Data Privacy and Discovery Statutes and Case Law by Region in a Digital Asset Context (strictly explanatory summaries; not legal advice)
Christopher Clayton
01/04/2025
United States - Updated 1/8/2026
Hague Evidence Convention Article 23 - will consider all requests for the taking of pretrial evidence from foreign jurisdictions (no full exclusion or any qualified exclusions).
28 U.S. Code § 1781(b)(2) (Department of State can only receive requests, but this does not preclude "the transmittal of a letter rogatory or request directly from a tribunal in the United States to the foreign or international tribunal, officer, or agency to whom it is addressed and its return in the same manner").
28 U.S. Code § 1651 allows US Federal District Courts to issue writs in aid of their respective jurisdictions if based in the principles of law.
Bank Secrecy Act, 31 U.S.C. 5336(a)(3)(A)(i) provides definitions of a beneficial owner of a money transmission business. 12 C.F.R. § 208.63(b)(2) ("customer identification program") requires the maintenance of a "minimum" of information about customers as defined by 31 C.F.R. § 103.121(b)(2), including names, dates of birth and addresses. 31 C.F.R. § 1010.100(ff)(5)(i)(A) defines that a money transmission business need not be registered with FinCEN to be considered such an entity in a US jurisdictional context if it had significant business contact with the US, which includes activity related to the electronic transmission of currency substitutes (i.e. virtual currency). Administratively, the minimum customer retention standards have changed from 31 C.F.R. § 103.121(b)(2) to 31 C.F.R. § 1022.210(d)(1)(iv), but may still be referenced in the former way elsewhere in the Code as described.
18 U.S. Code § 1956(a)(1)(B)(i) regarding the knowing laundering of financial proceeds (funds or monetary instruments as defined by the Racketeering Act). 18 U.S. Code § 1956(b)(2)(A) defines jurisdiction of US district courts over a foreign person if they are served process via the Federal Rules of Civil Procedure or their residence's jurisdiction's process service procedures, and if the transaction involved the United States in whole or in part. 18 U.S. Code § 1956(c) defines a scope that includes the breaking of relevant US Federal, US State as well as foreign laws, and regardless if the person knew the form of original unlawful activity.
18 U.S. Code § 1964(c) defines a right of private action for matters covered by 18 U.S. Code § 1962 (linking to § 1961(1) for a summary of all relevantly covered laws), which includes access device fraud, the Racketeering Act and offenses indictable under The Bank Secrecy Act (Currency and Foreign Transactions Reporting Act).
18 U.S. Code § 1964(a) - US district courts are generally defined as having jurisdiction to prevent and restrain violations covered in 18 U.S. Code § 1962.
17 CFR § 180.1(a)(1) and 180.1(a)(2) regarding the use of artifices to effect a fraudulent commodity futures scheme in violation of the Commodity Exchange Act.
7 U.S.C. § 6b(a)(2)(B) regarding the right of private action under the Commodity Exchange Act.
Commodity Futures Trading Commission v. My Big Coin Pay Inc. et al., 1:18-cv-10077-RWZ, District of Massachusetts, Document 106, page 6. The existence of Bitcoin futures contracts was utilized to show that all virtual currencies are treatable as commodity futures as any type is "dealt in" per the Commodity Exchange Act's standards (all count as a commodity regardless of type or grade, etc.), and the Court agreed.
Cox v. CoinMarketCap, 3:21-cv-08197-SMB, D.C. No. 23-15363 (9th Cir. 2024), pages 10-20, 12th August 2024 held that the Commodity Exchange Act's long-arm clause (7 U.S.C. § 25(c)) cannot be construed as having a truly global reach (nationwide service of process only). If an entity is domiciled outside of the United States entirely, personal jurisdiction via minimum contact with the US as a national forum must be demonstrated.
Williams v. Binance, No. 22-972 (2d Cir. 2024), 8th March 2024 establishing that cryptocurrency transactions executed directly on a US DNS server (or that in all probability that the transactions were executed on a US DNS server) of a cryptocurrency platform is enough to establish personal jurisdiction over a relevant beneficial owner. That is, at least under the Securities Exchange Act for a harm alleged directly against a given entity in question (nationwide service of process clause of the Statute under a minimum contacts standard with the US as a forum), and so long as litigation is launched within the statute of limitations of the Act.
