Introduction

In our previous issue of China Law newsletter in June 2020, we discussed the basics of the National Security Law of the People’s Republic of China (the “PRC”) and some court cases relevant to the potential risks for businesses. The Law of the People’s Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region (the “Hong Kong National Security Law”) was passed by the Standing Committee of the National People’s Congress on 30 June 2020 and came into effect on the same day. This article will focus on the urging needs of corporations to understand and ensure compliance with the new law.

Summary of the Hong Kong National Security Law

The Hong Kong National Security Law provides for four major areas of offences, namely secession, subversion, terrorist activities and collusion with foreign forces, which are all punishable with a minimum sentence of 3 years and a maximum of life imprisonment.

Secession

Under Article 20, it is an offence to (i) separate the Hong Kong Special Administrative Region (the “HKSAR”) or any other part of the PRC from the PRC, (ii) to alter the legal status of the HKSAR or any other part of the PRC, or (iii) surrender the HKSAR or any other part of the PRC to a country other than the PRC, whether or not by force or threat of force, with a view to committing secession or undermining national unification. Article 21 further provides that inciting, assisting, abetting or providing pecuniary or other financial assistance or property for the commission of secession is also an offence. Depending on the level of involvement, penalties for secession include life imprisonment, fixed-term imprisonment, short-term detention or restriction.

Subversion

Under Article 22, it is an offence to organise, plan, commit or participate in (i) overthrowing or undermining the basic system of the PRC, (ii) overthrowing the body of central power of the PRC or the HKSAR, (iii) seriously interfering in, disrupting, or undermining the performance of duties and functions in accordance with the law by the body of central power of the PRC or the body of power of Hong Kong, or (iv) attacking or damaging the premises and facilities used by the body of power of the HKSAR to perform its duties and functions, rendering it incapable of performing its normal duties and functions, by force or threat of force or other unlawful means with a view to subverting the state power. Article 23 further provides that inciting, assisting, abetting or providing pecuniary or other financial assistance or property for the commission of subversion is also an offence. Depending on the level of involvement, penalties for secession include life imprisonment, fixed-term imprisonment, short-term detention or restriction.

Terrorist activities

Article 24 provides that terrorist activities include (i) serious violence against a person or persons, (ii) explosion, arson, or dissemination of poisonous or radioactive substances, pathogens of infectious diseases or other substances, (iii) sabotage of means of transport, transport facilities, electric power or gas facilities, or other combustible or explosive facilities, (iv) serious interruption or sabotage of electronic control systems for providing and managing public services such as water, electric power, gas, transport, telecommunications and the internet, or (v) other dangerous activities which seriously jeopardise public health, safety or security, where the activity was one that causes or intended to cause grave harm to the society with a view to coercing the Central People’s Government, the Government of the HKSAR or an international organization or intimidating the public in order to pursue political agenda. Article 25 further defines a “terrorist organisation” as an organisation that commits, intends to commit, participates in or assists in the commission of terrorist activities. A person who organises or takes charge of a “terrorist organisation” shall be guilty of an offence under Article 25 too. Article 26 provides that, inter alia, the provision of support, assistance or facilities to a terrorist organisation or a terrorist is also an offence. Likewise, advocating terrorism or inciting the commission of a terrorist activity contravenes Article 27. Depending on the level of involvement and the consequences caused, penalties for terrorist activities include life imprisonment, fixed-term imprisonment, short-term detention, restriction, fines or confiscation of properties.

Collusion with foreign forces

It is an offence under Article 29 to steal, spy, obtain by payment or unlawfully provide state secrets or intelligence concerning national security for a foreign country, or an institution, organisation or individual outside the PRC, the HKSAR or the Macau Special Administrative Region (an “External Element”). It is also an offence under the same Article to request, conspire with, or directly or indirectly receive instructions, control, funding or other kinds of support from a foreign country or an External Element to (i) wage a war against the PRC, or use or threaten to use force to seriously undermine the sovereignty, unification and territorial integrity of the PRC, (ii) seriously disrupt the formulation and implementation of laws or policies by the HKSAR Government or the Central People’s Government, which is likely to cause serious consequences, (iii) rig or undermine an election in the HKSAR, which is likely to cause serious consequences, (iv) impose sanctions or blockade, or engage in other hostile activities against the HKSAR or the PRC, or (v) provoke by unlawful means hatred among Hong Kong residents towards the HKSAR government or the Central People’s Government, which is likely to cause serious consequences. The External Element involved shall also be convicted and punished for the same offence. Depending on the level of involvement, penalties for collusion with foreign forces include life imprisonment and fixed-term imprisonment.

