Guest post by Dr Sagi Peari, Senior Lecturer/Associate Professor at the University of Western Australia

When it comes to the question of the applicable law that governs disputes involving corporations: one must make a sharp distinction between two principal matters: (1) matters relating to external interactions of corporation (such as disputes between a corporation and other external actors, such as other business entities or individuals); and (2) matters relating to the internal interactions of a corporation (such as disputes within the corporate structure or  litigation between a corporation and its directors). A claim of a corporation against another in relation to a breach of contract between the two is an example of a dispute related to external affairs of a corporation. A claim of a corporate shareholder against a director in the firm is an example of a dispute concerning corporate internal affairs.

The division between external and internal affairs of corporation is an important one for the question of applicable law. A review of the case law suggests a strong tendency of the courts to apply the same choice-of-law rules applicable to private individuals. Thus, the general rule of the place of tort applies equally to corporations and private individuals.[1] In similar, the advancing principle of party autonomy[2] does not distinguish between corporations and other litigants on its operational level. The very fact that litigation involves a corporation does not seem prima facie to affect the identity of the applicable law rules.

The situation becomes dramatically different in cases concerning the internal affairs of a corporation. These are the situations involving claims between the corporate actors (i.e. executives, shareholders and directors) and claims between those actors and the corporation itself. Here, different considerations seem to apply. First, internal affairs of corporations tend to be excluded by the various international statutes aiming to harmonise the applicable law rules.[3] Second, there is a clear tendency of the rules to adhere to a single connecting factor (such as the place of incorporation or corporate headquarters with some further constitutional implications[4]) to determine the question of the applicable law. Thirdly, there is a clear tendency of rejecting the party autonomy principle in this sphere according to which  corporate actors are not free to determine the applicable law to govern their dispute.[5]

One of the neglected frameworks for addressing the external/internal affairs distinction relates to the classical corporate law theory on the nature of corporations and the relationships within the corporate structure. Thus, the classical vision of corporations perceives a corporation as an artificial entity that places the state at the very centre of the corporate creation, existence and activity.[6] Another, perhaps contradictory vision, challenges the artificial nature of corporation. It views corporation as an independent moral actor what dissects its existence from the originating act of incorporation.[7] Lastly, the third vision of corporation evaluates the corporate existence from the internal point of view by focusing on the bundle/nexus of contracts within the corporate structure.[8]

One could argue that an exercise of tackling the various theories of corporations could provide an invaluable tool for a better understanding of the internal/external division and subsequently shed light on the question of applicable law rules. Thus, for example, the traditional insistence of choice-of-law to equalise between corporations and private individuals seems to correlate with the ‘personality’ vision of corporation. On a related note, the insistence of the choice-of-law doctrine on a single connecting factor that denies party autonomy seems to be at odds with the nexus-contract theory and aligns with the traditional artificial entity theory of the corporation.

From this perspective, placing this question within the conceptual framework of corporate law could enable us to grasp the paradigmatic nature of the division and contemplate on whether the various suggestions for reform in the area of choice-of-law rules applicable to corporations do not just correlate with the underlying concerns and rationales of private international law/conflict of laws, but also those of corporate law.

I have tackled these (and other) matters in my recent article published in the 45 (3) Delaware Journal of Corporate Law 469-530 (2021) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3905751.

[1] See eg Regulation 864/2007, on the Law Applicable to Non-Contractual Obligations (Rome II), 2007 O.J. (L 199) 40 (EC), art 4 (1).

[2] See eg Hague Principles on Choice of Law in International Commercial Contracts, 2015.

[3] See eg Regulation 864/2007, on the Law Applicable to Non-Contractual Obligations (Rome II), 2007 O.J. (L 199) 40 (EC), art 1 (2) (f).

[4] See eg Case C-212/97, Centros Ltd. v. Erhvervs-og Selskabsstyrelsen, 1999 E.C.R. I-1459, 2 C.M.L.R. 551 (1999).

[5] See eg Hague Principles, Commentaries, 1.27-1.29.

[6] See eg Dartmauth College v Woodward 17 U.S. 518, 636 (1819)

[7] See eg Peter A French, ‘Responsibility and the Moral Role of Corporate Entities’, in Business as Humanity (Thomas J Donaldson and RE Freeman eds, 1994) 90.