Alibaba Group Holding Limited v. Alibabacoin Foundation, 18-CV-2897 (JPO), S.D.N.Y., Document 137, page 9, 22nd October 2018 held that New York's long-arm Statute applied against a Defendant when one or more New York residents purchased a product on a website, so long as reasonableness and likelihood of success of litigation existed in the circumstances of a given case. That case involved cryptocurrency sales alleged to have violated Alibaba's trademarks (naming/branding) which New York citizens had provably purchased online, despite the lack of physical presence of the Defendant seller in New York (Internet activity basis to establish specific personal jurisdiction). Alibaba Group showed evidence that a substantial number of New Yorkers had purchased such infringing cryptocurrency coins.
Among various cases dealing with third-party discovery of cryptocurrency wallet holders' identities, SingularDTV GmbH v. Doe, Southern District of New York, 26th October 2022 specifically found that though Google LLC and Binance were properly served subpoenas in that case, and they complied, two other innocent third-parties moved to quash the particular subpoenas they received. Documents and information requested 'swept broadly,' including for detailed financial transaction information. Those specific third parties were not proven to have non-publicly available information; and the pursuit of discovering other activities unrelated to the case would not help further identify Defendants, despite an established cause for action.
One of, if not the first, U.S. Federal District Court civil cases to find for the validity of deponing a cryptocurrency exchange as a relevant third-party entity in that context, ZG Top v. Does, 2:19-cv-00092-RAJ, W.D. Wash., 22 January 2019 went into a request for voluntary dismissal by Document 9. The above example case also ultimately went into closure.
Birmingham v. ROFX.net, 1:21-cv-23472-RNS, 29 September 2021 achieved a granting of service of process via mail to various identified Defendants by Document 36 (in-line with their jurisdictions' stances on the Hague Service Convention) and achieved dispositive judgment decisions by Document 253. However, much if not all of the groundwork for identifying Defendants had taken place via US Federal government investigative and lawsuit action.
Osterer v. Bam Trading Services Inc., 1:23-cv-22083-RAR, S.D. Fl., 5 June 2023 finally reached a stage of arbitration with BAM Trading (Binance's US operational entity for the Binance.US platform) and Binance Holdings Limited in June 2025 (Joint Status Report, Document 95). However, because of the question of personal jurisdiction (assets of US persons were actually taken to the Binance.com platform), arbitration was compelled in Document 39 regarding discovery matters (finding out users who took the putative class of Plaintiffs' cryptocurrency regarding Plaintiffs joined to the case at that point). The case was stayed and initially Plaintiffs did not undergo arbitration, instead opting to begin a spin-off case with largely the same subject matter (Martin v. Binance, 2:24-cv-01264-BJR, W.D. Wash.) based upon Binance having utilized WA State DNS infrastructure to operate Binance.com (Amazon Web Services), similar to the argument in William v. Binance but in a different context (class action Federal Question basis rather than the Securities Exchange Act). By Document 75, this spin-off case was closed via Document 75 on the first-to-file basis (remanded back to S.D. Fl.), finally leading to the apparent decision to launch arbitration. The remaining S.D. Fl. case is worth monitoring because the cause of action is ultimately based on disgorging profits from Binance (that in itself as correcting Binance's harm of allowing money laundering to take place on its platform per the results of United States v. Binance, 2:23-cr-00178-RAJ, Document 35). However, underlying harm is ultimately alleged as having taken place by Binance.com users and the discovery issue involves identifying more putative class members. I'm not sure how that can take place unless this involves attempting to discover Binance.com users or back-tracing suspicious final cryptocurrency transactions to source locations. I'd look out for the Complaint being amended (or a request for leave for amendment being filed) to potentially change the basis of harm depending on how arbitration proceeds, or perhaps adding user Defendants if any are identified.
