China gets tough with personal information leaking

China courts have issued a harsh judicial ruling, stipulating those who illegally obtain or sell 500 or more pieces of personal information could face a sentence of up to seven years.

The judicial interpretation, the first of its kind jointly released by the Supreme People’s Court (SPC) and the Supreme People’s Procuratorate (SPP), came amid increasing public outcry against rampant online and telecom fraud in China.

It clearly defines personal information, a concept of which is controversial in practice, said Yan Maokun, research director at the SPC.

Judges will be able to give an accurate and consistent ruling based on the interpretation, Yan added.

Under China’s Criminal Law, those convicted of selling or providing personal information could face a maximum sentence of three years if “the circumstances are serious,” while if “the circumstances are especially serious,” violators could face up to seven years in prison.

The judicial ruling defines which situations considered “serious” or “especially serious” according to the types and amounts of leaked personal information, as well as the impact caused such encroachment.

Situations considered “especially serious” include illegally obtaining, selling or providing 500 or more items of data about a person’s location, communication content, credit or property information; 5,000 or more items of communication record, accommodation, health or transaction information; or 50,000 or more items of personal information other than the aforementioned types.

Should violators make more than 50,000 yuan ($7,239) from these activities or their crimes lead to victim’s death, serious injury, mental disorder or kidnapping, their offenses will be considered “especially serious.”

The amount of leaked information in cases considered “especially serious” is ten times that in “serious” cases.

“Such specific penalty standards for personal information infringement assists law enforcement and will act as a powerful weapon to fight information leaking,” said Ren Xianjie, from the legal policy research department of the SPP.

Investigation found that employees of the banking, e-commerce,education, express delivery and telecom industries are the most likely to leak customers’ personal information, said Xu Jianzhuo from the Ministry of Public Security (MPS).

Police arrested 4,261 suspects in 1,886 cases related to infringement of personal information in 2016, and 391 of them were employees leaking customers information, according to MPS data.

The new rule has stipulated that employees who illegally sell or provide half of the aforementioned amounts of data about customers personal information could face the same penalties as individuals.

“The interpretation lowered the penalty threshold for employees, which provided legal basis for us to fight information leaking,” said Xu.

Leaking personal information has become a public nuisance in China. Last year, a telecom fraud case involving leaked personal information aroused shock and anger among the public.

Xu Yuyu, a recent high school graduate in east China’s Shandong Province, died of cardiac arrest in August 2016 after losing 9,900 yuan earmarked for her university fees to telecom fraudsters.

The Internet Society of China estimated junk messages, leaked personal information and fraud led to losses of about 91.5 billion yuan in 2016.