[8] Of course, the distinction between the above-mentioned three theories is not sharp and variations and overlaps have been suggested over the years in the corporate law literature.

Written by Huiying Zhang, PhD Candidate at the Wuhan University Institute of International Law

China enacted the Personal Information Protection Law (PIPL) at the 30th Session of the Standing Committee of the 13th National People’s Congress on August 20, 2021. This is the first comprehensive national law in China concerning personal information protection and regulating the data processing activities of entities and individuals. PIPL, the Cyber Security Law (came into force on June 1, 2017) and Data Security Law (promulgated on September 1, 2021) constitute the three legal pillars of the digital economy era in China.

PIPL includes eight chapters and 74 articles, covering General Provisions, Rules for Processing Personal Information, Rules for Cross-border Provisions of Personal Information, Rights of Individuals in Activities of Processing Personal Information, Obligations of Personal Information Processors, Departments Performing Duties of Personal Information Protection, Legal Liability and Supplementary Provisions. This note focuses on its extraterritorial effect.

1.Territorial Scope

Article 3 of the PIPL provides:

“This Law shall apply to activities conducted by organizations and individuals to control the personal information of natural persons within the territory of the People’s Republic of China.

This Law shall also apply to activities outside territory of the People”s Republic of China to handle the personal information of natural persons within the territory of the People’s Republic of China under any of the following circumstances:

a . personal information handling is to serve the purpose of providing products or services for natural persons within the territory of the People’s Republic of China;

1. personal information handling is to serve the purpose of analyzing and evaluating the behaviors of natural persons within the territory of the People’ s Republic of China; or
2. having other circumstances as stipulated by laws and administrative regulations.”

According to paragraph 1 of Art 3, PIPL applies to all data processing activities of personal information carried out in China. If foreign businesses processes or handles the personal information within the territory of China, in principle, they shall comply with the PIPL. It indicates that this clause focuses on the activities of processing or handling personal information in the territorial of China, especially the physical link between the data processing or handling activities and Chinese territory.

According to paragraph 2 of Art 3, the PIPL shall be applicable to activities outside the territory of China in processing or handling the personal information within China under some circumstances. As provided in Art 53, “personal information handlers outside the borders of the People’ s Republic of China shall establish a dedicated entity or appoint a representative within the borders of the People’ s Republic of China to be responsible for matters related to the personal information they handle”. Notably, this clause focuses on the physical location of the data processors or handlers rather than their nationality or habitual residence.

PIPL has extraterritorial jurisdiction to data processing or handling activities outside the territorial of China under 3 circumstances as provided in paragraph 2 of Art 3 of the PIPL. This is the embodiment of the effect principle, which derives from the objective territory jurisdiction and emphasizes the influence or effect of the behavior in the domain. If the purpose is to provide products or services to individuals located in China, or to analyze the behaviors of natural person in China, the PIPL shall be applicable. Crucially, the actual “effect” or “influence” of data processing or handling is emphasized here, i.e. when it is necessary to determine what extent or what requirements are met of the damage caused by the above-mentioned data processing or handling activities outside the territorial of China, Chinese courts may reasonably exercise the jurisdiction over the case. Obviously, it reflects the consideration of the element of “brunt of harm”. However, if the “effect” or “influence” is not specifically defined and limited, there will be a lot of problems. It is important to figure out exactly whether data processors or handlers outside the territorial of China are aware of the implications of their actions on natural person within China and whether the “effect” or “influence” of the data-processing behaviors are direct, intentional and predictable.

The PIPL explicitly states its purported extraterritorial jurisdiction for the first time and insists on the specific personal jurisdiction and the effect principle. It is mainly because the PIPL is formulated “in order to protect personal information rights and interests, standardize personal information handling activities, and promote the rational use of personal information”, but in the process of legal protection of personal information of natural person, there are a lot of challenges, such as the contradiction between the application of traditional jurisdiction, the virtual nature of personal information and so on. In this sense, all jurisdiction of the PIPL, whether territorial jurisdiction or personal jurisdiction or effect principle, are all further supplements for the existing personal information protection regime previously provided.