United States v. Any and all virtual currency on deposit in Binance Account associated with user ID 16130005, Eastern District of New York, 24-CV-8514, December 2024 is an example of modern criminal litigation action for in rem seizure in a digital asset context under 18 U.S.C. Section 1343 and Section 981 (action to seize property derived from a fraudulent artifice). The action resulted in cryptocurrency account assets that were in part plausibly related to the Osterer case being seized, or which could be used toward compensating for original stolen assets which were ultimately taken to that account via a series of mid-point transactions found to be related to the original fraud event involving a classic computer screen takeover scam. A purported invitation to make a victim's remission claim on related assets per Document 96 of Osterer was made. Cryptocurrency tracers determined the relevancy of the mid-point transactions so it must have involved Federal investigators hiring or using in-house tracers.
Non-privileged data disclosure in private civil cases – Check Federal Court tests for finding the validity of the non-privileged release of data about unidentified Defendants from third-parties (e.g. customer data) as utilized in the Doe cases cited here. I.e., the three-part test regarding unidentified Defendants accused of fraud involves specifically defining the Defendants, showing previous attempts taken at attaining their identification and defining the accusation of fraud with particularity per FRCP Rule 9(b).
Duty of care - Check standards by U.S. State and look out for concepts such as determining whether a duty of care exists at all versus the factual particulars for scope of breach, causation and damages (basis for duty of care at all versus an ideally jury-reviewed exact factual basis); common law basis for duty of care (established relationships or where a relationship is expected); public policy basis for duty of care regardless of direct or special relationships (in Statute or after care has been taken to establish that a duty exists in the public mind without a doubt otherwise). See also the concept of 'negligence per se' as establishing a civil tort harm due to the violation of a Federal Statute in itself that may apply even in a State Court context if harm can be described. Also, check if a State explicitly disregards the breaking of administrative regulations in its precedent (solely focused on legislative sources of authority).
While US State Courts may typically handle common law tort matters such as duty of care, including implied duties to third parties over Statutory violations (negligence) and the standards for when such a liability might exist, some laws can still trump that concept. E.g., 47 U.S.C. Section 230 regarding Internet service companies bars ANY liability for third-party content. No law (Federal, State, etc.) or tort conception that predicates third-party harm can overcome this (merely a publisher and thus 'content neutral' even when knowingly taking standard service fees unless the service provider was directly knowingly involved producing the content or benefitting from it/specially promoting it in some way). However, Murphy v. Twitter, 60 Cal.App.5th, page 29 in particular defined that a contract with a specifically designated beneficiary such that the clause acted as a specific promise or offer to such persons can trump such conditions. This was part of the finding that Twitter's employment of general policies to remove user content under certain conditions (namely, hateful and threatening content) did not create liabilities to specific users when disputes erupt over the justification for such removals.
Cognizable harm - Check case precedent at the Federal or State level for whether cognizable harm applies (whether a basis for individual harm can be established for the purposes of legal judgment that comports with precedent in that forum), which can supersede Statute-defined rights of private action and Statute-defined damages. Versus damages or other remedies that may be more effectively determinable via breach of contract (arbitrable dispute) and so where a Court's ability to compel arbitration as needed may apply. That is, liability in a private civil context over Statutory violations, such as an implied duty of care to impacted third-parties, may not exist at the US Federal District Court level because of a lack of basis in direct harm over the violation, but equitable remedies may apply. E.g. where a duty to disclose information is defined in civil procedures or to correct inaccuracies in currently-provided deposition (namely, FRCP Rule 26(e) and State equivalents) which might be enforced for productive response via threat of sanctions if personal jurisdiction applies. The litigant would not benefit from sanction fines directly except insofar as ensuring that maximally productive responses could be yielded within the bounds of what the Court finds would constitute as complete of a response or supplementation as can be done without a risk of enforcing a particular Statutory standard in a way that may rely on implied duties to third-parties. Or where an arbitrator could recommend such sanctions for the litigant to then go to an appropriate Court for an application to enforce such an arbitral result, including if a contract defines equitable duties to specific beneficiaries (e.g., duties to correct information records to a reasonable degree and effort when 'any person' brings up a claim of inaccuracy over domain name contact information per ICANN's RAA # 3.7.8).
Recognition of foreign judgments - At the US State level but where most US States are part of one or the other (or both) US State uniform standards (United States at the Federal level is not acceded to the Hague Judgments Convention).
