Forming Rules for Government Access:Toward Optimizing the International Flow of
Personal and Non-Personal Data

Report from Study Group on Government Access and Trade Rules(Summary)

November 2022
Center for International Economic Collaboration

Summary
If the government improperly uses data held by the private sector (government access), this may
create a direct impediment to international data flow and undermine the trust of data subjects
and the private sector that support data utilization. Although necessary and beneficial
government access should be possible, clarifying the evaluation criteria and creating a shared setof rules is necessary. Inadequate, unclear, and inappropriate rulemaking negatively impacts thedevelopment, maintenance, and expansion of data-related businesses.
For example, if the government improperly and forcibly intervenes in private-sector data
management policy, it will probably be forced to respond with actions that are incompatible withsafety management measures as well as confidentiality obligations based on other legal
obligations, contracts, and operational policies. Moreover, even if some level of government
access is justified, demands that exceed the limits of the private sector’s voluntary data provision
may make it difficult to conduct sound business activities and manage data appropriately.
Internationally, different criteria are used by countries and regions to determine the scope ofgovernment access to data in the private sector. Meeting these varying criteria will increase bothmanagement costs and risks.
Japan’s concept of DFFT (Data Free Flow with Trust) has a positive impact on international
discussions at the G7, G20, OECD, and other organizations, and government access is
considered an important element of the concept. To reduce international friction arising fromdifferent ideas about the scope and conditions of appropriate government access, and inaccordance with elements conducive to future discussions on appropriate rule formation(hereinafter, “safeguards”), parties should begin discussing the shared criteria that will
determine necessary and legitimate government access.
This report summarizes the discussions of a study group established within the Center forInternational Economic Collaboration (CFIEC), but it does not directly propose rules forgovernment access per se. The main focus is on providing an overview of the current
understanding regarding the significance and necessity of safeguards, even as discussions clarify
them further. Moreover, although the ongoing discussion about government access is mainly
concerned with personal data, the distinction between personal and non-personal data is not
absolute. Consideration of aspects other than the protection of personal information, such as
trade in the digital field, the economy and other aspects of security, intellectual property
2protection, and data-driven innovation, is equally important. Regarding supporting international
data flow, a comprehensive perspective that includes both personal and non-personal data isnecessary. Such a perspective anticipates that diverse viewpoints coexist in an increasingly
complex international situation and carefully provides an overview to avoid arbitrarily excluding
differences in specific ideologies and polities.
The reality is that government access takes many different forms, including discussions about
the perceptions of legitimacy caused by differences in legislation designed to protect personal
information as well as concerns that stem from differences in how national sovereignty relates todata maintenance and management. Regarding what data held by the private sector should beaccessible to the government, our discussion suggests that care must be taken when broadening
the scope of existing discussions to go beyond just personal information. As much as possible,
bias in identifying issues and discussions about safeguards must be avoided. Assuming thefollowing classification foci will assist in that process.

Classification of Government Access
1. Classification by data type: data type (personal or non-personal, including ambiguous
types), nature of the data (e.g., 3Vs: volume, variety, velocity), data value (intellectual
property, etc.)
2. Classification by degree of enforcement: is it compulsory regardless of the penalties
involved and is it voluntarily or spontaneously provided by the private sector
3. Data lifecycle classification: do issues that arise refer to actions taken at the time of dataacquisition, or is use after acquisition, provision to non-governmental authorities,
alteration, or deletion anticipated
4. Classification by data flow: will data flow directly to the government sector or toorganizations designated by the government sector, including certain private sector
entities
5. Classification by the cross-border nature of issues: are issues limited to the relevant
country or region, or are they due to demands that cross two or more countries andregions3

6. Classification by purpose of government access: what purposes are assumed forgovernment access, such as criminal investigation, security, domestic industry
promotion, and the protection of citizens’ personal information

These six classification foci recognize the breadth of anticipated issues with government access,but foci 1, 2, and 5 in particular characterize the nature of government access.
Based on the foci listed above, we analyzed a wide range of cases, 1 expanded the scope while stillreferring to existing discussions on government access, and presented 14 items 2 as elements
required for appropriate rule formation in the future (safeguards). The first seven items are
based on existing discussions 3 and we add our own discussions regarding their significance,
while the remaining items are discussed based on our review. To present many points that cancontribute to future rule discussions, we risked overlapping meanings and content across theitems. These safeguards should not unconditionally be included in discussions, but will bereferenced as necessary for the purpose of confirming candidates or comprehensiveness whenappropriate.

Examples of expanded safeguards that should be considered in government accessinvolving non-personal data
1. Legal basis: There should be a valid legal basis in the country where data is accessed(e.g., the country whose government is requesting data; or where data are held by theprivate sector.)
2. Meet legitimate aims and be carried out in a necessary and proportionate manner: The
purpose of government access should be justified and the measures taken should be bothnecessary and proportionate
3. Transparency: The content and process of government access should be explicit,
especially for the private sector providing the data

1 Appendix 1. Case Studies on Government Access2

Appendix 2. Government Access Rule Elements Regardless of Whether Personal or Non-Personal Information

3 OECD “Government access to personal data held by the private sector: Statement by the OECD Committee on Digital

Economy Policy” (December 2020) https://www.oecd.org/digital/trusted-government-access-personal-data-private-sector.htm(retrieved August 22, 2022) See detailed version for more about existing discussions.

44. Approvals and constraints: Government access should be approved and constrained inscope
5. Limitations: There should be clear restrictions on the minimum handling andmaintenance of data
6. Independent oversight: Supervision and approval by an independent body should be a
pre-condition
7. Effective redress: There should be clear mechanisms for challenging and seeking redress
against unlawful or inappropriate government access
8. Impartiality and non-discrimination: Partial and discriminatory treatment should be
eliminated in the selection of private actors to be accessed by government
9. Uniformity: The application of the legal system for government access should not be
arbitrary; it should be carried out using uniform standards and methods
10. Fair and equitable treatment: Treatment must not be arbitrary, unfair, unjust, or
idiosyncratic, and should not be based on prejudice or discrimination due to factors suchas race, ethnicity, culture, religion, place of residence, or gender
11. Economic rationality: It should not impose excessive costs or burdens on the private
actor subject to government access or on society
12. Compensation: Substantial compensation should be provided upon request to companies
subject to government access as well as individuals affected financially
13. Limitation of liability: The various liabilities that may arise as a result of a private actor’scompliance with government access should be limited or waived for the relevant private
actor
14. Conflicts of law: If there is another law or regulation that conflicts with the legal basis forgovernment access, either domestically or internationally, the government should be
responsible for handling potential contradictions and conflicts, both before andafterward

