Data Crime Risks for Corporate Entities and Compliance Prevention Pathways Under the "Dual Punishment" System
In the digital economy era, data has become a core corporate asset—and the risks of data-related crime that come with it are growing increasingly acute. China's Criminal Law applies a "dual-punishment system" to corporate crime, punishing both the corporate entity and the individuals directly responsible. In the field of data-related crime, this doctrine means that companies, their decision-makers, and those who carry out those decisions all face criminal exposure. This article examines in depth the criteria for establishing the liability of corporate actors in data-related crime under the dual-punishment regime, the allocation of liability among the parties, and practical compliance strategies—offering companies a roadmap for preventing criminal risk.
I. The Core Criterion for Corporate Liability: The "Corporate Will"
Under the principle of legality, the Criterion for whether data-related criminal conduct constitutes corporate crime is not essentially different from that applied to corporate crime generally. Three elements are indispensable to the examination and determination of corporate crime: (1) whether the entity genuinely exists; (2) whether the criminal conduct was carried out under the direction of the entity's collective will; and (3) whether the conduct was intended to obtain benefits for the entity.
The key question is whether the "corporate will" is reflected. Corporate will typically takes shape through the following decision-making mechanisms: first, a formal resolution of a statutory decision-making body, such as a board of directors or a shareholders' meeting; second, a decision by the entity's actual controller or a principal responsible officer which—even if it did not follow formal procedure—represents the collective will of the entity; and third, in special circumstances, the entity's acquiescence or subsequent ratification, that is, the entity knew of the criminal conduct but failed to stop it, or endorsed it after the fact.
In the data-crime context, common manifestations of corporate will include a company's decision to conduct data scraping in order to sharpen its competitive edge; organised data theft aimed at cutting costs; and data tampering deployed to evade regulatory oversight. Even a one-person company may commit corporate crime, provided it has an independent legal personality—that is, independent property interests, an independent will, and a corporate governance structure that complies with the requirements of the Company Law.
II. Who Bears Liability: Both Those Who Carry Out the Conduct and Those Who Lead and Decide
Under the dual-punishment system, the individuals liable for corporate crime fall into two categories: the person directly in charge and other persons directly responsible. In the data-crime context, "the person directly in charge" usually refers to an officer of the entity with authority to decide, organise, direct or approve the data-related criminal activity; it also covers managers who knew that a subordinate's conduct was unlawful but failed to stop it, or who, in pursuit of business targets, acquiesced in or tolerated such conduct. "Other persons directly responsible" are typically the employees who actually carried out the data-related criminal conduct—for example, data engineers, analysts or IT administrators.
It is worth noting that judicial practice is moving towards a more granular approach in defining which corporate personnel bear liability. In the landmark "Smarter" case, (2018) Supreme People's Court Civil Retrial No. 366—a milestone in the company law field—the Supreme People's Procuratorate lodged a protest, and on retrial the Supreme People's Court examined each of the company's directors individually, assessing whether subjective fault existed on the basis of their specific duties, whether they knew of the wrongdoing, and what measures they took. This set aside the original judgment's finding that all directors bore joint and several liability, reflecting a fundamental shift in judicial philosophy from "status-based liability" to "fault-based liability." By the same principle of the unity of the legal order, criminal justice, too, must tie liability closely to conduct and fault: liability must be matched to an individual's specific authority, actual role and subjective fault within the entity.
III. How Corporate Compliance Affects Conviction and Sentencing
Awareness of compliant business practice is steadily rising among companies. Yet the reality of a company's compliance management will directly affect whether corporate crime is established: on the one hand, an effective compliance programme may serve as a defence to liability; on the other, non-compliance—or "paper compliance" that exists only on paper—may heighten a company's criminal exposure.
A compliance system that is effectively implemented can, at several points, mitigate or even eliminate corporate liability:
1. Severing liability. A well-designed compliance system can effectively insulate individual criminal conduct from the corporate will; a compliance system that operates effectively is objective evidence that the entity opposes unlawful conduct. When an employee commits an offence for personal performance or personal purposes, the company can rely on these systems to argue that the conduct was an "individual act" carried out in circumvention of those systems, rather than a "corporate act" authorised or acquiesced in by the entity.
2. Sentencing mitigation. Where corporate crime is charged, an effective compliance system already in place beforehand, or proactive compliance remediation after the wrongdoing comes to light, may be treated at sentencing as significant evidence of lesser viciousness and a lower risk of reoffending—supporting a lighter or reduced penalty.
3. Negating fault. In certain cases where corporate negligence or a failure to discharge a statutory duty of care is a prerequisite for liability, an effectively operating compliance system can demonstrate that the company exercised reasonable care, and can be used directly to rebut allegations of corporate intent or negligence.
Conversely, non-compliance or "paper compliance" offers no protection at all. It significantly increases a company's criminal exposure on several fronts and may even become evidence working against the company in judicial proceedings:
1. Proving corporate will. Where a company lacks an effective compliance system, or the system exists only in documents and is never enforced, that indicates the company acquiesced in or even tolerated unlawful conduct; criminal conduct committed by employees—especially senior executives—in pursuit of business performance is then highly likely to be found by judicial authorities to reflect the corporate will, elevating individual liability to corporate liability.