Deposition of non-US entities - Look carefully at modern US Federal District Court case precedent as to when balance of interest tests in an international comity sense may be employed at all to find for allowance to depose a third party in an alternate location due to blocking laws. I.e., under what conditions it can be shown for Federal District Courts to find in favor of another deposition solution besides going through the Hague Evidence Convention. Further, especially in regards to Judgment Creditor situations involving banks, as to when it might be enforced for a US counterparty entity to be deposed over an overseas counterparty entity's data, especially where US law and the overseas law on disclosure are similar. When personal jurisdiction is not in question, Aerospatiale held that the Hague Evidence Convention does not have to be considered toward a decision to enforce depositional responses from non-US entities, but lower court (US Federal District Court) cases gradually started to winnow the precedent anyway. Particularly at first where some decisions started to include the Evidence Convention as a comity factor valid for due consideration, even if as a 'neutral' factor.
Supplementation and correction of inaccuracies in discovery materials as a duty in further detail - Federal Rules of Civil Procedure Rule 26(e) generally outlines that inaccuracies in deposition materials that become known to a deposed party should be addressed. However, the advisory commentary errs towards parties working out disputes on their own (via conferencing or otherwise) and that enforcement should only occur in 'limited instances'. Further within the advisory commentary, guaranteed 'ongoing' duties are only defined in terms of identifying witnesses who have knowledge of discoverable materials; any other assertion of ongoing duties can be challenged. FRCP Rule 37(2) indicates that discovery controversies involving non-parties (third-parties) need to be moved to the relevant Court system where discovery was taken if different from the jurisdiction of the cause of action (consistency in domestication of discovery actions). Checking specific US State civil procedural rules is then important given the likelihood in modern Internet controversies of needing to depose third-party entities in US Federal private civil cases, as well as other countries' systems in terms of applying for relevant equitable relief (jurisdiction change around such issues depending on principal place of business of a third-party entity relative to the originating cause of action, such as harm asserted against a third-party's customers).
Showing the need for cross-judicial Letters of Request in Federal private civil cases - Because the United States tends to rely on discovery matters being resolved directly between parties, alongside the complications of attaining discovery from third parties relative to an originating cause of action per FRCP Rule 37(2), the enforceability of Rule 45 FRCP subpoenas sent across borders via the Hague Service process without the benefit of utilizing the Hague Evidence process comes into question. On top of that, other regions may take Hague Evidence Convention Article 1 literally in barring Plaintiffs or Plaintiffs' attorneys from directly utilizing the Hague Evidence process (only 'Contracting States' can send such requests in a strict reading; in a private civil context this means the Judge of a foreign case). As defined previously in this section, the United States also doesn't require US Tribunals to send Letters of Request; it's merely an option they have and the Department of State also won't send such Letters itself.
In light of these limitations, see the example of a case such as In Re Baycol Products Litigation, 348 F. Supp. 2d 1058 (D. Minn. 2004), Pretrial Order No. 133 regarding the transmittal and issuance of a Letter of Request towards attaining thousands of pages of documents. In regard to the subject matter of that case, the decision analyzed the importance of evidence sought, the specificity of the particular evidence request, whether the information originated in the United States, the availability of alternate means of information procurement, the balance of interests between the United States and the targeted state for information gathering and the third-party status of the targeted entity for information (page 3) to find in favor of sending a Letter of Request to Italy's Central Authority. Such a decision even took place in spite of Italy's full exclusion of Hague Evidence Convention Article 23 (barring of all pre-trial evidence requests) by concluding that a strict reading of 'pre-trial' in that context likely referred to the lack of a start of an originating formal cause of action at all to begin with.
United States 47 U.S.C. § 230 in further detail ('safe harbor') - added 12/12/2025
Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009) held that an individual promise establishing liability to remove third-party content from a website did not overcome treating Yahoo! as a publisher after a positive lower Court decision (an individual promise by a corporate officer; not necessarily even involving a general Terms of Service clause). However, this at least showed that a Federal Court of Appeals was willing to consider contracts as a source for a duty.
