Guo Wengui / Miles Guo — bankruptcy case · ORDER · ECF #1411

# **UNITED STATES BANKRUPTCY COURT DISTRICT OF CONNECTICUT**

In re:

Chapter 11

HO WAN KWOK, *et al.,* Case No. 22-50073 (JAM)

Debtors. (Jointly Administered)

# **DECLARATION OF GARY J. GAO IN SUPPORT OF UBS AG'S OPPOSITION TO CHAPTER 11 TRUSTEE'S MOTION TO COMPEL**

# **I. Introduction of Declarant**

- I I, GARY GAO, am a lawyer qualified in the People's Republic of China. I am a Senior Partner at Zhong Lun Law Firm, Shanghai Office **("Zhong Lun").** I am also the head of the Compliance and Regulatory Department of Zhong Lun. - 2 I received my LLB degree from the East China Institute of Political Science and Law (Currently: East China University of Political Science and Law) in 1990 and my LLM degree from the University of Hertfordshire in the UK in 2000. - 3 I started my legal career as a clerk in a district comi in Shanghai in 1990 and was subsequently promoted to a criminal judge. I was in those roles for five years. I have been admitted to the PRC Bar Association since 1995. I have been a partner of Zhong Lun since 2014. My practice specializations are government regulatory matters, crossborder corporate compliance and international dispute resolution, and I have practised PRC law for 27 years in the People's Republic of China. My working languages are English and Chinese. - 4 I have been recommended as a leading lawyer by *Legal 500 Asia Pacific* in the area of Regulatory and Compliance for three consecutive years from 2020 to 2022. I have been ranked as Band I by *Chambers Greater China Region Guide 2023* published by Chambers & Partners, a leading international legal research and rating institution. I have

also been listed as an *"A-list Legal Elite"* for the China market for 2022 by *China Business law Journal.* I have received several other awards including *Asia Law Profiles* 2022 Distinguished Practitioner in Compliance, Legal Band "2021 Leading Lawyer in Compliance and Government Affairs", "2020 Leading Lawyer in Compliance and Government Affairs" and "2019 Leading Lawyer in Compliance". You may find more details about my professional accomplishments and recognitions in Annex I (Gary Gao's CV) to my Declaration.

5 Throughout my career, I have advised clients on a number of occasions on cases involving document disclosure in US litigation proceedings and cross-border transfer of data. In recent years, I have also acted as an expert witness in cases involving US litigation proceedings and cross-border transfer of data, including in *BNY Corporate Trustee Services Ltd v Celestial Nutrifoods Ltd* [2014] 4 SLR 331.

## **II. Background**

#### **(I) Purposes of Declaration**

- 6 Ho Wan Kwok **("Kwok")** filed for bankruptcy on 15 February 2022 in the United States Bankruptcy Court, District of Connecticut, Bridgeport Division **("Connecticut Bankruptcy Court").** - 7 The Com1ecticut Bankruptcy Court appointed Luc Despins (the **"Trustee")** Chapter 11 Trustee to K wok's estate. - 8 UBS AG **("UBS"** or the **"Bank")** is a banking financial institution with branches in several jurisdictions including the People's Republic of China. Kwok holds/has previously held several accounts with the Bank via personal investment companies. I have been asked by UBS AG's PRC Branch (the **"PRC Branch")** to provide this Declaration regarding: (i) the PRC laws and regulations relevant to the disclosure and cross-border transfer of financial data ordered in a US court subpoena (the **"Subpoena")** that the Trustee in the above-captioned case served on UBS pursuant to bankruptcy Rule 2004; (ii) the impact of those laws and regulations on the ability of UBS AG's PRC Branch (the **"PRC Branch")** to comply with the Subpoena; and (iii) the alternatives that

could enable the Tmstee to pursue the disclosure he seeks without requiring the PRC Branch to violate PRC laws and regulations.

- 9 Accordingly, this Declaration explains the restrictions imposed by PRC laws and regulations and describes the alternative that would enable the Tmstee to seek disclosure from the PRC Branch without causing a violation of PRC laws and regulations. In particular, this Declaration will describe how the Tmstee could seek the desired disclosure by seeking judicial assistance pursuant to the Convention on the Taking of Evidence Abroad in Civil or Commercial Matters (the **"Hague Evidence Convention").** - IO The opinions expressed in this Declaration are my own, independent opinions. I confirm that in preparing this Declaration, I am aware that my primary duty is to the court and that such duty overrides any obligation I have to the persons from whom I receive my instructions or by whom I am paid.

# **(II) Materials Reviewed**

- 11 In preparation for providing this Declaration, I have developed familiarity with the events culminating in the Trustee's filing of the instant motion to compel UBS to produce certain information and documents to the extent that material exists and is in possession, custody or control of the PRC Branch (the **"Motion to Compel").** In particular, I have reviewed the Subpoena. It is my understanding that, in the Subpoena, the Tmstee has requested that UBS produce, among other materials, information and documents in possession of the PRC Branch relating to various entities and individuals, to the extent such infonnation and documents exist. - 12 Besides the above, I also reviewed the summary of the recognition regime under Chapter 15 of the US Bankruptcy Code.