In this report, these 14 safeguards are analyzed individually while considering the relevant
evaluation criteria. The evaluation criteria for each discipline element are designed to function
as indicators to help the government consider potential protective legal benefits and loss ofbenefits by any party (individual, private sector, or society) as a condition for accepting the5relevant government access. We also provide an analysis of the significance of incorporating therelevant safeguards, their relationship to other safeguards, and their relationship to otherinternational rules.
We expect this report to be used in international discussions and that the prospective readers
will be policymakers and corporate practitioners. Care should be taken with the scope of theword “access,” as it is necessary to discuss not only the forms of data acquisition that can beused exclusively by governments or government agencies, but also arbitrary restrictions onaccess by others, alterations of the data itself, falsification requests, deletions, concealment, andso forth, in the broad sense of “access.”
In parallel with the international rulemaking that is likely to continue, it is also important toconsider existing international rules such as the WTO Agreement on Trade-Related Aspects ofIntellectual Property Rights (TRIPS) as well as the handling of illicit government access basedon the national laws of the countries and regions where the access is taking place. Furthermore,as a way to collect evidence for rulemaking discussions, quantitative investigation and analysis of
the negative economic impact of government access is necessary.
If government access goes unchecked, data held by the private sector and data subjects will
effectively be controlled by the government and government agencies. Determining who should
be considered the subject of data governance is important for the utilization and free flow ofdata. Here, too, it is necessary to respect the philosophy of multi-stakeholders; examine the roles
and powers of the government, the private sector, and data subjects; and achieve universal
understanding through a clarification of the division of duties. Referring to the 14 safeguards
identified in this report, it must be ensured that government access does not adversely affect thedigital economy, the sound development of innovation, or the resolution of social issues.

November 2022

6

Center for the International Economic Collaboration
Study Group on Government Access and Trade Rules

Committee members (affiliations when the study group was formed)

Naoto Ikegai

Hitotsubashi University

Kaori Ishii

Chuo University

Yoichiro Itakura

Attorney at law (Hikari Sogoh Law Offices)

Shigeo Takakura

Meiji University

Jun Nakatani

JEITA Trade Committee

Taku Nemoto

OECD Trade and Agriculture Directorate

Kenta Hirami

Waseda University

Yu YamadaJapan Business Federation

Mariko Watanabe

Gakushuin University

Moderator

Makoto Yokozawa

Center for International Economic Collaboration

Observer

Ministry of Economy, Trade and Industry

7Appendix 1 (Summary)

Government Access Case Studies
Case studies were collected and analyzed to extract elements that would contribute to future
discussions on appropriate rule formation (safeguards). Descriptions are based on thoseavailable at the time the information was provided. It is possible that, in some cases, the legal
system has been revised, implementation has changed, or that issues may have been resolved or
been alleviated since that time. Moreover, some content is based on the observations of thereferencing reporter, meaning that alternative observations may be possible in some situations,but we have tried to include a description from as flexible a perspective as we can.

Case 1 【China】 Requests for disclosure of confidential technical information in exchange foradministrative approval
Case 2 【China】 Prohibition of cross-border transfer of data collected by automobiles
Case 3 【China】 Acquisition of voice data by the government for national security purposes
Case 4 【India】 Mandatory sharing of non-personal data (framework for creating and using
high-value datasets)
Case 5 【US-EU】 Access to data transferred from the EU for the purpose of US government
surveillance (Schrems I/II)
Case 6 【US-EU】 Requests for disclosure of data from abroad relevant to criminal
investigations (Microsoft case, CLOUD Act)
Case 7 【China】 Concerns about unlimited data acquisition by government under the National
Intelligence Law
Case 8 【Singapore】 Use of COVID-19 control app data for criminal investigations

8

Case 1 【China】 Requests for disclosure of confidential technical information in
exchange for administrative approval
The Chinese government was directly or indirectly forcing foreign companies (especially inhigh-tech industries) to transfer technology in exchange for access to the domestic market.
In March 2018, the Office of the US Trade Representative (USTR) released an investigative
report 4 on the unfair, irrational, and market-distorting laws and practices of the Chinese
government that aimed to upgrade its industry by acquiring technologies and intellectual
property from foreign companies. Based on this, the US government invoked tariffs as policy
measures.
The report points to requests for the disclosure of classified technical information in exchange
for necessary administrative approvals as one of the technology transfer mechanisms used by the
Chinese government. Foreign enterprises in various industries such as ICT, pharmaceutical,
chemical, agri-food (especially genetically modified crops), machinery, financial services, and soforth can obtain permission for factory construction and product sales, requiring them toprovide detailed information to government agencies. In some cases, such corporate information
has been provided to local industries and used for similar industrial activities. There have also
been concerns that disclosed information might be given not only to the government but also to
third parties after being reviewed by expert panels (composed of representatives of government,
industry, academia, etc.) that may involve competing relevant stakeholders. Such expert panels
might make review requests in a variety of industries at any stage of a company’s operation in
China. The revised USTR report states that high-tech industries, particularly aerospace andchemical companies, have faced strong pressure to transfer technology. 5
The US government has filed a complaint with the WTO Dispute Settlement Body about
discriminatory treatment by the Chinese government. 6 In response to these developments in othercountries, China has revised its law, and forced technology transfer has been prohibited
according to the Foreign Investment Law of 2019. The Data Security Law of 2021 sets the

4

The Office of the United States Trade Representative (USTR), “Findings of the Investigation into China’s Acts, Policies, andPractices Related to Technology Transfer, Intellectual Property, and Innovation under Section 301 of the Trade Act of 1974,”
March 2018.
5
The Office of the United States Trade Representative (USTR), “Update Concerning China’s Acts, Policies and Practices
Related to Technology Transfer, Intellectual Property, and Innovation,” November 2018, p.23.
6
Ibid., p.5.