2. Exposing management fault. "Paper compliance" is precisely powerful evidence of a serious management failure. It shows that the company recognised the risk yet deliberately circumvented or perfunctorily discharged its statutory duties, directly demonstrating corporate criminal intent or gross negligence and serving as important grounds for finding criminal intent on the part of the company and its responsible officers.
3. Forfeiting any chance of leniency. Once an investigation begins, a company with no compliance or only "paper compliance" displays no resolve or good faith to operate compliantly, and loses the critical opportunity to obtain lenient treatment through compliance remediation.
Read together with the Law of the People's Republic of China on the Promotion of the Private Economy—which requires private enterprises to operate in a well-regulated manner and embodies the spirit of safeguarding the lawful rights and interests of private economic actors—judicial authorities should abandon the traditional mindset of being "heavy on punishment, light on protection," encourage voluntary corporate compliance, and, where it is doubtful whether conduct amounts to a crime, adopt the interpretation favourable to the enterprise. This policy orientation creates institutional room for companies to prevent criminal risk through compliance building.
IV. Preventing Corporate Data-Crime Risk and Insulating Executives from Liability
(1) Avoiding Corporate Crime Through Internal Governance
Companies should build an internal governance system to prevent data-related crime along the following lines:
1. Build a sound rule framework. Adopt dedicated data compliance management policies that set standards for every stage—data collection, storage, processing, transmission and destruction—and incorporate compliance requirements into promotion decisions and performance assessments.
2. Strengthen enforcement and oversight. Establish a closed-loop mechanism running from whistleblowing to investigation to remediation. On the internal risk-control side, impose periodic rotation and mandatory leave for high-risk positions such as data management and IT operations, reducing the fraud risk that comes with long tenures.
3. Build a compliance culture. Through training, internal communications and briefings on typical cases, embed compliance awareness in the corporate culture and move ethical conduct from rule-driven compliance towards voluntary habit.
(2) Strategies for Insulating Executives from Liability and Mounting a Defence
Executives facing data-crime allegations may consider the following defences:
1. The due-diligence defence. As the data security lead or a relevant executive, the individual should show not only that he or she drove the drafting or approval of key policy documents on data security protection, but also that he or she substantively promoted and supervised implementation of security controls across the entire data lifecycle—thereby proving that reasonable data security obligations were discharged, and asserting a defence of no fault. Supporting materials may include approval documents and minutes for the purchase of data encryption systems, the deployment of data loss prevention (DLP) tools and the engagement of external security auditors; data security risk reports reviewed on a regular basis; internal audit reports; records of data-breach response drills; and records of briefings received from the data protection officer (DPO) or the head of IT security.
2. The system-separation defence. By proving that the company had established and operated an effective governance structure and internal control mechanism, the executive can characterise the unlawful conduct as individual fraud that breached those systems, thereby severing it from the corporate will. The key is to show a comprehensive compliance management system—including technical safeguards already in place, such as approval and logging of data access permissions, audit logs of operations on core databases, and rule configurations for masking sensitive data; process controls, such as standardised approval tickets for data export, sharing and destruction, and security assessment records for third-party data processors; and ongoing monitoring, such as internal or third-party penetration test reports, vulnerability scan and remediation records, and employee compliance assessment records.
3. The causation defence. Even if a data-related crime occurred, its direct cause was an employee's individual unlawful conduct or an uncontrollable technical vulnerability—not a management decision or oversight failure by the executive. The argument stresses that the executive's role is to build systems and supervise, while day-to-day data security operations are the direct responsibility of a dedicated technical team and security lead. Where it can be shown that reasonable resources were allocated to the function in question and a qualified person was appointed to head it, the executive can argue that this particular risk was properly delegated and effectively controlled.
4. The proportionate-liability defence. Where data processing involves multiple parties—entrusted processing, joint development and the like—the principles of civil liability attribution can be drawn on to clarify the internal allocation of responsibility and to distinguish the liability of external partners: where several liable parties contributed to the loss, each bears liability in proportion to its degree of fault and causal contribution rather than unlimited joint and several liability. The application of proportionate joint liability gives executives a new line of defence. It may not secure a complete acquittal, but it can effectively confine an executive's personal legal liability to the scope of his or her actual decisions and influence, substantially reducing the penalty he or she may face.
Under the dual-punishment framework of criminal law, the logic of preventing corporate data-crime risk has shifted fundamentally—from reactive, after-the-fact, case-by-case response to proactive, preventive, systemic compliance building. This requires companies to move beyond formalistic policy documents, to embed compliance requirements deeply into every business process, to build management mechanisms covering the entire data lifecycle, and to use technology to make compliance controls automated and auditable. Corporate decision-makers in particular need to recognise that an effectively operating data compliance system delivers value on two levels: it is not only a "shield" against risk, but also—when a judicial investigation begins—a substantively meaningful defence for severing corporate liability and proving that reasonable care was exercised. The current direction of judicial policy has likewise shifted from simply condemning corporate non-compliance towards actively incentivising and guiding ongoing compliance management. In the frontier where the digital economy meets criminal compliance, therefore, building a compliance system that both fits business development and is genuinely enforceable is no longer optional: it is the strategic cornerstone and the indispensable path to steady, enduring growth.