## **III. Executive Summary**

13 The PRC Branch will not be able to comply with the Subpoena without violating PRC laws and regulations, absent (a) approval of PRC authorities (see Para. 20 to 32 for more details), (b) express consent of any account holder at issue (see Para. 28, 34, 36 for more details) and (c) the release of any other restrictions imposed by PRC laws and

regulations. PRC laws and regulations impose broad restrictions on banks operating in PRC, including the PRC Branch of the Bank, which limit the circumstances in which information and documents relating to accounts at such branches can be disclosed. The laws imposing such restrictions include, but are not limited to, the *Civil Procedure Law of the People's Republic of China* **("PRC Civil Procedure Law"),** *Criminal Law of the People's Republic of China* **("PRC Criminal Law"),** *Data Security Law of the People's Republic of China* **("PRC DSL"),** *Cybersecurity Law of the People's Republic of China* **("PRC CSL"),** *Personal Information Protection Law of the People's Republic of China* **("PRC PIPL"),** *Commercial Banking Law of the People's Republic of China* **("PRC Commercial Banking Law").** There are a range of financial regulations which also impose restrictions on the current circumstances. The PRC Branch will face severe consequences if it discloses information or documents relating to accounts held there in violation of PRC laws and regulations. Those consequences could include but are not limited to criminal penalties, significant fines, suspension of business, disqualification of senior management of the Bank and reputational hann. In addition, Trustee's request for PRC Branch to comply with the Subpoena to disclose such data would also potentially raise issues of PRC national security, confidentiality of criminal investigations, and raise political sensitivity concerns in China.

14 The Trustee could pursue the alternative that would enable the Trustee to seek disclosure from the PRC Branch without causing a violation of the PRC laws and regulations. In particular, the Trustee could seek the desired disclosure by seeking judicial assistance pursuant to the Hague Evidence Convention. It would be an effective and legitimate approach for Trustee, and PRC Branch would not violate the abovementioned restrictions imposed by PRC laws and regulations.

## **IV. Restrictions Imposed by PRC Laws and Regulations**

## **(I) PRC Judicial Assistance**

15 China imposes heightened restrictions for entities in China to produce documents in response to a U.S. subpoena. A1iicles 283 and 284 of *PRC Civil Procedure Law* (in Chinese: 9'1 \$ A ~:#;;JsO 00 ~¥ Wi!ti'!) and *Frequently Asked Questions on Judicial Assistance in International Civil and Commercial Matters* (in Chinese: l;ifil~,ij;~if.J:fi:j§]

¥tt/J,J:l}J '/Jl' Yt!. (ii] *!W/h/¥~,* hereinafter referred to as the **"FAQ")** issued by Ministry of Justice of the PRC **("MOJ")** clearly provide that any assistance provided for 'litigation acts' in foreign court proceedings including investigation and collection of evidence must be conducted pursuant to relevant international treaties or diplomatic channels. Although there are differences between the disclosure procedures in U.S. and the evidence collection or investigation procedures in the PRC, the disclosure ordered by the Subpoena should be considered as a "litigation act". The abovementioned laws and FAQ are as follows:

16 Article 283 of PRC Civil Procedure Law provides that *"Pursuant to the international treaty concluded or participated by the People's Republic of China or in accordance with the principle of reciprocity, a People's Court and a foreign court may request each other to carry out service of documents, investigation and collection of evidence and any other litigation acts on its behalf.*

*Where a request by a foreign court for assistance is prejudicial to the sovereignty, security or public interest of the People's Republic of China, the People's Court shall refuse to enforce."*

17 Article 284 of PRC Civil Procedure Law provides that *"Request for and provision of judicial assistance shall be carried out via the channels stipulated in the international treaty concluded or participated by the People's Republic of China; where there is no treaty, request for and provision of judicial assistance shall be carried out via diplomatic channels.*

*An embassy or consulate of a foreign country based in the People's Republic of China may serve documents on a citizen of the foreign country and carry out investigation and collection of evidence, but shall not violate the laws of the People's Republic of China and shall not adopt mandatory measures.*

*Except for the circumstances stipulated in the preceding paragraph, no foreign agency or individual shall carry out service of documents, investigation and collection of evidence in the People's Republic of China without the consent by the relevant administrative authorities of the People's Republic of China."*

18 No. 5 of the FAQ provides the followings:

*"Q: How can foreign judicial authorities or judicial officers retrieve evidential materials located in China?*

*A: The request for investigation and evidence collection shall be made by the foreign judicial authority or individual qualified to request for evidence collection to the MOJ through the channel prescribed in the treaty. Where the foreign country has not concluded relevant treaty with China, a request shall be made to the Ministry a/Foreign Affairs. After the request is examined and approved, it shall be enforced by the people's court, and the result shall be replied to the requesting party by the department receiving the request.* "