9

standard for data processing activities in China, and stipulates data security assurances, personaland organizational protection obligations, penalties, and so forth.7

Case 2 【China】General prohibition of cross-border transfer of data collected byautomobiles
The Chinese government banned cross-border transfer of data collected about automobiles.
In China, the Cybersecurity Law was enacted in 2017, while the Chinese Data Security Law and
the Chinese Personal Information Protection Law were enacted in 2021, thus establishing
China’s three data protection laws. 8
In response to these developments, the following bylaws were enacted one after another;“Certain Provisions for the Administration of Automobile Data Security (Exposure Draft)” 9

7 Motoo Yuno, “Establishment of the Data Security Law in China” (Foreign Legislation, No. 289–1, October 2021)
https:dl.ndl.go.jp/view/download/digidepo_11767245_po_02890113.pdf?contentNo=1(retrieved August 22, 2022).
8 The Chinese names of the three data protection laws are as follows, in the order in which they are described.
「中华人民共和国网络安全法」「中华人民共和国数据安全法」「中华人民共和国个人信息保护法」
9 国家互联网信息办公室『汽车数据安全管理若干规定(试行)』 (announced August 16, 2021) http:www.cac.gov.cn/2021-

08/20/c_1631049984897667.htm(Reference website with Japanese translation: http:maruyama-mitsuhiko.cocolog-nifty.com/security/2021/08/postfefed0.html?fbclid=IwAR1iu43oAGFGt8-MSFQ6A5JdgmbC2KS_vJLiCIBtaA1b1qiB05dTN3i51LE) (retrieved August 22,
2022)

10

were announced for the automobile industry in August 2021, followed by “Information Security
Technology —Security Requirements of Vehicle Collected Data” 10 in October 2021. In bothcases, cross-border transfer of automobile data is prohibited in principle, and in cases where it isnecessary to transfer data across a border, it must pass the cross-border data security assessment
conducted by the National Cyberspace Administration. 11 The category of “automobile data andautomobile data processors” is broad, 12 and it can be said that the scope of data acquisition is too
broad in proportion to the stated purpose. Moreover, it has hindered production anddevelopment by Japanese automakers. On the other hand, “Certain Provisions Concerning the
Security Management of Automobile Data (Trial)” (Article 11) states that “if there are different
provisions in an international treaty or agreement to which China is a party, the international
treaty or agreement shall apply, excepting those provisions that China has declared that it shalldefer.” This suggests that treatment might differ in cases where there is an international
agreement.

10 全国信息安全标准化技术委员会『信息安全技术 汽车采集数据的安全要求』 (October 2021)

https:www.tc260.org.cn/file/2021-10-19/e5a87bcd-770f-4035-83dd-610e15a34096.pdf(Reference website with Japanese translation: http:maruyama-mitsuhiko.cocolog-nifty.com/security/2021/10/post-69a493.html)(retrieved August 22, 2022)
11 Ibid. (9) (Article 11) and Ibid. (10) (Article 7).
12 Ibid. “(9) (Article 3) In this provision, automobile data includes data pertaining to personal data and important data in theprocess of design, production, sale, use, operation and maintenance of automobiles. […] Automobile data processors refers toorganizations that carry out automobile data processing, such as automakers, parts and software suppliers, dealers, repair shops,
and travel service companies. […] Important data means data that, at the time of alteration, destruction, leakage, unauthorizedaccess, or unauthorized use, may threaten national security, public interests, or the legitimate rights and interests of an individual
or organization.”11

Case 3 【China】 Acquisition of voice data by the government for national security
purposes
China is building a nationwide voice recognition database for the purpose of national security.
In China, digital strategies are being promoted from the top down, and the government issimultaneously creating public-private sector integrated innovation by fully supporting privatecompanies in priority industries in terms of funding and policy. 13 In July 2017, the Ministry of
Science and Technology of China formulated the “Next Generation Artificial Intelligence (AI)Development Plan.” To realize innovation using AI, four priority areas (1. autonomous driving,
2. smart cities, 3. healthcare, and 4. voice recognition) were defined, with leading companies
selected for each field.
The Chinese government is collecting personal voice authentication data (biometric data) tobuild a national voice authentication database for the purposes of counterterrorism and public
security by utilizing AI technology that has been developed with significant government
support. 14 A leading company in the field of speech recognition is cooperating with the Ministryof Public Security to build a national voice pattern database and develop a pilot version of asurveillance system that can automatically identify the voice of a person of interest from a phonecall. The involved company is also a designated supplier of voice pattern collection systems
purchased by police stations in the provinces of Xinjiang and Anhui. It offers commercial textto-speech and recognition apps for mobile phones in China, but the large voice datasets fromthe apps could also be used for monitoring. It is unclear to what extent the company sharespersonal information collected for commercial purposes with the Ministry of Public Security,
but the company says it may disclose personal information at the request of relevant government
departments.
In a 2017 report, a China representative at Human Rights Watch said, “The Chinese
government collects the speech patterns of tens of thousands of people, but there is little
transparency about the program or the laws that govern the people targeted and how that
13 Zhihui Lee, “Formation and Development of China’s Digital Powerhouse Strategy” (Overseas Investment and Loans,
September 2021) pp.20-26.; Mitsubishi Research Institute, “Trends toward the Social Implementation of Artificial Intelligencein China,” https:www.soumu.go.jp/main_content/000483136.pdf (retrieved August 22, 2022)
In the field of speech recognition, companies have been improving speech recognition technology by utilizing enormousvolumes of high-quality data accumulated by the government as training data.
14 Human Rights Watch, China: Collecting Voice Authentication, Data Privacy Threats: The Police Major AI Companies
Working together in a Legal Gray Zone (October 2017) https:www.hrw.org/ja/news/2017/10/23/310343 (retrieved August 22,
2022)

12

information is used.” They have pointed out that in China, with its continuous uncheckedsurveillance and retaliation against government critics, it is easy for the authorities to collect andpotentially misuse data. However, the Data Security Law was enacted in 2021, after which thehandling of data related to government access has improved.

Case 4 【India】 Mandatory sharing of non-personal data (framework for creating andusing high-value datasets)
The Indian government is submitting a report on making the sharing of non-personal data
mandatory.
In December 2020, a report on a non-personal data governance framework was submitted by an
Indian expert committee. 15 It frames non-personal data as a public good and envisions data
sharing as a way to ensure that Indian society gains the greatest value (especially economic
benefits) from the data. That report proposes a new framework that requires data-holding
entities to share non-personal data.
Specifically, it establishes a Non-Personal Data Authority (NPDA) to oversee rules on nonpersonal data. Within its regulations, data trustees collect data from data custodians and create
and manage high-value datasets (HVDs). Any organization registered in India can request HVD
15 Ministry of Electronics and Information Technology-Government of India, “Report by the Committee of Experts on NonPersonal Data Governance Framework,” 2020.

