Looking Before You Leap in International Investigations

Historically, the risk of enforcement under these laws has proven to be largely theoretical. Consequently, data privacy has often been dismissed as a dry topic of legal discourse, with little impact for practitioners. Recent developments call this perception into question, particularly as U.S. regulators have more aggressively demanded that companies produce documents protected by data privacy regimes. A stark example of this is the Securities and Exchange Commission's (SEC or Commission) recent action against the Chinese subsidiaries of the “Big Four” accounting firms, for their refusal to produce documents ' including audit work papers pertaining to U.S.-listed Chinese companies ' because production would violate China's state secrets regulations.

With the SEC digging in its heels, data privacy restrictions proliferating, and foreign jurisdictions taking a tougher stance on local enforcement, it appears that U.S. lawyers are now stuck between a rock and a hard place, with foreign regulators on one side and their domestic counterparts at the SEC on the other. However, as is often the case, the situation is not as dire as it first appears. While international investigations are invariably more complicated in this new era of data privacy, with careful planning and several practical, proactive steps, lawyers can successfully navigate the new reality.