On February 6, 2015, the U.S. Securities and Exchange Commission (SEC) imposed sanctions against four China-based accounting firms for their refusal to surrender documents in conjunction with an investigation of potential accounting fraud and corruption in China.  These sanctions highlight the intensifying challenges multinational companies face when asked to participate in U.S. discovery of data stored in China, and emphasize the increasing importance of creative but sound solutions for dealing with U.S. discovery obligations in China.

Background

In the matter In re BDO China Dahua CPA Co., Ltd., an SEC administrative law judge (ALJ) found that Deloitte Touche Tohmatsu Certified Public Accountants Limited, Ernst & Young Hua Ming LLP, KPMG Huazhen (Special General Partnership) and PricewaterhouseCoopers Zhong Tian CPAs Limited Company violated Section 106 of the Sarbanes-Oxley Act by willfully refusing to surrender documents to the SEC.  The SEC had requested China-based documents from the four accounting firms in conjunction with an investigation into nine Chinese companies that held U.S.-based securities.  The firms refused to comply with the document requests on the grounds that Chinese laws prevented the production of the requested documents to the SEC.  The SEC instituted public administrative proceedings against each of the firms, in turn leading the ALJ to sanction the firms.  The firms settled with the SEC by agreeing to pay $500,000 and admitted that they did not produce documents prior to the commencement of the proceedings in 2012.  The SEC retained authority to impose additional remedial measures on the firms if future document productions fail to meet specified criteria, including an automatic six-month bar on a single firm’s performance of specific audit work, commencement of a new proceeding or the resumption of the current proceeding.

U.S. Discovery of Foreign Accounting Firms

The Sarbanes-Oxley Act of 2002 requires public accounting firms to provide audit workpapers and related documents to the SEC upon request.  Section 106(b)(1), as amended by Dodd-Frank in 2010, governs the production of audit workpapers by foreign firms, stating,

If a foreign public accounting firm issues an opinion or otherwise performs material services upon which a registered public accounting firm relies in issuing all or part of any audit report or any opinion contained in an audit report, that foreign public accounting firm shall be deemed to have consented to produce its audit workpapers for the Board or the Commission in connection with any investigation by either body with respect to that audit report and to be subject to the jurisdiction of the courts of the United States for purposes of enforcement of any request for production of such workpapers.

The SEC’s ability to obtain foreign firms’ workpapers is an essential component of fraud and corruption investigations.  In reaction to the sanctions, the director of the SEC’s Enforcement Division stated that “obtaining an audit firm’s workpapers is critical to enforcement staff’s ability [to] adequately protect investors from the dangers of accounting fraud.”

China’s Data Protection and Secrecy Landscape

There is no single or overarching law governing the protection of electronic data in China.  Multinational companies are left to piece together a data protection regime from various authorities throughout the country, including the following three regulations:

• The 2012 Decision on Strengthening Online Information Protection prohibits companies and individuals from improperly obtaining, selling or providing personal digital information, and obliges certain types of entities to collect, use, preserve, manage and otherwise handle personal data in accordance with specific principles.  

• The Law of the People’s Republic of China on Guarding State Secrets, formulated “for the purpose of guarding state secrets, safeguarding state security and national interests and ensuring progress of reform, of opening to the outside world, and of socialist construction,” defines state secrets as “matters that have a vital bearing on state security and national interests and, as specified by legal procedure, are entrusted to a limited number of people for a given period of time.”  This law sets out six categories of state secrets, and also includes a seventh ambiguous catch-all category defined as “other matters that are classified as state secrets by the state secret-guarding department,” giving Chinese enforcement authorities broad discretion to define what information constitutes a state secret. 

• The State Security Law of the People’s Republic of China provides that “[a]ny organization or individual that has committed any act endangering the State security of the People’s Republic of China shall be prosecuted according to law.”  The law defines “acts endangering State security” to include actions such as “stealing, secretly gathering, buying, or unlawfully providing State secrets.”  Intentional and negligent violations of this law could result in criminal prosecution or other disciplinary sanctions.

The Right Solution

There is an obvious conflict between a need in the United States to receive information and China’s desire to protect it.  Navigating U.S.-driven discovery of Chinese entities is a complex endeavor that invariably involves questions surrounding the transfer of data from China.  Many companies deal with U.S. discovery obligations by simply moving large tranches of data from China to the United States for the review and production of that information.  Others, such as the four accounting firms in this case, take the opposite approach and categorically refuse to produce any documents altogether.  Neither end of the spectrum is effective.  The right solution in any particular case typically focuses on a defensible process that involves the collection, processing and analysis of documents by Chinese-qualified lawyers through the use of a secure Chinese environment in order to identify which data can be transferred from China to the United States.  A combined U.S.-China team of lawyers and technology professionals who are well versed in both Chinese data protection laws and U.S. discovery requirements can help guide multinational companies safely through the complicated process that led to the significant sanctions recently imposed on the four accounting firms involved in the In re BDO China Dahua CPA Co., Ltd., matter.