No Easy Way Out for Social Media Companies Under the New Hong Kong National Security Law

By Lauren Maranto –

Hong Kong’s new national security law has left U.S. social media companies operating in Hong Kong with a difficult choice: Surrender user data as prescribed by law, potentially endangering their users’ privacy and freedom, or risk prosecution by protecting free speech on their platform in defiance of the law. Although some companies have temporarily halted processing data requests from the Hong Kong government, they will soon need to take more decisive measures to avoid prosecution. That being said, there does not seem to be a sustainable “happy medium” in this case, leaving these large companies to decide between a potential loss of business in the Chinese market or aiding authorities in convicting Hong Kong residents, and beyond, under the new law.
 
Tensions surrounding Hong Kong have spiked in the past year, following the announcement of Hong Kong’s Extradition Bill in April 2019. Critics of the bill claimed that it reduces Hong Kong’s autonomy and would be used to target pro-democracy advocates. The bill was eventually withdrawn, but the protests had already expanded in scope to focus on larger demands for autonomy and democracy. In order to quash dissent, the new national security law was enacted on June 30, 2020.
 
The law is both broad in scope and far-reaching in its coverage. Individuals can be prosecuted if they are suspected of acts of secession, subversion, terrorism, or collusion. Although this covers a broad array of activities, it most notably targets those who have participated in widespread protests or have expressed pro-democracy values. In response to fears confirmed by the arrests of popular pro-democracy advocates and lawmakers, many have turned to self-censorship, deleting social media posts and even de-activating accounts that may have been used to express contradictory political views.
 
The far reach of the law, as stated under Article 38, means anyone can be charged regardless of their location or residency. Furthermore, the law does not only apply to individuals. Companies can be charged under Article 31, which states that “an incorporated or unincorporated body such as a company or an organization which commits an offence under this Law shall be imposed with a criminal fine,” and that a convicted company shall face suspension or withdrawal of its license. Repercussions depend on the offense and severity, but include a minimum prison sentence of three years for individuals, sometimes with an added criminal fine, with potential to be reduced for minor offenses or by complete cooperation (including voluntary surrender and reporting other offenders). Conviction under the law does not require direct violation of the law, instead extending to be an accomplice of any of the previously listed charges. By not complying with demands for user data in investigations, social media companies face large fines or employee arrests. In this context, U.S.-based media companies must all grapple with the question of how to strike an appropriate balance between compliance with the law and protection of customer privacy.
 
Following the implementation of the law, large U.S. social media companies with operations in Hong Kong, including Facebook, Twitter, and LinkedIn, announced a pause in processing data requests from Hong Kong officials. This meant that, for the time being, they would delay requests by the government for consumer information and protect users from having their social media accounts used against them under the new law.
 
As tech companies struggle to navigate the national security law and find the least harmful path for business, additional account security could alleviate some of the pressure on users. Facebook provides account security measures that help secure social media accounts from the police. One such feature is support for a trusted legal administrator who can maintain, and if necessary, deactivate, a user’s account following an arrest.
 
Where Facebook has sought a subtle path through and around the law, Twitter has done little more than provide general guidance, emphasizing its commitment to “working with governments around the world to encourage healthy behavior on the platform, and exercised due diligence to respect local laws”, while adding that the company leans towards freedom of expression “within the parameters of the law.”
 
Google has taken a small step further than Twitter and Facebook, informing Hong Kong authorities it will no longer directly respond to data requests, but will instead process requests through a Mutual Legal Assistance Treaty with the United States. Initially signed in 1997, this agreement states that Hong Kong and the United States will provide mutual assistance in the investigation, prosecution and prevention of criminal offenses as determined each respective party’s Attorney General. This lengthens and complicates the process whereby Hong Kong authorities obtain information, while also removing some of Google’s compliance burden by placing the ultimate decision in the hands of the Attorney General’s office, which retains the power to decline requests for assistance as permitted within the treaty. Shortly after, however, China’s Foreign Ministry announced that Hong Kong will suspend the Mutual Legal Assistance agreement with the U.S., leaving Google’s path unclear.
 
