Law & Society

China has not issued a special Privacy Law or Data Protection Law so far. However, there are several PRC laws and regulations including privacy or data protection articles which consist of the current legal basis of privacy and data protection and infringement prohibition and punishment, including:

- Article 38 and Article 40 of the PRC Constitution – under which the personal dignity and the freedom and privacy of correspondence of citizens of the PRC are recognized and protected, although an express constitutional right to privacy is not established by these provisions.

- Article 120 of the General Principles of the PRC Civil Law – which recognizes the right to identity and the right to protection of a person’s name, portrait, reputation or honor.
- Article 253 of the PRC Criminal Law – which was amended by the Chinese legislature on 28 February 2009, to make working personnel of state agencies and organizations in the fields of finance, telecom, transportation, education or healthcare, potentially subject to criminal liability if they sell or illegally provide to others, the personal information of citizens obtained during the course of such organization’s performance of their official duties or provision of services.

- Article 1 of the Interpretation of the Supreme People’s Court on Issues Regarding the Ascertainment of Liability for Compensation for Psychological Damages in Civil Torts – which grants a person whose privacy has been infringed, a right to claim for psychological damages.
A Recent Landmark Criminal Case in China

On 5 August 2010, the Shanghai Pudong New District Court heard a case involving 10 respondents who were suspected of the crime of illegal obtaining personal information. After 3.5 hours’ of testimony and argument, the court decided that all 10 respondents had committed the crime of illegal obtaining personal information. The court sentenced 9 of the defendants to jail terms of six months with a six-month reprieve for two years and imposed fines of RMB10,000 to 40,000. One defendant was exempted from criminal punishment by the court.

Case History

In February 2005, Zhou Juan registered Shanghai Taimeng Information Technology Co., Ltd. (“Taimeng company”), and hired some of her relatives, including Li Zhizhao, Zhang Wei, Hu Meizhen, Li Xuehua, Zhang Xiu, Wang Kaisheng, etc. to buy and sell company information and personal information via the internet.

Zhou Juan got someone to create the company websites and posted topics on the net to solicit business. Unexpectedly, she was overwhelmed with clients. Zhou Juan always “sold goods” on the net, negotiated the price with her clients via phone or QQ and then sent the “goods” to her clients – this was all aimed at gathering personal information about the clients. At the same time, she always “bought goods”, to update the personal information of companies and managers.

Zhou Juan did not open an account using her own ID card, so as to not remain anonymous, but opened accounts in the name of Hu Meizhen, Wang Kaisheng, etc to collect money. Her colleague, Li Zhizhao was in charge of the sale of personal information associated with property owners, car owners, credit card users, and independently “bought goods” and “sold goods” on the internet, for the purposes of gathering personal information for selling. Zhang Wei was in charge of the collection of payment for goods sold by Li Zhizhao, and then passed the money to Zhou Juan for distribution. Zhou Juan told the public security authorities that she had made a profit from her activities in the vicinity of RMB1, 000,000 since 2005.

In June 2008, Li Zhizhao, along with Zhang Wei and Zhang Xiu left Taimeng company and started a competitive business. They set up offices in Shanghai and Hubei, and bought and sold personal information on the internet, in the name of “Shanghai OK Information” and “Shanghai Yitong Information”. Zhang Xiu was in charge of sending goods and collecting payment for goods. Zhang Wei was in charge of starting topics on the net and contacting buyers. Evidence was located on their computers and USB devices, showing they had collected more than 30,000,000 items of personal information including investor data, car owner information from Changsha and Beijing, bank client lists, security client lists and lists identifying people with high income.

A tremendous amount of information owned by Li Zhizhao attracted many buyers, including Zhang Yiyu – he spent RMB2,000 buying more than 3,000,000 items of personal information regarding Shanghai property owners from Li, and then spent RMB2,000 buying more than 200,000 items of information regarding Shanghai credit card clients, investor information and details as to the parents of newborns – in total, he purchased more than 10,000,000 items of personal information.

Furthermore, in order to increase profits, Yu Yinhua and Chen Zunlong who worked at a recruitment company, issued false employment vacancy advertisements on free recruitment websites, to attract job seekers and solicit personal resumes - they then sold the resumes for between RMB0.10 – RMB0.50 each.

When arrested, Chen Zunlong was adamant that he had obtained legal advice regarding their business to the effect that what he was doing was not a crime and was legal in China.

Case Analysis

Article 253 of the PRC Criminal Law states:

“Working personnel of state agencies, or of organizations in particular financial, telecom, transportation, education or health sectors who sell or illegally provide to other persons individual information of citizens obtained during the course of such organization’s performance of official duties or provision of services shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention and concurrently or independently, to a fine, if the circumstance is serious.
Anyone who illegally obtains the above information by means of stealing or others shall be sentenced in accordance with the provisions of the preceding paragraph.
If an organization commits a crime under the preceding two paragraphs, the organization shall be sentenced to a fine and concurrently, the person-in-charge directly responsible and other persons directly responsible of it shall be sentenced in accordance with the provisions of the preceding two paragraphs.”

The court declared that only personnel at state agencies or organizations in particular industry sectors, can potentially commit the crime of illegal sale or supply of personal information. However, the charge of illegally obtaining personal information (ie. the second sentence of Article 253) does not have this limitation, so these individuals were all correctly charged with this crime and found guilty of the contravention of Article 253.

Conclusion

Given the recent amendments to the PRC Criminal Law and the courts decision in this case, it is clear that China is paying more attention to privacy protection. Given societies constantly increasing use of the Internet and computers, the speed and ease at which valuable personal information can be gathered and sold, is frightening. Some commentators believe that it is imperative for China to enact a special privacy law which will provide more effective and complete protection for privacy and personal information.