Earlier quoted context omitted.
Your question at the moment is ill-defined. Carefully expand out the nationalities of the "you" who is buying the info, the nationalities of the person whom the info is about, the nationality of the subsidiary from which the information is being purchased, and the nationality under which you believe they should be suable. ("Jurisdiction", if you prefer, may replace "nationality".) There's a lot of combinations in the…
Chinese subsidiary, Chinese buyer, US citizen.
It seems odd that you're worried about China, when you live in a nation that has been proven to wiretap you by the government, and where private transactions are authorized based on information which three credit score companies store completely insecurely.