13

data from data trustees. Data trustees may collect fees to cover the costs of data processing andso forth. The Indian government hopes that the sharing and use of non-personal data will
promote innovation in start-ups and others with limited access to data.
However, the mandatory sharing of data has been criticized by researchers and privatecompanies, as well as other concerned parties. 16 First, critics say that it is costly for companies tocollect data, but they are required to share datasets free of charge and with no incentives.
Compensation for preparing data for use by third parties and for the value of the data should beconsidered. Companies should also be shielded from liability that might arise from third-party
data use. Second, there is a question of whether anonymized data constitutes non-personal
data. 17 Data custodians provide data to data trustees after anonymization, but since data
regarding individuals is being collected from more data sources, identifying individuals is
becoming easier, even with highly anonymized data. Third, existing research has not provided
evidence that sharing large datasets promotes innovation.
For these reasons, the establishment of the NPDA in India is a new idea worth considering;
however, it is too early for it to be put it into practice, and some have argued that legislation andinvestment in personal data protection are necessary first. 18

16 Jain, R., Pingali, V., “India’s Non-Personal Data Framework: A Critique,” CSI Transactions on ICT 9, 2021, pp.171–183.

17 The scope of the proposed statute in the NPD report is as follows: all data not covered by “personal data” in the Personal Data
Protection Bill, 2019 (PDP Bill 2019).
18 Kapoor, A., Nanda, A., “Non-Personal Data Sharing: Potential, Pathways and Problems,” CSI Transactions on ICT 9, 2021,
pp. 165–169.

14

Case 5 【US-EU】 Access to data transferred from the EU for the purpose of US
government surveillance (Schrems I/II)
There are concerns that personal data transferred from the EU to the United States is subject tosurveillance by US government agencies.
In the EU, the “EU Data Protection Directive” 19 was adopted in 1995, so that transfer of
personal data outside the EU was only allowed when the European Commission has issued anadequacy decision for the destination country of the data transfer. Although there was no“adequacy decision” with the United States in this specific case, the US and EU agreed to a
“Safe Harbor Agreement,” which is a framework for obtaining equal protection. Based on thisagreement, only companies authorized by the US Department of Commerce may receive
personal information. 20
However, after the 2013 “Snowden Incident” revealed that the US National Security Agency(NSA) was monitoring and collecting data held by IT companies in the United States, Austrian
resident Schrems filed a complaint alleging insufficient protection of his Facebook personal datatransferred to the United States (Schrems I 21). In October 2015, the EU Court of Justice ruledthat the Safe Harbor Agreement was invalid 22 because the data transferred from the EU could beaccessed by US government agencies beyond what is strictly necessary and proportional fornational security, the public interest, and law enforcement. Moreover, since the collection andadditional processing of personal data was part of US surveillance programs, the Court deemedthat people had no opportunities to access, revise, or delete their own data, or to receive
administrative or judicial assistance.
As US companies were no longer able to transfer data under the Safe Harbor Agreement,
Standard Contractual Clauses (SCC) and Binding Corporate Rules came to serve as the basis fordata transfers, but in July 2016, the European Commission adopted the Privacy Shield 23 as a new
19 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with

Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995.
20 EU MAG, “Launch of a New Framework for the Transfer of Personal Information between the EU and the US” (Vol. 54,
October 2016) https:eumag.jp/behind/d1016/ (retrieved August 22, 2022)
21 CJEU, Maximillian Schrems v Data Protection Commissioner, Case C-362/14, 2015.
For a commentary, see Hiroshi Miyashita, “EU-US Privacy Shield” (Keio Law Journal, No. 36, December 2016), pp. 145-179.
22 ICR – InfoCom Research, “On the European Court of Justice’s Judgment on the Invalidity of the Safe Harbor Agreement”(InfoCom Law Report, 2015) https:www.icr.co.jp/newsletter/law20151008-fujii.html (retrieved August 22, 2022)
23 Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European
Parliament and of the Council on the Adequacy of the Protection Provided by the EU-US Privacy Shield (notified underdocument C(2016) 4176)

15

transfer framework. The Privacy Shield mandates stronger measures to protect the data of EU
citizens, stipulating restrictions on and protection from access by US public authorities.
However, Schrems filed another complaint, citing concerns that even if data is transferred inaccordance with the Privacy Shield or SCC, they will not be adequately protected in the UnitedStates. Consequently, in July 2020, the European Court of Justice ruled the Privacy Shieldframework to be invalid (Schrem II 24). The reasons for this decision were 1) that it recognizes,
as with the Safe Harbor Agreement, that the needs of US national security, the public interest,and law enforcement take precedence over the fundamental rights of data subjects guaranteed
under the EU Charter of Fundamental Rights, 25 2) that Article 702 of the Foreign Intelligence
Surveillance Act (FISA), which is the basis for US intelligence activities, and Executive Order(E.O. 12333), are not limited to the minimum extent necessary in view of the principle ofproportionality under EU law, 26 and 3) that the system for submitting complaints in the event of
infringement is inadequate, not ensuring legal remedies for data subjects. 27 Meanwhile, theEuropean Commission’s decision 28 on SCC within the framework of the EU’s General Data
Protection Regulation (GDPR) 29 was found to be valid. An SCC is the conclusion of a contract
with a template clause recognized by the European Commission that faced extremely highhurdles prior to its introduction, but following the invalidation of the Privacy Shield, theEuropean Commission revised the SCC in June 2021. 30 The new SCC addresses a wide range ofdata transfer scenarios and complex data processing. Moreover, regarding the protection of
personal data, they included an article on security assurance to achieve the same level ofprotection as in the EU. The SCC is also designed to counter risks of personal data violations
due to government access, such as requiring the data importer to notify the data exporter when adata access request is received from the government of the country where the data istransferred.

24 CJEU, Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems, Case C-311/18, 2020)
25 Ibid., pp.164, 165.
26 Ibid., p.184.