Regardless of the path or method, these tactics only delay more decisive measures. In order to avoid prosecution, companies will soon need to enact more decisive policies, as their current actions leave them susceptible to fines and employee arrests. That being said, there is no easy way out of this.
 
Facing potential prosecution under the new law, social media companies must quickly adopt new policies. Unable to indefinitely forestall data requests, the paths forward are limited, and all could detrimentally affect business. Three general paths forward, and their associated implications, are as follows:
 

1. Social media companies continue to avoid processing data requests.
2. Social media companies comply with the law in order to maintain their position in the Chinese market.
3. China 2.0- Tech companies withdraw from Hong Kong

 
Under the first scenario, the companies would continue to face potential fines and arrests with increased pressure from authorities to provide user data. The current hold on data sharing is not sustainable, and authorities will begin to crack down on companies that do not provide them with the requested information, leading to fines and a minimum of 3 years in prison for company employees or executives, with the potential for a shorter sentence if the case is deemed a minor offense. However, there is potential to take this one step forward in this scenario, enacting specific policies that may protect users and companies from data requests and the consequential penalty under the law. One example of this was enacted by Yahoo. The well-known U.S. internet browsing company changed its terms of service in July to address Hong Kong users under U.S. laws rather than local rules and restrict access for employees in Hong Kong to user data in order to protect them from prosecution under the law. That being said, it is unclear how Hong Kong authorities would react to such policies if enacted on major social media such as Facebook and Twitter.
 
Option two offers a polarized approach: Ignore the obligation to protect user data in Hong Kong in order to preserve business operations. A significant drop off of users is likely. Many who wish to stay online but attempt to evade police criticism have turned to VPNs, though some VPN companies have begun to remove servers from Hong Kong. This option would also contradict the current U.S. administration’s condemnation of the law and would likely lead to criticism and skepticism on the U.S. side, both by the government, and by those who support the pro-democracy movement in Hong Kong from afar.
 
This leads to the third option. Social media companies could withdraw service from Hong Kong, just as many have in mainland China. For users, this would create a relationship very similar to that of the tech-companies in China, with no direct service in Hong Kong, leaving users located in Hong Kong to either terminate their accounts or rely on a VPN for access. This could be the safest bet in terms of liability for both users and the tech-companies, but at a cost. Although Hong Kong is not a major market for companies such as Facebook and Twitter, they could face significant losses by completely withdrawing from the Chinese market. Reuters reported that Facebook sells more than $5 billion worth of ad space per year to Chinese businesses and government agencies, making China Facebook’s second largest country for revenue. Withdrawing from Hong Kong could further separate Facebook and other social media giants from the Chinese market, with the potential to leave a substantial financial dent. That being said, Facebook has found ways to remain in this critical market, continuing to sell ad space to China based businesses. The understanding that these U.S. based social media companies have found ways to work with and around China, despite the lack of users within mainland China, shows that the same may be a viable solution for the new Hong Kong regulations, even if it may not be ideal.
 
Though social media was once an outlet for individuals and groups to express their free and often political opinions, the law casts a shadow for social media policies similar to that of mainland China. The new national security law may just be a breaking point for the “one country, two systems” model, as increased censorship brings Hong Kong closer to a mainland China way of life. The wedge being driven between social media companies and users in Hong Kong is merely another example of how relations between the U.S. and Hong Kong will continue to change in the wake of the new national security law. It is unclear as to how significant the financial repercussions will be for social media companies that have grown accustom to business in Hong Kong, or whether they are willing to sacrifice data privacy to maintain a presence in Hong Kong. One thing is for sure- the current approach of staving off data requests from Hong Kong authorities is not sustainable. Tech-giants will need to enact specific policies that will protect users and themselves from the new national security law or remove themselves from service in Hong Kong. As Beijing continues to tighten its grip on Hong Kong, it may time for U.S. based social media companies to start viewing Hong Kong more like mainland China.
 

Lauren Maranto is program coordinator for Freeman Chair in China Studies at CSIS.