ILMA Compoundings - August 2020 - 16

INDUSTRY RUNDOWN

International Insight
China Cybersecurity Impact: Hong Kong in
the Crosshairs
By James Eggenschwiler
As mentioned in a Compoundings article earlier this year,
China began enforcement of its new cybersecurity law
on Dec. 1, 2019. Since that time, Chinese government officials in Beijing have extended the applicability of that
law to Hong Kong. In concert with this extension, Beijing
has also become confrontational with Hong Kong and
its citizens and has added new restrictions against privacy rights and personal conduct, as well as a new law
authorizing extradition of violators to mainland China
government authorities.
In addition to the threat and risks to U.S. businesses that
operate in mainland China, this recent aggressive posture by
Beijing is precipitating new risks and consequences to U.S.
businesses operating in Hong Kong as well, particularly in
light of the most recent nature of threatened U.S. response.
CHINA'S CYBERSECURITY AND ENTITIES LAWS
Beginning Dec. 1, 2019, this new law made all computer
servers in China open to surveillance and data mining by
the Chinese government. The combination of this new law
with the new Chinese Foreign Vested Entities Law expands
Beijing's surveillance capability and authority to all businesses and individuals in mainland China. This latter law
removed the status difference previously enjoyed by U.S.
and other foreign-owned companies (including subsidiaries
and joint ventures) and made them subject to the same legal
requirements as Chinese-owned companies.
The combined impact of these two new laws redefines
personal and business life in Hong Kong. It strongly
suggests that U.S. and other foreign businesses in Hong
Kong will be required to allow Communist Party representation in board meetings and management meetings. It also
implies that all businesses and individuals must reveal all
information requested to inquiring authorities, even if it is
otherwise confidential.
In addition, all IT servers of U.S. and other foreign
businesses may become subject to search (on-site or

AUGUST 2020

| COMPOUNDINGS | ILMA.ORG

remotely) without notice. Because the cybersecurity law
permits government surveillance at the Chinese server level,
this necessarily jeopardizes the security of information
maintained outside of mainland China that has connectivity
with servers located in mainland China. With these recent
developments by Beijing extending its jurisdictional authority to include Hong Kong, the risks associated with these
new laws inherently expand to U.S. and foreign businesses
(and individuals) located in Hong Kong.
Similarly, the risks mentioned above are likely to include
the presence of mainland Chinese- and Hong Kong-owned
business locations that are situated outside of mainland China
or Hong Kong. Consequently, anyone engaged in business
transactions with Chinese or Hong Kong businesses could
face downstream risk concerning their data security.
NEW U.S. SANCTIONS RISKS
In response to Beijing's recent extension of authority over
Hong Kong, the U.S. is responding by systematically
eliminating Hong Kong's special status under U.S. law.
Defense exports to Hong Kong have been interrupted, and
Hong Kong's access to U.S. high-technology products is
now blocked. For instance, the U.S. Commerce Department
will no longer grant export license exceptions for controlled
goods intended for Hong Kong. It also appears that the sale
of all dual-use technologies and commodities to Hong Kong
businesses will be prohibited.
Also, U.S. sanctions that currently apply against China
are very likely to be applied to Hong Kong due to the
erosion of the jurisdictional separation. Be aware that the
path this could take might not involve promulgation of a
new sanction against Hong Kong. Instead, U.S. authorities
simply interpret that current U.S. sanctions against China
also apply to Hong Kong. Either way, keep in mind that
each U.S. sanction against China imposes severe penalties
on violators, but the more recent sanctions that respond to
the exportation (including unintentional) of U.S. intellectual property are particularly severe - imposing fines of up
to $1 million and imprisonment of 20 years, per violation.

http://www.ILMA.ORG

ILMA Compoundings - August 2020

Table of Contents for the Digital Edition of ILMA Compoundings - August 2020