- 19 As China and the U.S. are both parties to the Hague Evidence Convention, and according to the *Rules of the Supreme People's Court on Judicial Assistance Requests for Service of Judicial Documents and Investigation and Evidence Collection in Handling Civil and Commercial Cases under International Conventions and Bilateral Judicial Assistance Treaties (Amended in 2020)* (In Chinese: Jl~A~r!~Jt:!l~-f-1~:fl.il00~ffi0t"J;FOx.J(:iiJ.E] \$~M\*~~g~~¥-#EJ\$~~~~~~~~filEJ\$~Mffl\*~~~ ( 2020 11,lLiI) ) **("Rules on Judicial Assistance under Treaties"),** the legitimate channel for a foreign judicial authority to carry out 'litigation acts' such as an order for disclosure of documents in PRC is through judiciary assistance in accordance with the Hague Evidence Convention. - 20 The position is also supported by other recently enacted laws, PRC DSL and PRC PIPL, emphasizing that unless prior approvals are obtained from competent Chinese authorities, (I) judicial agencies outside of China are prohibited from requesting disclosure of documents by entities in China; (2) entities in China and individuals in China are prohibited from cooperating with the request for disclosure of documents made by those judicial agencies. You may find more details about the PRC DSL and PRC PIPL in Para. 27 to 32. - 21 In particular, Article 36 of PRC DSL provides that *"The competent authorities of China shall, in accordance with the relevant laws and the international treaties and agreements concluded or acceded to by China, or on the principle of equality and mutual benefit, handle the requests made by foreign judicial or law enforcement authorities for the provision of data. No organization or individual within the territory*

*of China may provide foreign judicial or law enforcement authorities with data stored within the territory of China without the approval of the competent authorities of China."*

- 22 A1iicle 41 of PRC PIPL provides that *"The competent authorities of the People's Republic of China shall, in accordance with the relevant laws and the international treaties and agreements concluded or acceded to by the People's Republic of China or under the principles of equality and mutual benefit, handle the requests made by foreign judicial or law enforcement authorities for providing the personal information stored within the territory of China. Without the approval of the competent authorities of the People's Republic of China, no personal information handler may provide the personal information stored within the territory of the People's Republic of China to foreign judicial or law enforcement authorities.* " - 23 Based on the above, it can be concluded that under circumstances involving courts of foreign jurisdictions, such as a U.S. court, such approvals could be only obtained from MOJ, which then transfer to Supreme People's Court of PRC, following the Hague Evidence Convention procedures or diplomatic channels. A U.S. court order would not suffice to displace such necessary approvals to provide the PRC Branch with any protection. - 24 PRC authorities have also taken a clear and serious attitude towards document disclosure orders issued by U.S. courts and discouraged entity recipients in China to comply with such orders, unless the promulgated laws and regulations are complied with. According to the speech of Mr. PU Xiangrui, the Chief Legal Adviser of China Banking Association, published on the official website of the State Council of the PRC on June 26, 2019, ¹he believed that based on the provisions of the PRC Civil Procedure Law, without the pennission of the competent authorities of the PRC, no entities or individuals within the territory of the PRC shall provide any foreign entities with judicial assistance such as evidentiary mate1ials. He further pointed out that, US plaintiffs could obtain client infonnation from banks in China through judicial assistance pursuant to Hague Evidence Convention. Banks in China will cooperate and provide assistance in

¹**China Daily, China Banking Association: America1 s exercise of 0long-ann jurisdiction" over Chinese banks violates** the PRC Law, June 26, 2019, <htt l 9-06/26/content\_5403308.htm>.

accordance with the law. However, the behaviour of the U.S. court ordering a Chinese bank to directly provide the plaintiff in a case administered by it with the bank's client infonnation that is strictly protected by Chinese laws; and that, without the consent of the relevant competent authorities of the PRC and based solely on U.S. domestic laws, is a typical exercise of "long-ann jurisdiction" over a Chinese bank and clearly violates a series ofrelevant Chinese laws and regulations, including PRC Connnercial Bank Law and PRC Civil Procedure Law. Banks in China are not legally obligated to comply with the U.S. courts' orders.

- 25 Based on the above, if the PRC Branch complies with the Subpoena and provides account infonnation as requested, both the PRC Branch and its employees will be in breach of the PRC laws and will face civil and even criminal penalties as a resnlt. Please find more details about such consequences in the Para. 31 to 32. - 26 Although no direct enforcement cases of the above provisions relating to the document disclosure orders have been observed publicly, the frequent promulgation of regulations on cross-border data provision indicates PRC government's position and fierce enforcement in this filed, which would impose the PRC Branch the risks of those serious penalties including warning, business suspension, business license revocation by the relevant competent authority, with a concurrent fine, if producing documents in response to the Subpoena.

#### **(II) PRC Data Protection Laws**

- 27 As stated above, PRC DSL and PRC PIPL echo the requirements for any judiciary assistance for responding to subpoenas issued by comis of foreign jurisdictions. Moreover, PRC data protection legislations also impose restrictions for cross-border transfer of sensitive information, including important data and personal information. - 28 According to the Article 38 of PRC PIPL, the necessary requirements for cross-border transfer of personal infonnation include (1) passing the security assessment conducted by the Cyberspace Administration of China of the PRC **("CAC");** (2) being certified by a specialized agency for protection of personal infonnation; or (3) having entered into a contract with the overseas recipient( s) under the standard contract formulated by the CAC, specifying the rights and obligations of both parties. A separate consent

requirement is imposed by A1iicle 39 of PRC PIPL, which provides that to provide the personal information ofan individual to an overseas recipient outside the territory of the PRC, the personal infonnation processor shall infonn the individual of the relevant information such as the name of the overseas recipient, its contact infonnation, the purpose and method of handling, the type of personal infonnation and the method and procedure for the individual to exercise his or her rights against the overseas recipient, and shall obtain the individual's separate consent. According to Article 40 of PRC PIPL, Article 37 of PRC CSL and Article 31 of PRC DSL, cross-border transfer of important data and/or personal infonnation shall be subject to security assessment.