27 Ibid., pp.191, 192; For a commentary, see Corporate Legal Navigation “Overview and Impact of the Invalidation of Privacy
Shield (Adequacy Decision to the United States): Ruling in Schrems II by the EU Court of Justice (2020) https: www.corporatelegal.jp/news/3604 (retrieved August 22, 2022)
28 Commission Decision of 5 February 2010 on Standard Contractual Clauses for the Transfer of Personal Data to Processors
Established in Third Countries under Directive 95/46/EC of the European Parliament and of the Council (notified underdocument C(2010) 593)
29 Japan External Trade Organization (JETRO), “About the EU General Data Protection Regulation (GDPR)”
https:www.jetro.go.jp/world/europe/eu/gdpr/ (retrieved August 22, 2022)
30 European Commission, “European Commission adopts new tools for safe exchanges of personal data,” 2021.

16

According to a survey in late 2020, SCC is the most used international data transfer mechanism,of particular importance for all kinds of businesses in Europe. 31

Case 6 【US-EU】 Requests for disclosure of data from abroad relevant to criminal
investigations (Microsoft case, CLOUD Act)The US government requested the disclosure of data stored outside the country.
In the United States, before the enactment of the Clarifying Lawful Overseas Use of Data Act(CLOUD Act) in 2018, the Stored Communications Act (“SCA” 18 U.S.C. §2703) 32 and otherlaws about the procedures for providers of telecommunications services and such to disclose
data did not explicitly include stipulations about US government agencies and data stored
outside the United States.
In 2013, US law enforcement agencies asked Microsoft to provide certain e-mail information,
but Microsoft argued that this was an unlawful extraterritorial application of the SCA as it
required disclosure of materials stored abroad, since the storage servers were located in Ireland,
and filed a petition for the warrant to be ruled invalid. The US District Court dismissed thepetition, but when Microsoft appealed, the US Court of Appeals for the Second Circuit

31 DIGITALEUROPE, “Schrems II Impact Survey Report,” 2020.

32 18 US Code Chapter 121 §2703 - Required Disclosure of Customer Communications or Records.)

17

recognized the company’s argument that the SCA applied to data stored within the UnitedStates (Microsoft case). 33
It was at this point that the US Congress enacted the CLOUD Act,34 which clearly stated thatwarrants under the SCA had extraterritorial validity, which meant that the Microsoft case was nolonger relevant. The CLOUD Act clarifies that the US government can force providers under
US jurisdiction to store, back up, and disclose data they store both domestically and abroad. 35
Communications service providers (CSPs) operating globally may be subject to the laws andregulations of multiple countries, which can cause conflicts between one government’s data
disclosure request and another country’s legal obligation to restrict data disclosure. 36 In somecases, such judicial conflicts can be resolved through a so-called mutual legal assistance treaty(MLAT), but since the acquisition of data goes through the courts and governments of othercountries, these procedures are complicated and take a long time. The CLOUD Act assumes
that the United States will conclude executive agreements with other countries that meet certain
standards such as respect for the rule of law and allows the governments of both countries toissue orders to submit electronic data directly to the CSP without having to go through the othergovernment. This eliminates the restrictions under US law and does away with judicial conflicts.
However, an agreement under the CLOUD Act does not impose an obligation on CSPs in the
United States and other countries to comply with the orders of other countries’ governments,
and it holds no jurisdiction over CSPs in other countries. 37 Moreover, data disclosure is limited
to purposes related to the prevention and investigation of terrorism and other serious crimes,
which means that existing high standards under US law must be met before disclosure ofelectronic data can be requested by law enforcement agencies. Moreover, a CSP that hasreceived a request to disclose data may file a petition in a US court within 14 days if it
reasonably believes that complying with the disclosure would entail a significant risk of violatinglaws in the other country, allowing it to seek a revision or revocation of the disclosure order. 38

33 United States v. Microsoft Corp., 829 F.3d 197 (2nd Cir. 2018)34 Enacted as part (Division V) of the Consolidated Appropriations Act 2018) on March 23, 2018.
35 CLOUD Act Sec.3(a)(1), 18 USC. Sec. 2713.

36 US Department of Justice “Promoting Public Safety, Privacy, and the Rule of Law Around the World: The Purpose andImpact of the CLOUD Act,” April 2019, pp.2-6.
37 Ibid., p.5. Moreover, the agreement does not require either government to force companies to comply with orders issued by
the other government.
38 CLOUD Act Sec.3(b), 18 USC. Sec. 2703(h).

18If the US government requires a Japanese company to disclose data under the CLOUD Act, thismay not be consistent with the Constitution of Japan and other domestic laws
(Telecommunications Business Act, Personal Information Protection Act, etc.). Moreover, if
Japan concludes an administrative agreement with the United States in the future, while thatwould facilitate the acquisition of cross-border data for investigation purposes, attention needs
to be paid to the impact it may have on other international agreements concluded by Japan.
Various legal issues need to be considered to realize the concept of Data Free Flow with Trust(DFFT) and to enable appropriate cooperation with investigations while also protecting data
subjects. 39

Case 7 【China】 Concerns about unlimited data acquisition by government under the

National Intelligence Law

In June 2017, China’s National Intelligence Law came into effect. 40 There have been concernsthat under this law, national intelligence agencies would have virtually unlimited government

access to related agencies, organizations, and individuals when conducting intelligence activities
at home and abroad.

39 Nishimura Institute of Advanced Legal Studies, Report of the CLOUD Act Study Group: Consideration of andRecommendations on Legal Issues Surrounding Investigations Involving Data Held by Companies (December 2019)40 Shikako Okamura, “China: Enactment of the National Intelligence Law" (Foreign Legislation, No.272-2, Aug. 2017)https:dl.ndl.go.jp/view/download/digidepo_10404463_po_02720209.pdf?contentNo=1 (retrieved August 22, 2022)

19

Article 7 of the National Intelligence Law stipulates that all organizations and individuals shallcooperate with the intelligence activities of the state in accordance with the law and shall beobliged to protect the confidentiality of the state’s intelligence activities, while the state shallprotect the organizations and individuals who have cooperated with the intelligence activities.41
China’s National Security Law, which came into force in 2015, defines national security in

Article 2 as the ability to maintain a safe state of “national administration, sovereignty, unity andterritorial integrity, social welfare, sustainable economic and social development and other vitalinterests of the country.” 42