2.PIPL and GDPR: a Comparative Study

The provisions on jurisdiction of GDPR are mainly concentrated in Art 3 and Art 23, 24, 25, 26, 27 of preambular 2. In Art 3, paragraph 1 and 2 identified “establishment principle” and “targeting principle” and paragraph 3 provides “This regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law”.

A. Establishment Principle

Under paragraph 1 of Art 3, GDPR applies to “the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.” It set the “establishment criterion”, which has the dual characteristics of territorial jurisdiction and extraterritorial jurisdiction.

Compared with establishment criterion in GDPR, the PIPL indicates that personal information handlers outside the territorial of China shall establish a dedicated entity or appoint a representative within China as previously mentioned. It highlights the significance and necessity of establishing an entity when foreign data handlers process the personal information of national persons outside China under circumstance in paragraph 2 of Art3 of PIPL.

B. Targeting Principle

Compared with targeting criterion in GDPR, PIPL has many differences. Paragraph 2 of Art 3 of the GDPR clearly states that for data processors and controllers that do not have an establishment in the EU, GDPR will apply in two circumstances. Firstly, as stated in Art 3 of GDPR, the processing activities relate to “the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union” (Art 2 GDPR). It seems too abstract to give the definition and processing method of data processor and controller’ s behavior intention. Art 23 of the GDPR provides the clarification that “it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.” The key factor to assess whether the processor or controller “targets” the EU is whether the behaviour of the offshore data processors or controllers indicates their apparent intention to provide goods or services to data subjects in the EU. This is an objective subjective test.

In contrast, Art 3 of the PIPL states that the law shall apply when the data processor processes personal information “to serve the purpose of providing products or services for natural persons within the territory of the People’ s Republic of China”. It indicates that the purpose of data processor or controller outside China is to provide a product or service to a domestic natural person in China. The key to the application is not only about whether it has purpose, but also about whether they have processed personal information of a natural person in China.

Secondly, the procession activities are in related to “the monitoring of their behaviour as far as their behaviour takes place within the Union”. It requires both the data subject and the monitored activity be located within the EU. “Monitoring” shall be defined in accordance with Article 24 of the GDPR preamble. This provision does not require the data processors or controllers to have a corresponding subjective intent in the monitoring activity, but the European Data Protection Board ( Hereinafter referred to as EDPB) pointed out that the use of the term “monitoring” implied that the data controllers or processors had a specific purpose, namely to collect and process the data. Similarly, Art 3 of the PIPL also applies to activities outside China dealing with personal information of natural persons within China, if the activities are to analyse and evaluate the acts of natural persons within China. The meaning of “analysis and evaluation” here is very broad and seems to cover “monitoring” activities under the GDPR.

Furthermore, paragraph 3 of Art 3 of the GDPR provides: “This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.” It suggests that the data processor or controller does not have an establishment in the territory of the EU and there is no circumstances under paragraph 2 of Art 3 of the GDPR. Due to that the international law applies EU member state law in the area where the numerical controller is located, this law shall apply. This condition is primarily aimed at resolving the issue of extraterritorial jurisdiction over data processing or controlling that takes place in EU without an establishment. This condition is similar to Directive 95/46 of the European Parliament and the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The similar condition is not included in the PIPL, which instead shall apply to other circumstances “as stipulated by laws and administrative regulations”.

C. Passive personality principle

Under the passive personality principle, a state has prescriptive jurisdiction over anyone anywhere who injures its nationals or residents. As previously mentioned, paragraph 2 of Art 3 of the GDPR states that although the personal data processors or controllers are not established in the EU, EU still applies the laws of member states in accordance with public international law. Art 25 of the preamble of GDPR provides examples of such situations which may include a Member State’s diplomatic mission or consular post.

To some extent, GDPR includes all the personal data processing activities involving natural persons situated in the EU area into its jurisdiction, which is a variation of the passive nationality principle. It is because EU treats the individual data right as a fundamental human right and aims to establish a digital market of the unified level of protection. PIPL adopts the similar practice by adopting the passive nationality principle to protect Chinese citizens and residents.

3.Conclusion

The promulgation of PIPL shows that China recognizes the extraterritorial effect of data protection law. The exploration of legislation not only has the meaning of localization, but also contributes to the formulation of data rules for the international community. It marks an important step towards China’ s long-term goal of balancing the preservation of national sovereignty, the protection of individual rights and the free flow of data across borders.