29 For the PRC Branch, the account related information ordered to be disclosed by the Subpoena includes but not limited to all transaction infonnation, communication infonnation, KYC information. Such information contains not only privacy infonnation of the clients, but also infonnation related to the business operation of the PRC Branch which may constitute or include 'important data' and 'personal information' regulated under data protection legislations. According to the *Information Security Technology Guideline on the Identification of Important Data (Draft for Comments2 )* (in Chinese: {§ ,@,'?x:i:ti:;f: ll!~~:Jj,hQ!iJ1J:Jlti¥i (1iE>J<~~%'filli)) released by the National Infonnation Security Standardisation Technical Committee, 'important data' refers to data that exists in electronic fonn and may endanger national security and public interests once it is tampered with, destroyed, leaked, or illegally obtained or used. As personal financial information related to personal bank account is a type of important basic data accumulated in the daily business operations of banks, if there is any improper operation occurring to such personal financial information, not only the legitimate rights and interests of clients will be directly infringed, but also the risks and operation costs of banks will be increased. Consequently, financial data of banks could fall under the category of 'important data'. As provided by Article 4 of PRC PIPL, 'personal infonnation' refers to all kinds of information related to identified or identifiable natural persons recorded by electronic or other means. Account related infonnation showing the

²**In practices in the PRC, the finalized and formal version ofa law, a regulation or a standard will be nearly the same as their "draft for comments'' versions. And, the PRC authorities will refer to or even rely on the "draft for comments'' versions during their analysis and enforcement. As a result, legal professionals and other entities or individuals concerned in the PRC usually pay close attention to and follow the guidance in the "draft for comments" versions.**

financial activities of the debtor and other related individuals would certainly fall under the category of 'personal infonnation'.

- 30 Therefore, to provide the requested account related infonnation stored within the territory of the PRC according to a U.S. court Subpoena, as the recipient is located abroad, the PRC Branch would be subject to the restrictions including: (I) obtaining approval of judiciary assistance as stated above; (2) passing the security assessment by CAC (according to Article 4 of *Security Assessment Measures for Outbound Data Transfers* (in Chinese: ~ tlis W m 'ti: :i: W 1i1i *!i:1'* Yit ), where a data processor provides critical data abroad, it shall declare security assessment for its outbound data transfer to the CAC through the local cyberspace administration at the provincial level; (3) obtaining separate consent from the accountholder; and ( 4) taking confidentiality measures in accordance with the confidentiality requirements including but not limited to the followings: taking confidentiality measures in accordance with the requirements stressed by 6.1.2 of Personal financial information protection teclmical specification (JR/T 0171-2020) (in Chinese: -t-A~ili<h1J!L1/i!,1JiHf':tJi:#~.ffim) issued by the People's Bank of China, that all parties participating in the process of transmission of personal financial information shall ensure the confidentiality, integrity and availability of such infonnation in the process of transmission. Specifically, the confidentiality measures required for the transmission include but not limited to technical measures such as secure channel and data encryption. Such requirement is also emphasized in the Measures for Security Assessment for Cross-border Transfer of Personal Information (Draft for Comment) (in Chinese: 1'-A1§}~'!-Wm'ti::i:v11i1i!i:J-Yt CfiE>R~:§,1,:frlli) ), Article 4 and Article 17 of which require that the data processor transferring the personal information abroad shall provide analysis reports on security measures to protect the personal information security and the legitimate rights and interests of the subjects of personal infonnation. - 31 For any violations, Article 48 of PRC DSL provides that violating entities will be subject to penalties such as warning, business suspension, business license revocation by the relevant competent authority, with a concurrent fine of CNY 100,000 (around USD 14,742) to CNY I million (around USD 147,417), or CNY 1 million (around USD 147,417) to 5 million (around USD 737,083) if serious consequences are caused, if they

provide data to a foreign judicial agency without the approval of the competent authority. In addition, relevant persons who are directly in charge or directly liable will be subject to a fine of CNY 50,000 (around USD 7,371) to CNY 500,000 (around USD 73,708). Article 46 of PRC DSL provides that the entities illlegally transfer abroad the important data will be subject to warning with a concurrent fine of CNY 100,000 (around USD 14,742), or business suspension, business license revocation with a concurrent fine of CNY 1 million (around USD 147,417) to 10 million (around USD 1,474,165) if serious consequences are caused. Relevant persons who are directly in charge or directly liable will be subject to a fine of CNY 100,000 (around USD 14,742) to CNY 1 million (around USD 147,417). Similarly, Article 66 of PRC PIPL states that entities in violation of any of the provisions of the law will be subject to penalties and fines. If the circumstances are severe, the fine may range from no more than CNY 50 million or no more than 5% of the turnover of the entity of the previous year. Person directly in charge or directly liable will be subject to fines and be prohibited from acting as senior management in corporate entities. Further, Article 66 of the PRC CSL also clearly provides that liabilities including warning, business suspension, business license revocation by the relevant competent authority, with a concurrent fine, will be imposed on entities which export data in violation of Article 37 of PRC CSL. In addition to penalties as stated above, according to Article 67 of PRC PIPL, any violations of PRC PIPL will be recorded in the credit archives and disclosed to the public.

