the power of the Chinese state to control the data inside of its country and crossing its borders,” McNicholas and Tham wrote. “The 'important data' covered by the law thus includes not only personally identifiable information, but also trade secrets (often overlapping), and other information that the state considers sensitive, such as information on sensitive cultural and political issues.”
So what can a company do to protect its secret data?
The key is to segregate and encrypt data, according to Robert Cattanach, a cybersecurity and compliance specialist at Dorsey & Whitney in Minneapolis, where he's a partner. He anticipated that China's new regulations will give the government a “blank check” to snoop on companies, which means businesses are going to have to be more vigilant.
“I would isolate those crown jewels so they're not connected to any networks and I'd encrypt as much as I could,” he said. “You need to carefully segregate your data assets. The data that you generate in China about Chinese residents is fair game and you have to keep it there, but how much of your IP data do you need to have in China if you can help it?”
If the authorities in China demand that a company hand over encrypted or otherwise protected data, it will at least open the door for a discussion about whether the information is pertinent to national security, according to Cattanach.
“You try to make it difficult while being nice about it,” he said. “This is a cat-and-mouse game. We're going to see how this rolls out and how aggressive they're going to be.”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllLowenstein Hires Ex-FTX US General Counsel Ryne Miller to Lead Its Commodities, Derivatives Practice
3 minute readSustainable Packaging Company Packsize Finds New Legal Chief a Perfect Fit
2 minute readLockmaker's Veteran GC Takes Old Job Back After Successor Lasts Just 3 Months
2 minute readTrending Stories
- 1Judicial Ethics Opinion 24-59
- 2The American Lawyer Names Industry Award Winners
- 3Regulatory Upheaval Is Coming. How Businesses Prepare and Respond Will Separate Winners and Losers
- 4Cravath Elevates 7 to Partnership, Up From Last Year
- 5Kline & Specter Hit With Lawsuit From Another Former Associate
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250