Balsam v. Tucows Inc., 627 F.3d 1158, 1163 (9th Cir. 2010) considered the liability of a registrar entity under ICANN's Registrar Accreditation Agreement # 3.7.7.3 for the content published by a domain licensee. The primary issue with the claim cited as part of the ruling was that the clause defines liability against a domain registrant (Registered Name Holder) and not registrars. A registrar then falls out of contractual scope as a third-party, where California's contract law upholds general 'no third-party benefits' contract clauses. The clause answers the who, what, and for whom in regard to duties, but the correct type of entity had not been targeted. The decision otherwise did not directly review Section 230 in any way regarding the extent to which such a clause might be able to overcome Section 230 (broad 'acceptance for liability' mandated in the clause if a domain licensee cannot be identified when a party brings evidence of actionable harm). However, an idea of what may be possible in civil or arbitral cases that do target correct entities according to the exact clause cited is also outlined in that contract. Registrars control registrant contact data according to RAA # 3.7.8 and a registrant that sub-licenses use of a domain (such as a proxy service) must collect Personal Data in the same way as registrars per RAA # 3.7.7.6 (direct business data contractually defined as under such entities' full control as part of taking on customers).
Murphy v. Twitter, supra, 60 Cal.App.5th, 22nd January 2021, page 29 described specifically defined, contractual offers or promises to specifically named classes of people as a method of avoiding treating an Internet service company as a publisher. However, the circumstances of the case entailed a general Terms of Service clause which was found to fall out of scope (Twitter removed certain tweets that it found objectionable according to its own self-created Terms and refused to restore the content).
Wozniak v. YouTube, LLC, 3/15/24 CA6, H050042 exactly cited Murphy v. Twitter amidst rejecting many other forms of relief that would entail treating YouTube as a publisher. E.g., merely taking fees from known objectionable content makers would fall into protective scope ('content neutrality') unless there was direct, knowing collaboration with such creators.
Facebook Inc. v. Namecheap Inc., No. 2:20-cv-00470-GMS (D. Ariz. Nov. 10, 2020) involved a trademark dispute over Namecheap's proxy service allowing unidentified actors to violate Meta's trademarks. Thus, ICANN's RAA # 3.7.7.3 was cited in the cause of action (liability over the harm caused). Document 52 (Order) found that the proxy service, as a related entity to Namecheap, had incorporated ICANN's contract into its Terms, that personal jurisdiction applied in D. Ariz. due to the contractual forum selection clause, and that Meta was meant to benefit as a third-party even in spite of the proxy service entering into separate agreements with licensees. However, the Complaint had to be amended because liability was aimed at the parent Namecheap itself which triggered a review of alter ego, with such a standard requiring evidence to be shown that Namecheap knowingly participated in the proxy service's activities and that the entities were related. The case reportedly reached a settlement (Document 187). Otherwise, at least in terms of Document 52, Section 230 was not directly addressed in terms of what sort of liability may be enforceable.
See generally The Georgetown Journal of Law and Public Policy, https://www.law.georgetown.edu/public-policy-journal/blog/is-it-possible-to-circumvent-%C2%A7-230-with-contract-claims/ (accessed 21 November 2025) for a delineation of the concept of certain cases being treated as mere content moderation disputes (lack of any liability by Internet service companies) versus cases meant to uphold honesty in commercial dealings.
People's Republic of China (mainland) - Updated 12/26/2025
HHague Evidence Convention Article 23 - 12/26/2025 revision - On a re-reading of mainland China's HCCH.net page for the Evidence Convention since I originally wrote this note, the exclusion does allow consideration of requests for documents clearly enumerated in a Letter of Request with close relation to the case at hand (https://www.hcch.net/en/instruments/conventions/status-table/notifications/?csid=493&disp=resdn). Citations of State secrets or other sensitive matters from other laws can still be cited in a refusal, but on review the Article 23 stance functions as a qualified exclusion. I had somehow interpreted it as a 'full exclusion' before.
Hague Service Convention Article 10 - Full exclusion (direct service of process of documents via mail, among other alternate means of service defined in the sub-paragraphs, is not allowed). All requests to serve process must pass through the intake authority acting on behalf of the Central Authority (International Legal and Cooperation Center in Beijing).
The Civil Code (version as adopted on May 28th, 2024), Article 148 (English version) establishes the right for a party to request a People's Court or arbitration institution to revoke a "civil juristic act" that a counterparty induced a victimized party to execute via fraudulent means.