32 The competent authorities have fiercely enforced such provisions. For example, the Cyberspace Administration of China has imposed a fine of CNY 8. 026 billion yuan against Didi Global and a fine of CNY 1 million each for Didi Global's CEO and president on July 21, 2022 for the violations of PRC CSL, PRC DSL and PRC PIPL. Although Didi Global's violations have not been exhaustively listed in the public announcements due to national security considerations, according to the official answers to questions regarding Didi's penalties issued by the Cyberspace Administration of China on July 21, 2022, the non-compliance with the security censorship or assessment requirement before cross-border transfer of data has been an enforcement focus from and after this largest data protection penalty.

#### **(IIl)PRC Financial Regulations**

33 There are traditional obligations of the bank to keep its clients' infonnation confidential under PRC laws and regulations. Article 29 of *PRC Commercial Banking Law* provides general principal for keeping the confidentiality of the clients' infonnation. Additionally, the following regulations provided more specific requirements:

Article 9 of the *Administrative Measures on RMB Bank Settlement Accounts (Decree of the People's Bank of China No.5, 2003)* (in Chinese: AR r!HlH'rM~mlEf' -~1:ri't (9" OOARflfff1?- 2003 ~ 5 %)): *Banks shall ensure confidentiality of information about depositors' bank settlement accounts. Banks shall have the right to decline any inquires by institutions or individuals on deposits and other relevant information on bank settlement accounts for institutions, unless stipulated otherwise by the laws and administrative regulations. Banks shall also have the right to decline any inquiries by institutions or individuals on deposits and other relevant information on bank settlement accounts for individuals, unless stipulated otherwise by the laws and administrative regulations.*

Article 4 of the *Administrative Measures for Client Due Diligence and Preservation of Clients' Identity Information and Transaction Records by Financial Institutions (PBOC, CB/RC and CSRC Decree [2022} No.* J) (in Chinese: ~ill1t!L:ti,J'.g'.f'ffijRiJlil~;fn'.g'.f' ~ffiM~R~a~~~#WR!l:r~(q:iOOAR ffq:iOO ff~~m••~~~~ 0! ⁰ 00i.iE~m,IW~~~~1?- (2022) ~ I %)): *A financial institution shall, under the principles of safety, accuracy, completeness and confidentiality, properly preserve its clients' identity information and transaction records and ensure that each and every transaction can be reproduced in such a manner as to provide the information necessa,y for the due diligence on its clients, the monitoring and analysis of transactions, the investigation of suspicious transaction activities as well as the investigation and handling of money-laundering and terrorist-financing cases.*

Article 5 of the *Anti-money Laundering Law of the People's Republic of China* (in Chinese: q:i if A R~;fn 00 .&i'31:/t\Ut): *Customer identity information and transaction records obtained in the course of anti-money laundering duties or obligations* *performed pursuant to the law must be kept confidential and not be disclosed to any organization or individual unless required by the provisions of the law.*

Article 8 of the *Provisions on Individual Deposit Accounts under Real Names (Decree of the State Council No. 285)* (in Chinese: *1'* A1'ftJzWif:r'~::3f#U~.lll'.iE(~9HJr:4-~= BJ\.+ Ji-'%)): *Financial institutions and their staff members are responsible for keeping confidential the information about individual deposit accounts. Financial institutions shall not provide the information about individual deposit accounts to any entity or individual, and, have the right to refuse any entity or individual to inquire, freeze, transfer money deposited by individuals; however, an exception applies as otherwise provided in laws.*

34 Besides the traditional obligations of confidentiality of financial institutions as introduced in Para.33, the *Notice of the People's Bank of China for Banking Financial Institutions to Get the Personal Financial Information Protection Work Well Done (No. 17 [201 l] of the PBOC)* (in Chinese: 9" ~A l,(!/ilHT:A:'f1ilHT~~r.irlltJLt'q{/jQ:ff1' A~ r.ir!l{§}~,{Jj(Jf'I{'FB<Jll]H,U (i~'.& (2011) 17 -'%)) (the **"Notice")** published by the People's Bank of China provides more detailed requirements:

Article I of the Notice: *Personal financial information as mentioned in this Notice shall mean the following personal information obtained, processed and preserved by a banking financial institution by accessing to the information system, payment system and other systems of the People's Bank of China when it carries out the following business:*

*(1) personal identity information, including the name, gender, nationality and ethnicity of the person, the type, number and validity period of his identity card, his occupation, means of contact, marital status, family status, domicile, the address of the entity for which he works, and his photo;*

*(2) personal property information, including his income, real estates, vehicles, tax payment amount and reserve deposit amount;*

*(3) personal account information, including his account, the time of opening the account, the bank of deposit, the balance in the account, and the transactions under the account;*