Examining the National Intelligence Law on the premise that national security is definedbroadly to include general economic development, we can imagine how Chinese companies thatprovide telecommunications equipment in other countries may be legally obligated to provide
information and potentially forced to submit data obtained from the company’s

telecommunications equipment to the Chinese government without limitations. Therefore, theNational Intelligence Law effectively makes it possible for the Chinese government to acquire
personal and non-personal data not only from its own citizens, but also from citizens of othercountries who use the products of Chinese companies. The United States, citing national

security concerns, passed a bill prohibiting the certification of Chinese telecommunications
equipment makers, thereby increasing their exclusion from the US market. 43

41 National People’s Congress, "中华人民共和国国家情报法” (2018)42 Shikako Okamura, "China: Enactment of the National Security Law” (Foreign Legislation, No.264-2, Aug. 2015)

https:dl.ndl.go.jp/view/download/digidepo_9480563_po_02640209.pdf?contentNo=1 (retrieved August 22, 2022)

43 Taisei Toriyama, "US- and China-Made Telecommunications Equipment Exclusion Law Enacted: Huawei and others,” Nihon

Keizai Shimbun (November 12, 2021) https:www.nikkei.com/article/DGXZQOGN120MP0S1A111C2000000/ (retrieved
August 22, 2022)

20

Case 8 【Singapore】 Use of COVID-19 control app data for criminal investigations
The Singaporean government announced that data from a COVID-19 contact tracing app could
be used for criminal investigations.
In March 2020, Singapore began using TraceTogether, a government-approved contact tracing
app developed to combat the COVID-19 pandemic. As of March 2022, more than 90% of the
population have downloaded this app, 44 with hotels, restaurants, shopping malls, officebuildings, event venues, and many other places requiring the app for admission. 45
TraceTogether works by exchanging anonymous IDs with proxies using Bluetooth. 46 At initialuse, cell phone number and identification information are registered as user information andstored on a secure server together with randomly generated IDs. Personal location information
is not collected, and a temporary ID that is updated regularly is exchanged via Bluetooth among
terminals with the relevant application, located in short distance of each other. These
anonymous ID data are stored on each person’s device and are automatically deleted after 25
days. If a positive COVID-19 test results in a request from the Department of Health to sharedata, the data is manually uploaded, but if the data has not been uploaded to the Department of
Health’s servers, the app user may request that their identification data be deleted.
The app’s initial privacy policy stated that “all Bluetooth data shared with the Ministry of Healthwill only be used for COVID-19 contact tracing.” However, when a senior Singaporean
government official announced in January 2021 that “the Singapore Police have the authority toobtain all data, including from TraceTogether, for criminal investigations,” it was also noted thatparticipation in contact tracing was practically compulsory. Privacy concerns drew criticism.47
Following this announcement, TraceTogether’s privacy policy was amended to add that“exceptions are made only when data are required for investigations or criminal proceedings
relating to serious crimes as defined in the COVID-19 (Temporary Measures) Act.” 48

44 Instead of downloading the app, TraceTogether Tokens (small devices) can be used.

45 Embassy of Japan in Singapore, “COVID-19 Outbreak Alert (Part 43) (April 2021) https:www.sg.embjapan.go.jp/files/100182789.pdf (retrieved August 22, 2022)
46 TraceTogether Privacy Safeguards, https:www.tracetogether.gov.sg/common/privacystatement/index.html (retrieved August22, 2022)
47 MIT Technology Review, “Singapore Contact Tracking App Policy Shift, Made Available for Criminal Investigations"(January 2021) https:www.technologyreview.jp/s/230403/singapores-police-now-have-access-to-contact-tracing-data/ (retrieved
August 22, 2022)
48 COVID-19 (Temporary Measures) Act 2020 (No. 14 of 2020),
https:sso.agc.gov.sg/Act/COVID19TMA2020?ProvIds=P111-#P111- (retrieved August 22, 2022)

21

Privacy concerns have also been raised in countries other than Singapore where contact tracing
apps are used.

22

Appendix 2 (Summary)Discussion of government access safeguards that do not rely on personal and nonpersonal data
We discussed the “safeguards” required to determine the scope of appropriate government
access (elements that contribute to future discussions on appropriate rule formation). The
following shows the results of our analysis of safeguards related to the protection of personal
information, based on the content of past discussions on that scope and adding new original
interpretations (items 1 to 7, described in the text below).
The remaining items have been added as potential safeguards for government access of all typesof data, without distinguishing between personal and non-personal data.

1. Legal basis
Evaluation criteria: The legal basis for enforcing government access to personal data exists on
the part of the government that is providing access. Along with laws and regulations, bothprovisions for substantive data handling and procedures for access must be defined.
Significance and role: This provides procedures that prevent a government from exercising
powers arbitrarily by clarifying legal grounds for the processing of data on the part of thegovernment as well as improving predictability for data subjects and the private sector whose
data are accessed. The absence of government safeguards can cause atrophy and impede data
flow.
Relationship with other safeguards: It is anticipated that substantive content will be regulated by“necessity and proportionality” and procedural content by “approval and restriction” (bothdescribed below), which may cause some overlap with this element. However, considering thatgovernment access is permissible simply by preparing laws and regulations regardless of thecontent should be avoided, we also include rules concerning content in this element. Moreover,since both rules ensure predictability, there will be overlap with “transparency,” but theemphasis here is placed on curbing arbitrary exercise of authority by clarifying the legal basis on23the part of the government, while “transparency” is more focused on reducing the impact on data
subjects and the private sector whose data are accessed.
Relationship with other international rules: The idea that procedures for compulsory treatment
should be statutory is stipulated in Article 9 of the International Covenant on Civil and Political
Rights (ICCPR), for example.

Legal basis

2. Meet legitimate aims and be carried out in a necessary and proportionate manner
Evaluation criteria: The aims of government access need to be legitimate. The criteria for
judging legitimacy can vary across political systems. Regarding the need for means, government
access should contribute to the achievement of policy objectives, with no non-infringing means
available other than related government access. Regarding the proportionality of ends andmeans, the aims and means of government access should be balanced and the outcome (ordegree of infringement of rights and interests) should not be significantly disproportionate to
the ends achieved.
Significance and role: This is the core element for proper government access and should ensurethat the aims are not unjustified and that the legally protected interests of data subjects and the24private sector are not unnecessarily infringed upon, even if there are legitimate aims. It isnecessary to limit infringement of the rights of companies and individuals to the extent
necessary and reasonable to achieve the aims.
Relationship with other safeguards: The economic rationale of “the relationship between dataacquisition and the realization of the aims of government access should be strictly scrutinized
and rational” can be encompassed within this element.
Relationship with other international rules: The legitimacy and necessity of objectives are coreelements for assessing deviations from principles in trade rules (see discussions of general
exceptions in Article 20 of General Agreement on Tariffs and Trade [GATT] and Article 14 of
the General Agreement on Trade in Services [GATS]).