How does the Hong Kong National Security Law compare with
 equivalent laws of other common law jurisdictions?

It is noted that the Hong Kong National Security Law (as part of the national laws that apply in the HKSAR) is unique as it is implemented under the framework of “One Country, Two Systems” and cannot be directly compared with the national security laws of other common law jurisdictions. However, for the purpose of assessing the scope of the Hong Kong National Security Law, we believe it is still useful to compare it with the equivalent laws of the United States, the United Kingdom, Australia and Singapore:

It appears that the Hong Kong National Security Law criminalises activities that other common law jurisdictions also criminalises in their laws.

However, given the “One Country, Two Systems” policy and the HKSAR’s status of a local administrative region of the PRC, Article 55 provides that the Office for Safeguarding National Security of the Central People’s Government in the Hong Kong Special Administrative Region shall, upon approval by the Central People’s Government of a request made by the Government of the Hong Kong Special Administrative Region or by the Office itself, exercise jurisdiction over a case concerning offence endangering national security under the Hong Kong National Security Law, if (i) the case is complex due to the involvement of a foreign country or external elements, thus making it difficult for the Region to exercise jurisdiction over the case; (ii) a serious situation occurs where the Government of the Region is unable to effectively enforce the Hong Kong National Security Law; or (iii) a major and imminent threat to national security has occurred. This is one of the aspects which distinguishes the new Hong Kong National Security Law as the Central People’s Government can proactively and directly exercise jurisdiction over certain cases in Hong Kong which, had they occurred after the handover of Hong Kong from the United Kingdom to the PRC but before the coming into operation of the Hong Kong National Security Law, would have been adjudicated in Hong Kong locally.

As mentioned above, most states in the United States have provisions governing treason in their constitutions or statutes similar to those in the Constitution of the United States. A single act by a citizen of the United States could be treason against (i) the United States only; (ii) a single state only; or (iii) the United States and a single state. Individual states can enforce their own penal laws so long as it does not interfere with the powers granted exclusively to the federal government. The state court would have jurisdiction over (ii) and (iii), but not over treasonous acts that involve the United States only. This is reflective of the federal system of the United States in which states exercise authority over all criminal matters except those that are granted to the federal government under the Constitution. Article 55 of the Hong Kong National Security Law is different in the sense that a single act in Hong Kong could violate the Hong Kong National Security Law only but the Central People’s Government can exercise jurisdiction over the case.

Implications for corporate compliance

It is noteworthy that Article 38 of the Hong Kong National Security Law states that the Hong Kong National Security Law is applicable to every individual, including those outside of and not from Hong Kong. When carrying out business activities both in and outside the HKSAR, corporations should review their business processes and pay due regard to the pecuniary or other financial assistance or property they provide to others and ensure that such assistance will not be regarded as assistance with acts and/or activities endangering national security. Any such assistance for the commission by others of secession and subversion are offences under Articles 21 and 23. Likewise, providing support, assistance or facility such as training, weapons, information, funds, supplies, labour, transport, technologies or venues to a terrorist organisation or a terrorist, or for the commission of a terrorist activity; or manufactures or illegally possesses hazardous substances or uses other means to prepare for the commission of a terrorist activity constitutes an offence under Article 26. In fact, as per Article 31, both incorporated and unincorporated bodies, including companies and organisations, could be held liable under the Hong Kong National Security Law. Conviction may lead to (i) fines, (ii) suspension of operations, (iii) revocation of business licenses, and/or (iv) confiscation of unlawful proceeds, funds and tools used or intended to be used in the commission of the offences, according to Article 32. There is an uncertainty as to how Article 31 is to be enforced, as in general under Hong Kong law companies and organisations do not automatically lose their business registration and/or incorporation status upon a judicial finding of involvement in a criminal activity, without involving a separate and administrative process.

Not only corporations could be held liable under the Hong Kong National Security Law, but also the individuals working at those corporations, especially directors and employees of higher ranks. It is noteworthy that the national security laws of the United States, the United Kingdom, Australia and Singapore impose liabilities on “any person” or “whoever” conducting the criminal act in question, the concept of which includes both natural persons and juridical persons such as corporations. As such, it is unlikely that persons involved in a corporation’s commitment of the offences under the respective national security laws of either Hong Kong or the four abovementioned jurisdictions will be exempted from criminal liability. After all, corporations are merely the vehicles through which their employees engage in conduct that might contravene the relevant criminal provisions.