*(4) personal credit information, including the repayments under his credit card, the repayment of his loans, and other information formed in his economic activities and able to reflect his credit conditions;*

*(5) personal financial trading information, including the personal information obtained, preserved and kept by the banking financial institution in the process of intermediary business such as payment settlement, financial management and safe deposit box, as well as the personal information arising when the client has a business relation with a third-party institution such as insurance company, securities company, fund company and futures company, etc. via the bankingfinancial institution;*

*(6) derivative information, including the information formed from processing and analysis of original information to reflect a certain person's facts, such as personal consumption habits, investment will, etc.;*

*(7) other personal information obtained and preserved in the process of establishing a business relation with the person.*

Article 4 of the Notice: *A banking financial institution shall not distort or illegally use the personal financial information. When using the personal .financial information, it shall meet the purpose of collecting such information, and shall not commit the following acts:*

*(1) selling the personal financial information;*

*(2) providing any other institution or individual with the persona/financial information, unless othenvise authorized or consented to in writing by the individual when required by relevant business, or otherwise prescribed in any law or regulation or by the People's Bank of China;*

*(3) using the persona/financial information in its marketing activity not for the pwpose of generating such information despite of the individual's objection.*

35 For cross-border transfer issue specifically, there are also explicit restrictions on financial institutions, with certain statutory exceptions. For example, Article 6 of the Notice has provided the following restrictions on cross-border transfer of personal financial infonnation: *The personal financial information collected inside the territory of China shall be stored, processed and analysed also inside the territory of China.*

*Unless otherwise prescribed by any law or regulation or the People's Banko( China, the banking financial institution shall not provide any domestic personal financial information to an overseas party. 3*

3 6 The exceptions mentioned in the above underlined provisions are statutory ones. The statutory exceptions and corresponding requirements are as follows:

Article 4 of *The Notice on Issues Relating to Proper Protection of Personal Financial Information by Financial Institutions in Banking Industry (Shang Hai Yin Fa [2011* J *No. 110) (in Chinese:* \*'fil\lir.illc~Wi'lltJLf/;J{;\l(~J1-A~Wi'll{l§,i~J,1lf:1f'Ifi=fl\*i'iiJJl!Nl'i{J:® J;U ( l:.liiHltK ( 2011) 110 % ) ) has provided the following exceptions for the above introduced restrictions on cross-border transfer of personal financial information: *Issues relating to provision of personal financial information by financial institutions in the banking industry to overseas parties: Article 6 of the Notice stipulates that, "unless otherwise prescribed by any law or regulation or the People's Bank of China, the banking financial institution shall not provide any domestic personal financial information to an overseas party." However, where it is necessary to handle business for clients, upon the written authorization or consent o(the clients, domestic financial institutions in the banldng indus/Jy which provide domestic personal financial information to overseas head office, parent bank or branches and sub-branches shall not be deemed as a violation. Financial institutions in the banldng industry shall ensure that their overseas head office, parent bank or branches and sub-branches keep personal financial information obtained confidential.*

Besides the above, Section 7.1.3 (d) of the *Personal Financial Information Protection Technical Specification (JRIT0171-2020)* (in Chinese: 1-A~Wi'll{l§,~,{lf:=rf'J5'z;fJ.ffim) has also provided the specific description and requirements of the exceptions for the above introduced restrictions on cross-border transfer of personal financial infonnation: *7.1.3 (d) Personal financial information collected and generated in the course of providing financial products or services within the territory of the People's Republic of China shall be stored, processed and analyzed within the territo1y.*

³**These exceptions are stipulated in relevant regulations. However, a subpoena or a court order from the US is not an exception. Please find more details of such exceptions in Para. 36 in this Declaration.**

*Where it is really necessary to provide personal financial information to overseas institutions (including head office, parent company or branch company, subsidiary company and other affiliated institutions necessary to complete the business) due to business needs, the specific requirements are as follows:*

- *1) The transfer shall comply with the national laws and regulations and the relevant regulations of the competent department of the induslly.* - *2) The express consent of the subject of personal financial information shall be obtained.* - *3) The export security assessment of personal financial information shall be carried out in accordance with the methods and standards formulated by the relevant departments of the state and industry, so as to ensure that the data security protection capacity of overseas institutions meets the security requirements of the state, relevant departments of the industry and financial institutions.* - *4) The financial institution shall explicit inform and supervise the overseas institution to effectively perform its obligations such as confidentiality, data deletion and case investigation by means of signing agreements and on-site inspection.* - 3 7 The consequences for violating the above regulations on financial institutions are severe and may also have adverse impact on the executives of the financial institutions. Article IO of the Notice has provided the following consequences for violations: I,f *the People's Bank of China or its any branch at the level of prefecture or city central sub-branch accepts a complaint or finds that a banldng financial institution might have failed to perform the obligation of protecting personal financial information, it may make verifications according to law.* I,f *it ascertains that the banking financial institution has violated this Notice or is in other event of failing to perform the obligation of protecting the personal financial information, it may take the following measures:* - *(]) to make an appointment with the banking financial institution's senior manager for a conversation*⁴ , *and to require the senior manager to state the facts;* - *(2) to order the banking financial institution to make a rectification within a time limit;*

