Already an IBA member? Sign in for a better website experience
A statement from Didi at the time said that the company would ‘conduct a comprehensive examination of cybersecurity risks and would cooperate fully with the relevant government authority’.
‘The IPOs have obviously been a flashpoint,’ says Peter Bullock, a partner at King & Wood Mallesons in Hong Kong. ‘It is all to do with what authority is needed from Beijing to go overseas for capital raising. If you interfere with a company’s ability to raise capital, then that’s fundamental to how a fast-growing company can operate.’
It has been estimated that global investors have lost approximately $1.5tn of value from tech stocks as a result of the recent campaign. This includes from newly listed Didi Global to those already listed in the US, in Hong Kong, and even domestically on China’s exchanges. Leading Japanese investor Softbank, which holds stakes in many Chinese tech players such as Alibaba, Tencent and Didi, confirmed in August that it’ll ‘significantly cut back’ its investments in China amid the current uncertainties, leading some commentators to conclude that the gold rush days of China tech investment are over.
You might well ask, why on earth would China want to clamp down on this when these IPOs are the natural consequence of the excellence of the tech sector in the country
Partner, King & Wood Mallesons
‘We’ve all read how much capitalisation has been wiped off’, adds Bullock. ‘So, you might well ask, why on earth would China want to clamp down on this when these IPOs are the natural consequence of the excellence of the tech sector in the country.’
With Beijing’s shifting policies not priced into stock markets beforehand and investors getting increasingly nervous, an op-ed published by the state-run Economic Daily in late August sought to soothe market fears by outlining the government’s agenda. It argued that instead of targeting capital or specific industries and companies, the so-called crackdown aimed to ‘maintain fair and reasonable market competition’ and is ‘normal market governance’.
Other affected sectors include education, where regulations have been introduced that bar private, for-profit tutoring companies from raising capital overseas.
Beijing argues that its campaign in the tech sector is a short-term cost that must be paid to ensure the long-term growth of China’s digital economy. But investors are not known for their patience and have responded with action. While IPOs in China have slowed, approximately $8bn has been raised this year from first-time share sales by tech companies from India, Southeast Asia and South Korea – surpassing the previous annual peak.
Most of the recent regulatory developments centre on concerns around antitrust rules and data protection. ‘The regulators are responding to criticisms made by the public in these areas’, says Ian Wang, a partner at DeHeng Law Offices in Beijing.
But these concerns are not unique to China, adds Bullock. ‘American companies such as Alphabet, Apple and Facebook have all been in this situation. It’s a cat-and-mouse game in Europe, particularly in the US, and now in China. This is not surprising as you don’t want to have companies that are larger than individual states.’
China finally passed its Personal Information Protection Law (PIPL) in August after three rounds of review. Effective as of 1 November, the PIPL is a unitary law for data protection along the lines of the EU’s General Data Protection Regulation (GDPR). Together with 2017’s Cybersecurity Law and September 2021’s Data Security Law, it completes China’s legal infrastructure around network security.
The PIPL makes it very difficult for any large tech business in China to operate. Firstly, there are certain areas where the PIPL is mutually incompatible with laws in Europe and the US. For example, unlike GDPR, the PIPL does not allow for ‘legitimate interests’ as the basis for processing data, which makes it extremely difficult for tech companies to secure the necessary consent.
Hu Ke, a partner at Jingtian & Gongcheng in Beijing, says organisations face major headaches, such as ‘how to understand “separate consent” and harmonise it for specific types of data or specific processing activities with the current practice of notification and consent based on business functions; and how to achieve “separate consent” through product design’ and further whether it can be recognised by competent authorities and judicial authorities.
Secondly, entrepreneurs in China typically run ahead of regulation and try to make money in an unregulated fashion, with underground banking and peer-to-peer lending being two examples of this. ‘If you’ve built a billion-dollar empire on that sort of approach and then you get hit with not just GDPR but GDPR-plus-plus-plus […] your business model then falls over because it’s completely at odds with the regulation’, says Bullock.
The third element is the data sovereignty debate, with Beijing seeking to ‘contain the disorderly expansion of capital’ – a policy goal articulated in early 2021 to limit China’s perceived exposure from capital exercises undertaken by China’s tech sector. This is where the Cyberspace Administration of China, as the big regulator in this area and child of the Cybersecurity Law, plays an important role as gatekeeper for the export of data. ‘The end result is difficulties for both the tech giants in China and international companies trying to do business in China’, says Bullock.
As a result of these regulatory burdens, China’s tech companies have escalated their hiring of legal and compliance specialists and set aside funds for potential fines. But it’s not just Chinese regulation that firms need to be concerned about. Recent US securities legislation enforces financial and customer data disclosure by foreign companies listing in the US.
In the case of Didi, says Xudong Tao, a partner at JunHe in Shanghai, this created national security concerns from the Chinese government perspective ‘because even government officials working in the ministries in Beijing all use Didi after work’.
‘My worry now is that if a Chinese company holds lots of data, its only choice to raise capital will be to go to Hong Kong’, he adds.
Image: Ivan Marc/ Shutterstock.com