The Supreme People's Court released guidance on February 25th, 2022 (Question 4, < https://www.court.gov.cn/zixun-xiangqing-347211.html>), in essence stating that a party to a contract has the burden of proving that fraud occurred (that a counterparty intentionally acted in bad faith (appearance of agency) when a civil legal act was performed). These types of online Court guidelines are periodically geo-blocked from view by certain IP addresses (e.g. USA IP addresses).
The Civil Procedure Law Article 221 (English version; different number in the Mandarin version) defines that a relevant People's Court is empowered to freeze and/or transfer bank and credit cooperative assets of a subject who has refused to fulfill the obligations of an execution notice, up to a value within the scope of such obligations. Article 5 establishes the litigation rights of aliens (people and organizations not residing in or incorporated in China).
Recognition of foreign judgments – Not acceded to the Hague Judgments Convention; recognition takes place via bilateral treaty or mutual recognition (certainty that a similar judgment would be rendered in the other given country; establishment of the other given country ruling in favor of Chinese litigants; etc.). Intermediary People's Courts generally handle applications for recognition of foreign judgments. China and the United States generally have reached the level of mutual recognition as of 2017 via mutual action, but then access to Chinese Courts is another matter (potential geo-blocking).
Anti-Money Laundering Law (English version) - Article 3 establishes recordkeeping requirements for financial institutions, including clients' identities, and Article 5 allows for information disclosure to individuals 'in accordance with the provisions of law. ' Article 27 allows for cooperation on the basis of reciprocity with other countries. The Law's investigative protocols and recordkeeping clauses focus on criminal activity.
Personal Information Protection Law - Article 25 (English version) seemingly excludes any information disclosures 'except where separate consents has been obtained from the individuals.' However, in Article 27, a data holder can seemingly release data non-consensually if it would not significantly impact the rights of the individual related to the data. Article 38 sets conditions for cross-border personally identifiable information sharing; including the information processor going through a security assessment, attaining a cyberspace security certificate, concluding a standard cyberspace department contract with the overseas recipient or meeting other legal conditions in the alternate (only one method has to be followed). Article 41 requires that requests from foreign Courts or foreign law enforcement bodies be handled by competent authorities (thus referring back to Hague Evidence Convention protocols for pursuing information for civil case matters; if such requests can even overcome blocking laws).
United Kingdom and British Commonwealth legal principles – updated 10/17/2025
Six-year limitations period in civil actionable causes.
Norwich Pharmacal Co. v Customs and Excise Commissioners (now available as a standard request for a Norwich injunction), establishing precedent to seek information about wrong-doers from third-parties innocently mixed up in a situation. The information requested must be specific, related to an established actionable cause and entail proof that the third-party was mixed up in the situation.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, paragraph 40(3) stipulates storage of personal information related to financial transactions.
Data Protection Act 2018 paragraph 94(6)(b) allows disclosure of personally identifiable information without consent of the person in question whose data was stored if disclosed for a valid reason.
Chandler v Cape Plc, Court of Appeal, <2012> EWCA Civ 525, paragraph 80, 25th April 2012 established a knowledge and superior standing test for duty of care of a UK parent company for matters involving its subsidiaries (Petitioner's exposure to asbestos as a subsidiary employee and the parent company's expertise in that subject).
Shlaimoun and another v Mining Technologies International Inc <2011> EWHC 3278 (QB) decided in favor of Norwich Pharmacal disclosure in support of an originating foreign proceeding (Canada originating case).
However, Green v CT Group Holdings Limited [2023] EWHC 3168 (Comm) held against Norwich relief in support of foreign proceedings (evidence demanded from a UK entity) where no underlying claim has been reasonably contemplated in a UK jurisdictional sense (i.e., no claim shown against UK entities or assets). The Statutory methods of obtaining evidence were held to be exclusive in such a circumstance (i.e. through formal Court-to-Court Letters of Request for civil evidence).
AA v Persons Unknown & Ors, High Court of Justice, <2019> EWHC 3556 (Comm), paragraph 59, 13 December 2019 established precedent in the UK for cryptocurrency to be treated as intangible personal property (Bitcoin transferred to the Bitfinex platform via bribery).