⁴**The "conversation" here is a severe measure taken by the Chinese authorities, which is a signal to the public that the person being invited to the ·'conversation'' has very severe misconducts. Such signal will also be interpreted as a significant bad news and may cause adverse impact on reputation.**

*(3) to circularize the matter within the financial sector;*

*(4) to suggest that the banking financial institution give sanctions to the directly responsible senior manager and other directly liable persons according to law;*

*(5) to hand over the case to the judicial authority for punishment* if *the bankingfinancial institution is suspected to have committed a crime.*

- 38 In the previous couple of years, there was a well-known case of a bank's violation of the personal infonnation protection rules in which penalties were imposed. CITIC Bank provided detailed information of a Chinese stand-up comedian's personal bank account transactions to a third party without the authorization of the client himself, violating the principle of confidentiality of depositors and allegedly *PRC Commercial Banking Law* and the regulatory provisions of the China Banking and Insurance Regulatory Commission **("CBIRC")** on the protection of personal infonnation. According to a punishment decision published by the CBIRC (CBIRC Penalty No. [2021) 5), one of the main violations of the law was that CITIC Bank "mismanaged sensitive customer information and caused it to flow out; stored sensitive customer infonnation in violation of the law". CBIRC imposed an administrative penalty of CNY 4.5 million on CITIC bank. - 39 Besides the PRC laws and regulations for protecting financial personal data, there are some industrial standards for protecting the confidentiality and security of financial data as well, for example, the Guide for the Classification of Financial Data Security ( (JR/T 0197-2020) ) (in Chinese: ~ill1~Jm~:i: ~:/!~:i:%t/Hi'ii¥i). - 40 In summary, considering the above regulations and cases, if the PRC Branch discloses the required infonnation of its clients, it will be subject to severe punishment according to PRC laws and regulations on financial institutions.

#### **(IV) PRC Criminal Law**

- 41 Illegal provision of client's personal information, in very severe circumstances, may lead to the result of being prosecuted of the "C1ime of Infringement upon Citizens' Personal Infonnation". - 42 Article 253 (A) of *Criminal Law of the PRC* stipulates as follows:

*Whoever sells or provides personal information of citizens to others in violation of relevant provisions of the State,* if *the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than 3 years or criminal detention and shall also or only be fined;* if *the circumstances are particularly serious, he shall be sentenced to fixed-term imprisonment/ram 3 to* 7 *years and shall be fined*

*Whoever sells or provides personal information of citizens to others in violation of relevant provisions of the State, which is obtained during pe1forming duties or providing of services shall be sentenced to a heavier penalty according to the preceding paragraph.*

*Where an entity commits any of the offences as described in the preceding three paragraphs, it shall be fined, and the person directly in charge and other directly liable persons shall be penalized in accordance with the applicable paragraph.*

Pursuant to this Article, those who illegally provide personal infonnation to others shall be sentenced to pecuniary penalty, criminal detention, or fixed-term imprisomnent up to 7 years. The penalty will be even heavier if such illegally provided personal infonnation is obtained during perfonnance of duties or provision of services. If the PRC Branch is considered as having illegally provided personal infonnation, in severe circumstances, it may be considered as illegal provision of personal infonnation that it obtained during its performance of services, which may lead to heavy sentences, and not only the PRC Branch entity, but also the PRC Branch's executive in charge of this matter, may be criminally liable.

# **(V)N ational Security, Criminal Investigation, and Political Sensitivity**

43 According to news reports5 of Chinese govermnent's official media in previous years, Kwok was involved in criminal investigations because he was accused of fabricating documents of the central govennnent of China as well as other possible crimes; Kwok

⁵ **For example, China Court, Xinhua: Forging National Official Documents and Directing a Farce-**

Exposing Guo Wengui's "Top Secret Documents" (f)',ii,;[l,];!( 0:Jt, -\'i'iNJ\$r41ii,JJillj--jll\f.Z.\$F,:Jtl/t "tMl'i:Jt1'f" H'liJiiJ ~kt"), April 23, 2018, <http>;

**Zhong Gong, People Daily, Case of Guo Wengui and Others Forging National Official Documents Cracked (!;~Jt:11.t~** A 11:Ji!!i 00 ;!(f/1.7':0 :Jt~il!i{,JH<it), April 23, 2018,

^&lt;http 8042316 ! 915881.shtml>.

was one of the persons in the Red Notice List issued by the International Criminal Police Organization; some of Kwok's speeches jeopardized the reputation and security of China, because his speeches involved several senior officials of Chinese government. I am not in a position to comment on the above, but I do believe the above is highly politically sensitive and will leave a significant impact on the PRC Branch when considering the risks and harms of disclosing the required infonnation.