Legitimate aims, necessary and proportionate manner

3. Transparency
Evaluation criteria: The focus of evaluation is whether the laws and regulations that serve as thelegal basis are published and available to those whose data are accessed, and whether thecontent is detailed enough to judge whether these safeguards are satisfied. Moreover, whether
the government is proactive in disclosing the operational status of government access (number25

of cases, increasing and decreasing trends, breakdown of content) and whether data subjects
and the private sector, etc., are notified that government access has occurred to the extent that it
does not interfere with the aims of the government access should both be considered.
Significance and role: To determine whether data subjects and the private sector whose data areaccessed have received sufficient disclosure of the relevant laws and whether their content isdetailed enough to evaluate whether these safeguards are satisfied, it is crucial to ensure
opportunities to understand important information such as how much of your data is disclosed
and what assistance you can get. Moreover, the disclosure of access information by the state
allows citizens to supervise and thereby prevent abuse. Notification to data subjects and theprivate sector ensures that the data subjects know how their data are being accessed and offers
them the opportunity to check how it matches the elements of government access and to pursue
assistance regarding their rights.
Relationship to other safeguards: There is some overlap with “legal basis,” but see thedescription under “1) legal basis” for differences. Moreover, there was initial debate about
differentiating between predictability as an independent element and transparency, but we
decided to integrate them into this element. Here, we consider the predictability criterion to be
fulfilled if the rules are defined and published in enough detail that the data subject can accessthe rules and determine whether the safeguards are satisfied.
Relationship with other international rules: Article 10(1) of GATT stipulates that laws andadministrative decisions, etc., “shall be immediately made public in such a manner that they may
be known to governments and traders.”

Transparency
26

4. Approvals and constraints
Evaluation criteria: Procedural requirements for government access are in place and the content
of the procedural requirements is commensurate with the degree of infringement/intervention
on the rights of individuals. In particular, when the degree of infringement is large, approvalmust be obtained by an independent judicial or administrative body.
Significance and role: Stipulating due process, such as the approval of government agencies andindependent bodies that implement access, can meaningfully prevent infringement ofcompanies’ and individuals’ rights and interest by government access that does not satisfy thesafeguards. Trust can be ensured and the concerns of companies and individuals who arehesitant to submit data can be dispelled by making it clear that due process guarantees
protection against infringement of rights and interests.
Relationship with other international rules: Due process is regulated by Article 9 of the ICCPR.

Approvals and constraints

27

5. Limitation
Evaluation criteria: Data accessed must be identified and handled within the confines of therelevant aims (used according to the aims). Moreover, storage of the accessed data must be
evaluated in terms of the measures taken to ensure confidentiality, integrity, and useability.
Significance and role: This is to ensure that data collected through government access are used
for the aims identified by approvals and constraints and are also stored with appropriate
protection. The purpose of this policy is to prevent arbitrary use of data by public institutions by
ensuring that the data are handled appropriately within the scope initially envisioned even after
its provision, and to promote data flow by dispelling the concerns of data subjects and the private
sector.
Relationship with other international rules: Principles 4 (Use Limitation) and 5 (Security
Safeguards) of the OECD Guidelines on the protection of privacy stipulate related matters.

Limitation28

6. Independent oversight
Evaluation criteria: Data access, use, storage, and so forth must be supervised by anindependent organization after the fact.
Significance and role: Access should be supervised after the fact to evaluate whether thesafeguards relevant to government access are satisfied by a body independent of the government
agency implementing the access. Detecting after-the-fact infringement of the rights of data
subjects and the private sector due to unjustified government access that does not satisfy thesafeguards is significant because it becomes a cause for redress. By stipulating after-the-factprotection against infringement of rights and interests, trust is ensured, concerns of data subjects
and the private sector are dispelled, and data flow is secured.
Relationship with other international rules: The GDPR and other regulations have provisions
for supervision by independent supervisory bodies (e.g., the Data Protection Authorities[DPAs]).

Independent oversight29

7. Effective redress
Evaluation criteria: Regarding the above rules of access, use, storage, and so forth, legallybinding remedies that can be substantially employed by the data subject and the private sector
in the event of a violation by the government must exist. Remedies may include damages forrights and interests.
Significance and role: This ensures that the private sector and data subjects who have been
subjected to inappropriate government access are entitled to appropriate redress andcompensation, such as reversal of punishments.
Relationship with other safeguards: See “12) Compensation,” below, for a discussion of therelationship with “compensation.”
Relationship with other international rules: Article 10(3) of GATT states that “each contracting
party shall maintain, or institute as soon as practicable, judicial, arbitral or administrative
tribunals or procedures for the purpose, inter alia, of the prompt review and correction ofadministrative action relating to customs matters.” Article 14 of the ICCPR also provides for theright to a trial.

Effective redress30

8. Impartiality and non-discrimination
Evaluation criteria: Government access must not have competitive adverse effects (competitive
distortion) on the person whose data are accessed.
Significance and role: Government access is significant for ensuring equality of competitive
conditions between domestic and foreign companies as well as between foreign companies in
the market by not causing distortions with regards to the measure’s content (structure anddesign of measures). If there is a competitive distortion, companies and individuals may be cut
off from incentives for data collection (such as refraining from data collection or transfer for fearthat their own data will flow unfairly to competitors); hence, preventing this is important.
Relationship with other safeguards: There is some overlap with “uniformity.” This element
focuses on the “system and results of government access,” that is, the prevention of thecompetitive distortion effect of the structure and design of the measures themselves, orcompetitive distortion effects caused by the application of measures, while “uniformity” focuseson the appropriateness of the process by which measures are applied.
Relationship with other international rules: GATT and other international trade laws stipulate
principles of non-discrimination (Articles 1 and 3 of GATT, etc.).

