After Reporters without Borders reported that Yahoo had provided the Chinese government with personal information about a customer, journalist Shi Tao, that led to his arrest, Jerry Yang, co-founder of Yahoo, told an Internet conference in Shanghai that Yahoo was simply fulfilling their legal obligations: “The government asked for the documents and backed it up with a court order… We had to hand over the documents. We have to comply with the law.”
On his Chinese Law Prof blog, Donald Clarke disputed this argument. CDT asked Clarke, a professor at the George Washington University Law School, to explain his argument further.
CDT: According to China’s Criminal Procedure Law, any “unit or individual” has the duty, if requested by authorities, to hand over any material evidence that may prove a suspect’s innocence or guilt. Is that a reasonable defense for why Yahoo might have felt compelled to hand over Shi Tao’s information?
DC: Under the facts as we know them so far (and everything I say is subject to this qualification), this defense doesn’t stand up. According to the judgment, the entity that handed over the information is Yahoo Holdings (Hong Kong) Ltd., a Hong Kong company. The Criminal Procedure Law of the PRC does not apply in Hong Kong. Yahoo (I am speaking here of the corporate group as a whole) may well have a good argument that the entity that handed over the information was misleadingly identified in the judgment, and that in reality it was a PRC entity, subject to PRC law, that did so. As far as I know, however, it has not yet made this argument. It has simply stuck to its claim that local subsidiaries have to follow local law — true, but not apparently relevant to this case. Maybe there are facts that would differentiate this case from one in which the US parent handed over information because of pressure on its PRC operations, but given that Yahoo knows the facts better than anyone else, it’s not unreasonable to infer the absence of such facts from Yahoo’s interest in making them public and its failure (again to the best of my knowledge) to do so.
CDT: A recent Business Week article argued that “The authorities went to Yahoo and said they were doing an investigation and needed information — information that Yahoo was legally obliged to provide…. According to comments made by Yahoo co-founder Jerry Yang, the authorities didn’t reveal to Yahoo the allegation or the alleged criminal’s identity.” Do you believe that Yahoo officials have a responsibility to find out the details of a criminal investigation before cooperating with authorities?
DC: I don’t want to come off as a Yahoo-basher because I don’t know all the facts. But this defense, like all the others I have seen, relies for its effect on the use of a general term, “Yahoo”, that obscures precisely the details that matter: *which* Yahoo-affiliated entity was asked to provide the information, and which Yahoo-affiliated entity did so. According to the facts as we know them, and which Yahoo has not contradicted, the scenario about cops arriving at “Yahoo” in Beijing (whatever that means — the US parent has multiple subsidiaries and contractually-affiliated companies in China) and demanding information is misleading in one critical respect: it was Yahoo Holdings (Hong Kong) Ltd., a Hong Kong company, that provided the information. A more accurate scenario is to say, “Suppose the cops phone up Yahoo!, Inc. (the US parent) and threaten Chinese employees in China as well as Yahoo’s China operations if appropriate information is not provided?” A dilemma, certainly, but not a legal obligation as Yahoo!, Inc. has claimed. The fundamental point is this: if Yahoo is saying
that in some circumstances PRC authorities have the *legal authority* to compel Yahoo’s Hong Kong sub to hand over information about users, then they must concede that in some circumstances PRC authorities can compel Yahoo!, Inc., the US parent, to hand over information about users. (Hong Kong is no different from the US for these purposes.) Do they really want to say that?
The argument that information might be sought for socially beneficial purposes — to go after a spammer, for example, or a child molester or terrorist — does not seem relevant to the defense Yahoo has presented. If the holder of the information is legally obliged to provide it, then the purpose doesn’t matter. If the holder is *not* legally obliged to provide the information, then of course we might indeed want Yahoo and other companies to have a policy of cooperation when they determine that the social benefit outweighs the privacy infringement. But we could rightly criticize a policy of handing over information without further inquiry to any governmental authority that asks for it but has no legal authority to compel. In any case, Yahoo is not making this argument; it is arguing that the Yahoo-affiliated entity that handed over the information was legally compelled to do so. This argument has the virtue of simplicity — it requires no difficult weighing of competing values — but until Yahoo chooses to reveal more facts about what actually happened, it still appears that the local law to which the local subsidiary in question is subject is Hong Kong law, not PRC law.