Sally Jayne Danisz v (1) Persons Unknown (2) Huobi Global Ltd, High Court of Justice, <2022> EWHC 280 (QB), 20 January 2022 (private ex parte hearing) ordered Huobi Global Ltd (Seychelles) to disclose payment data tied to pseudonymous persons from the Huobi (HTX) cryptocurrency platform (Bitcoin transferred to HTX via fraudulent trade mechanisms).
Hague Evidence Convention Article 23 - foreign Courts can seek information from third-party entities regarding pre-trial evidence so long as the evidence is specific (not inquiring of the existence of evidence in the first place) and that the information reasonably exists in the jurisdiction (qualified exclusion of blanket common law capabilities of foreign Courts to seek pre-trial evidence). Requests must pass through the Central Authority.
Hague Service Convention Article 10 - At least for service of process (not evidence requests), direct service of documents by mail among other alternate methods of service of process as defined in the sub-paragraphs is allowed (no full or partial exclusions).
Recognition of foreign judgments - Application for recognition as common law debt collection unless another convention or treaty applies. Otherwise, the UK ascribed to the Hague Judgments Convention in 2019 and it is due to come into force on July 1st, 2025 but where it may only foreseeably apply to England and Wales.
Check for explicit private rights of action in Statutes in British Commonwealth-adjacent jurisdictions which then may provide a basis for claiming an entity's responsibility over harms caused by third parties mixed up with the entity (negligence). Such an implied right of action and responsibility under a Statute in a private civil context may not exist otherwise. Besides that, look for an authority that defines specific intended beneficiaries such as the Norwich precedent which also functions as an injunctive mechanism in various such jurisdictions. I.e., an authority for entitlement to equitable relief (to evidence identifying third parties) in private civil cases where the injunctive mechanism may provide for the threat of sanctions (threat of Court fines) to enforce responses, but where an expectation for guaranteed exact accuracy of evidence up to particular standards (such as up to Know Your Customer laws) may not be enforceable.
Hong Kong SAR
Inherited Norwich precedent and injunctive relief Order mechanism.
As a special administrative region of the People's Republic of China, it retained the UK's Hague Evidence Convention Article 23 stance.
Hague Service Convention Article 10 - At least for service of process (not evidence requests), direct service of documents by mail among other alternate methods of service of process as defined in the sub-paragraphs is allowed (no full or partial exclusions).
Limitation Ordinance paragraph 4 for contract and tort harms - six years; same UK standard.
Cap. 615 Anti-Money Laundering and Counter-Terrorist Financing Ordinance Schedule 2, Part 1, Division 2, paragraph 13(A)(2) regarding information retention of customer data for virtual asset service providers. Schedule 1, Part 1, Division 2, paragraph 53F also establishes enforcement against non-licensees for money transmission activities.
Evidence Ordinance (Cap. 8) paragraph 75(b) (evidence can be requested in support of a civil actionable cause already underway in a foreign Court). Paragraph 76(4) establishes that the specific information sought must be found to be reasonably accessible by the targeted legal entity.
Contracts (Rights of Third Parties) Ordinance paragraph 4 requires third-parties to either be explicitly named in a contract, or to be part of a specifically defined class, in order to claim benefits under such a contract (arbitrable claim when moving through a non-Court legal route; i.e. if Hong Kong is named as the seat for arbitration). The law establishes a general limiting principle where if third parties were not intended to be able to claim benefits under a contract, then they cannot claim any. Simultaneously, a third-party need not have existed prior to the contract's existence in order for such a third-party to claim a benefit.
Re Gatecoin Limited (In Liquidation), Court of First Instance, <2023> HKCFI 914, paragraphs 8, 47-48, 57-59; 31 March 2023 held cryptocurrency to be intangible personal property in a Hong Kong context, citing in part UK precedent (disposition of cryptocurrency held on the defunct Gatecoin platform for various users, including for a US company).
Yung Wai Tak Abraham William v Natural Dairy (NZ) Holdings Limited (in Provisional Liquidation), Court of First Instance, <2020> HKCFI 2067, paragraphs 47-49, 17 August 2020 highlights a test for parent company liability in Hong Kong over matters overlapping with a subsidiary; namely, background context including full range of documentary evidence and pattern of conduct as a contract (that Plaintiff's de facto double source of employment).