Impartiality and non-discrimination

31

9. Uniformity
Evaluation criteria: Uniformity in the operation (process) of government access is ensured. With
Article 10, Paragraph 3 of the GATT in mind, how the legal system is operated can be acriterion for determining government access.
Significance and role: Apart from whether government access has competitive distortion effects,
arbitrary operation of the legal system regarding government access (non-uniform or impartial
interpretation and application of the legal system, etc.) can seriously harm predictability forcompanies, and consequently, dampen their economic activity. In particular, if such a risk exists
in a foreign market, companies will be reluctant to share or transfer data to that market, which
will have a negative impact on securing international data flow. To address these issues, apartfrom the competitive distortion effect of government access, the need for rules to regulate theprocedural appropriateness of government access was pointed out.
Relationship with other safeguards: See “8) Impartiality and non-discrimination.” Moreover, incases where the operation of the legal system regarding government access leads to different
interpretations and applications depending on the company in question, but if no competitive
distortion effects have occurred, this safeguard can be used rather than “impartiality and nondiscrimination.”
Relationship to other international rules: Article 10(3)(a) of GATT provides that “eachcontracting party shall administer in a uniform, impartial and reasonable manner all its laws,
regulations, decisions and rulings of the kind described in paragraph 1 of this Article.” Theintroductory clause of Article 20 of GATT also stipulates the same intent.

32

Uniformity

10. Fair and equitable treatment
Evaluation criteria: Treatment must not be arbitrary, unfair, unjust, or singular, and should not
be based on prejudice or discrimination against race, ethnicity, culture, religion, place ofresidence, or gender.
Significance and role: This regulates not only anti-competitiveness, but also a wider range offactors such as prejudice and injustice. Regulating a wider range of aspects will ensure trust in
how data are handled and promote data flow.
Relationship with other safeguards: Regarding the overlap with “impartiality and nondiscrimination,” the former focuses on anti-competitiveness, while this element is distinguishedby the fact that it regulates broader aspects such as injustice and prejudice.
Relationship to other international rules: Most investment protection treaties (Article 1105 of
the North American Free Trade Agreement [NAFTA]) include provisions for fair and equitable
treatment.

33

Fair and equitable treatment

11. Economic rationality
Evaluation criteria: To avoid imposing excessive costs and burdens on the private sector
regarding the provision of data.
Significance and role: By not imposing excessive costs and burdens regarding the provision ofdata on the private sector whose data are accessed, business disruption, infringement of rights,
and so forth are prevented. Moreover, by reducing the risk of being forced to bear excessive
costs and burdens, this safeguard mitigates concomitant atrophic effects of data collection andtransfer, thereby promoting data flow.
Relationship with other safeguards: “Compensation” and “economic rationality” are similar inthat the government provides compensation when excessive burdens are imposed on the private
sector and economic losses are incurred, even when government access is legal.

34

Economic rationality

12. Compensation
Evaluation criteria: Substantial compensation should be made to data subjects and the private
sector providing data in consideration of the economic value of the data. However,compensation does not allow improper government access that is restricted by other safeguards.
Significance and role: The purpose of forcing the government to pay for the use of data withasset value is to compensate data subjects and the private sector for their interests, in the same
way as property rights. Without such compensation, incentives for data collection in the
countries concerned will be reduced, and competition will also be hampered by the fact that data
can be used cheaply when shared among domestic companies. As a result, it becomes difficultfor private sector companies to develop their businesses, and data flow itself is hindered; thus,
preventing this is important. Alleviating concerns that the economic interests of private sector
companies will be impaired (data that can be sold for a fee will have to be provided free ofcharge) is also significant. Moreover, the content of “substantial compensation” is controversial;for example, it is necessary to judge whether compensation is always required (there may becases where compensation is not necessary), and if so, at what level (for example, market price,costs required). Such matters depend on how this term is interpreted.
Relationship with other safeguards: The relationship with “Effective redress” is as follows.
“Compensation” stipulates that substantial compensation is provide even in the case of lawful
government access, while “effective redress” is supposed to compensate for damages stemmingfrom illegal access.
35

Relationship with other international rules: Under customary international law, government
expropriations of corporate and personal property are required to be compensated for public
policy purposes, non-discriminatorily, sufficiently, effectively, and promptly. In the EU,
compensation is being discussed as one of the issues of B2G data sharing as data laws areamended.

Compensation

13. Limitation of liability
Evaluation criteria: There are legal limitations of liability for the body that submits the data andthe content of the data submitted (the reliability and quality of the data submitted and thelimitations of liability for infringement of the data subject’s rights). However, this does not
apply if the aims of the government access cannot be achieved without liability (such asproviding appropriate financial information for taxation).
Significance and role: Preventing the private sector and data subjects who provide data throughgovernment access from being held unfairly liable is important. If the above unfair liability were
to be imposed, the private sector would opt to not intermediate or transfer data, thus hindering
data flow.
Relationship with other international rules: The EU’s B2G data sharing element provides that“private companies and civil-society organizations should not be held liable for the quality of thedata in question or its use by public authorities for public-interest purposes.” 49
49 European Commission, Directorate-General for Communications Networks, Content and Technology, “Towards a European

strategy on business-to-government data sharing for the public interest: final report prepared by the High-Level Expert Group on
Business-to-Government Data Sharing,” Publications Office, 2021, p82, c), https://data.europa.eu/doi/10.2759/731415 (retrieved
August 22, 2022)

36

Limitation of liability

14. Conflicts of law
Evaluation criteria: To address conflicts of law arising from government access (inconsistencies
with other legal systems), ensure that compliance with laws and regulations in the country
where government access is implemented does not violate the laws and regulations of that orother countries. Mechanisms to address and resolve contradictions and conflicts in domestic andforeign legal systems should be established.
Significance and role: In the event of a conflict between the legal obligation to provide data via
government access and the legal obligation to prohibit data provision to a third party in anothercountry, reducing the burden on the private sector by making adjustments in advance isnecessary. If there is a legal system that causes such a conflict of law to occur, that risk of
conflict might cause business restrictions as the private companies hesitate to enter the market
and business development is hindered. The private companies could then be motivated tochange the location of their servers or abandon business development to avoid risk. This hinders
data flow.
Relationship with other international rules: Article 31 (International access and transfer) of the
EU Data Governance Act provides that public authorities, private companies, and individuals
should take all possible technical, legal, and organizational measures to avoid cross-border37

transfers of data so as to avoid conflict with laws in the EU or its member states. Here, it isstipulated that data may be transferred based on the request of a foreign government and soforth in exceptional cases where certain conditions are met, such as when there is a mutual legal
assistance treaty or when appropriate protection is provided in that foreign country.

Conflicts of law

38