Even where some corporations consider their risk of being prosecuted under the Hong Kong National Security Law to be remote due to the nature of their businesses or otherwise, they are also reminded that under the Implementation Rules for Article 43 of the Hong Kong National Security Law (the “Implementation Rules”), the police may require service providers to provide relevant identification records or decryption assistance. Any service provider who fails to comply with the requests is liable upon conviction to a fine of HK$100,000 and six months of imprisonment. This further makes understanding the scope and effects of the Hong Kong National Security Law of paramount importance to corporations in Hong Kong.

For illustration purposes, below are various risks faced by corporates in different sectors operating in Hong Kong (and the employees thereof) after the Hong Kong National Security Law has come into effect.

Data centres and technology companies

As stated above, it is an offence under Article 29 to steal or provide state secrets or intelligence concerning national security for an External Element. Where the data stored and processed by these data centres contain sensitive information relating to state secrets or intelligence concerning national security, there is a chance that law enforcement agencies in Hong Kong may request disclosure of the identity of the data recipient pursuant to Schedule 7 of the Implementation Rules. Although the mere fact of storing and processing data is not “stealing” or “providing” state secrets per se, the risk faced by corporates operating data centres and related services is the potential duty to comply with a Court order granted under Schedule 7 of the Implementation Rules, and thereby compromising confidentiality and integrity of the data concerned.

It has become increasingly common for technology companies to receive data requests from the government authorities. Recently, video conferencing platform based in the United States, Zoom, has suspended its compliance with data requests from the Hong Kong authorities, making it clear that it will temporarily refuse to share user data following the enactment of the Hong Kong National Security Law. Similarly, other global communications platforms including Facebook, Twitter, WhatsApp, Telegram and LinkedIn have also suspended their compliance with data requests. Others, including Naver and LINE, have moved their data centres or servers out of Hong Kong. A more fundamental question is: can multinational companies fully comply with the national security laws of different countries without conflicts? This will be discussed in our next newsletter.

Corporations (including financial institutions such as banks)
 dealing with foreign entities

Many businesses have grave concerns over the vagueness of the concept of “foreign forces”, as it is very common for companies in Hong Kong to have dealings with entities abroad, including their foreign head offices and branch offices. They are particularly exposed to risks when, for example, following a sanction instruction from the head office, or just making donations or providing financial support for other organisations with foreign political or governmental backgrounds. When funds flow overseas, it is more likely to be politically sensitive and come under close scrutiny by authorities. Concerns also arise when corporations have interviews with the foreign press. Although mere fund flows to an overseas entity and/or interviews with the foreign press should not attract such scrutiny, particular concerns will arise if politically sensitive persons/entities are involved. Corporations should note that the offences under the Hong Kong National Security Law are separate from and in addition to the existing money laundering and terrorist financing offences in Hong Kong, but in reality the compliance requirements regarding financing and provision of assistance to another is not much different from those required of corporations for combating drug trafficking, terrorism, corruption and organized crime internationally or transnationally.

Recommendations

The above risks or compliance requirements to corporations and the employees thereof also exist in all the abovementioned jurisdictions, including the United States, the United Kingdom, Australia and Singapore. The implementation of the Hong Kong National Security Law is still in its early stage, and not only corporations should take precautionary measures to ensure compliance with the Hong Kong National Security Law, but management personnel and even employees should also take active steps to minimise the risks of being held personally liable. To ensure effective compliance with the Hong Kong National Security Law, we suggest that corporations should build a solid internal compliance system which should include at least (i) setting out clear written internal control policies for handling issues potentially relating to national security for employees to follow; (ii) designating a national security committee and/or officer within the corporation to oversee and handle matters relating to national security; (iii) setting up a reporting system to enable potential issues to be effectively escalated to the designated national security committee and/or officer; and (iv) setting up a whistle-blowing system to prevent and identify the relevant employee who will possibly breach or has potentially breached the Hong Kong National Security Law.

Our legal services include the provision of professional legal advice including due diligence exercise relating to national security and anti-money laundering and anti-corruption review. If you would like to learn more about our services in this regard, please feel free to contact us.

(Acknowledgement: We thank Dr P.Y. Lo, barrister-at-law, for providing valuable insights and comments on an earlier draft of the article. All errors are our own.)