Chan Yim Wah v New World First Ferry Services Ltd, Court of First Instance, HCPI820/2013, paragraphs 2, 26, 43, 85; 5 August 2015 highlights circumstances under which Hong Kong's High Court may exercise discretion to find that Norwich precedent for disclosure from third parties meets the threshold for exemption in privacy protection laws. That Plaintiff sought in part from the non-party Hong Kong Marine Department the identity of the owner of the vessel involved in her personal injury claim after the Department's investigation of the related accident.
Recognition of foreign judgments - Application for recognition as common law debt collection unless a bilateral treaty applies. Not ascribed to the Hague Judgments Convention.
Cayman Islands
Inherited Norwich precedent and injunctive relief Order mechanism.
The territory inherited the UK's Hague Evidence Convention Article 23 stance.
Hague Service Convention Article 10 - At least for service of process (not evidence requests), direct service of documents by mail among other alternate methods of service of process as defined in the sub-paragraphs is allowed (no full or partial exclusions).
Limitations Law paragraph 6 for tort harms - six years; same UK standard.
The Anti-Money Laundering Regulations (2023 Revision; previous most-recent revisions having taken place in 2020), paragraph 36(2) regarding general data collection and retention obligations around customers (regarding any transfers of funds), paragraph 49D(1) regarding specific data retention obligations of virtual asset businesses; and paragraph 32 where even if the corporate legal entity ("person") is not a licensee, the principal of the person must maintain record-keeping procedures.
Law 23 of 2016, paragraph 3(1)(j) allows disclosure under "any other law" not otherwise described.
ArcelorMittal USA LLC v Essar Global Fund Limited & or, Appeal No 15 of 2019, judged 3 May 2021, page 28 for "equitable remedy in discovery" even toward a potentially foreign proceeding without requiring an Evidentiary Order.
Republic of Seychelles
The Virtual Asset Service Providers Act 2024, paragraph 45B stipulates that virtual asset service providers must keep note of the wallet addresses, names, physical addresses, government issued IDs, etc. of transaction originators. International business companies can apply for a virtual asset services business license per paragraph 6(3)(b). Paragraph 8(3) stipulates that websites must prominently display such a license.
The original Anti-Money Laundering and Countering the Financing of Terrorism Act, 2020 paragraph 45 stipulates that customer data concerning wire transmissions must be retained.
The Data Protection Act indicates that the Information Commissioner can demand companies to disclose personally identifiable information.
Hague Evidence Convention Article 23 is fully excluded (no possibility for foreign Courts to make requests for pre-trial evidence in any way), but the country is otherwise ascended to the Convention.
Hague Service Convention Article 10 - No opposition to sub-paragraph (a) (direct service of process via registered mail, at least outside of evidence requests).
St. Kitts and Nevis
CAP 5.09 Limitation Law Part II(4)(2) - six-year limitations period in civil matters; same as the UK standard.
The Proceeds of Crime Act Cap. 4.28 requires money transmission businesses to comply with certain provisions (paragraph 198), and provides guidelines for verifying customers such as name and physical address (paragraph 79).
The Protection Act allows data disclosure by law or Court order (paragraph 19(b)(ii)), but simultaneously seemingly bars disclosure to third parties regardless unless the data user voluntarily offers such data (paragraph 9(b)).
The country is not ascribed to the Hague Evidence Convention at all, nor to the Hague Service Convention.
British Virgin Islands
Inherited Norwich precedent and injunctive relief Order mechanism.
The territory inherited the UK's Hague Evidence Convention Article 23 stance.
Hague Service Convention Article 10 - At least for service of process (not evidence requests), direct service of documents by mail among other alternate methods of service of process as defined in the sub-paragraphs is allowed (no full or partial exclusions).
The Anti-Money Laundering Regulations, 2020 paragraph 2 describes what counts as a beneficial owner (owner or controller of an applicant for business). Paragraph 16(2)(a)(iii) describes that staff must be trained on customer identification, record keeping and other procedures.
The Data Protection Act, 2021 outlines disclosure procedures including that a data subject must be informed of the class of third-parties that the data is being disclosed to; 8(1)(d), which is the only class of third-parties that may be informed. Per 8(1)(e), a data subject must be informed if the disclosure is voluntary or obligatory. Paragraph 9 does not allow disclosure to third-parties except as defined in 8(1)(d).