- 44 As Kwok was and may still be involved in criminal investigations, the bank account information of him or his companies may also be deemed as important infonnation in criminal investigations. Apart from the general rules on protection of state secrets of China, Article 9(6) of the *State Secrets Law of the PRC* also explicitly classified "secrets concerning activities for safeguarding state security and the investigation of criminal offences" as "state secrets". For illegal disclosure of "state secrets" such as important information on ongoing criminal investigations, A1iicle 398 of the PRC Criminal Law provides that *"[Crime of Intentionally Divulging State Secrets} [Crime of Negligently Divulging State Secrets} Any functiona,y of a State organ who, in violation of the provisions of the Law on Guarding State Secrets, intentionally or negligently divulges State secrets,* if *the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention;* if *the circumstances are especially serious, he shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years. Any person who is not a functionary of a State organ commits the offence mentioned in the preceding paragraph shall, in light of the circumstances, be penalized in accordance with the provisions of the preceding paragraph.* " - 45 If the required information under the Subpoena is considered as state secrets, due to the nature of state secrets and the political sensitivity, the provision of the required information will be considered illegal and may expose the PRC Branch to unpredictable and uncontrollable risks.

# **V. Alternative Option Available to the Trustee to Obtain the Information Sought in the Subpoena**

- 46 As stated in Para. 19, the US and the PRC are both signatories to the Hague Evidence Convention, which empowers contracting states to designate a central auth01ity to receive and review incoming "letters of request" for taking evidence in that country. If the letter ofrequest complies with requirements of the convention, the central authority will then "transmit" the "letter of request" to the competent authority to process the evidence collection. - 47 According to the Statistics on Judicial Assistance Cases in Civil and Commercial Matters in 2022 issued by the PRC Ministry of Justice **("MOJ"),** the MOJ had concluded 1,827 requests of judiciary assistance including collection of evidence pursuant to judiciary assistance treaties including the Hague Evidence Convention as of the end of December, 2022, which evidences PRC's commitment to providing judiciary assistance in civil and commercial matters. - 48 Several US cases could also illustrate the application of and the benefit provided by the Hague Evidence Convention. For example, in 2011, Tiffany & Co. **("TIF")** sought to enforce a financial judgment against alleged counterfeiters by applying to a US court to compel three Chinese banks to produce the defendants' Chinese account infonnation. The US court accepted the Chinese banks' argument that the plaintiff could have taken evidence through the Hague Evidence Convention and ultimately denied the discovery request. - 49 Procedures of obtaining evidence through the Hague Evidence Convention is clear and straightforward. The letter of request process under the Hague Evidence Convention starts with a judicial authority of the Requesting State, which will send a letter of request to the central authority in the Requested State. The letter will then be forwarded by the central authority of the Requested State to appropriate judicial authority to process, where the law of the Requested State will apply to the letter. - 50 In China, Articles 34 to 44 of the *Notice of the Supreme People's Court on Promulgation of "Implementing Rules for Provisions on Requesting Judicial Assistance in Service of Documents and Evidence Collection in Accordance with International Conventions and Bilateral Judicial Assistance Treaties (for Trial Implementation)" (Fa Fa [2013* J *No. 6)* (in Chinese:~~ A~\$~% ~p '& «\*rf:&t!if 00 ~jj;i;-g'J;fP,xX:itl El \$t/Hl)J~g'l j}l:!!l\_ ~ l'ili ••#EJ\$~~~~~~-~filEJ\$~M-\*OO~~~-~~c~~)>OOD

J;U) ( i't '} ( 2013 ) 6 ~) further expressly state the procedures for the assistance from Chinese courts in evidence collection of civil and commercial cases to foreign courts.

51 Foreign litigants seeking document discovery under the Hague Evidence Convention shall submit a Letter of Request to the Judicial Assistance Exchange Centre of the MOJ, which will then forward the Letter of Request to the Supreme People's Court of the PRC (the **"SPC").** After the SPC's review, a Letter of Fo1warding shall be prepared and submitted together with the request and its annexes to the High People's Court at the location of the witness or the location of the evidence, which will be further transmitted to the Intennediate People's Court or Basic-level People's Court at the location of the evidence or witness for review and processing. After carrying out the review, the judge in charge of investigation and evidence collection shall forward the results of evidence collection to the Personnel for International Judicial Assistance of the same comi. The Letter of Forwarding together with review and forwarding procedures will be subsequently carried out by the superior courts level by level until the SPC. The SPC shall review them and forward them to the Judicial Assistance Exchange Centre of the MOJ in a timely manner. To my knowledge, in most cases, the response to the Letter of Request could be obtained within one year or faster, depending on the specific case scenarios. In some complicated cases, it may take more than one year for the PRC court to decide. For example, in the case of *ALCALIS DE LA PATAGONIA S.A.I.C. v. RACING CLUB ASOCIACI6N Civil,* the National Court of First Instance in Civil and Commercial Matters of the Autonomous City of Buenos Aires, Republic of Argentina sought the disclosure of relevant payments regarding the transfer of a football player made to the defendant. On October 2021, the Argentine court submitted a letter of request to the MOJ for judicial assistance on evidence collection pursuant to Hague Evidence Convention. The letter of request was later reviewed and prepared as Letter of Judicial Assistance for Evidence Collection **("Letter for Evidence Collection")** being transfer to the PRC Supreme Court, then to Shanghai High People's Court, and to Shanghai Pudong New District Primary People's Court **("Pudong Court").** Upon receiving the Letter for Evidence Collection on December 29, 2021, Pudong Court took 23 days to review, investigate, collect the evidence and confirm the transfer of such evidence.

I declare under penalty of perjury under the laws of the United States of America

that the foregoing is true and correct.

Executed on January 29'\ 2023.

Gary J. Gao