Key takeaways:
- The crime of violating citizens' personal information was first introduced into China’s Criminal Law in 2009.
- The legal framework for the crime of violating citizens' personal information includes the PRC Criminal Law, and a judicial interpretation issued by the Supreme People's Court and the Supreme People's Procuratorate.
- An empirical study shows that from 2017 to 2021, a total of 166 first-instance criminal sentences for such crimes were handed down by primary courts in Ningbo, Zhejiang Province.
- In terms of the means by which personal information was obtained, there were 90 cases involving the use of purchase, fraud, theft, and other illegal means and 37 cases involving the use of professional convenience to obtain personal information.
In China, cybercrime involving individuals' privacy is known as the crime of violating citizens' personal information.
This crime of violating citizens' personal information was first stipulated in the 7th Amendment to the Criminal Law of China in 2009. It was later revised in the 9th Amendment to the Criminal Law of China in 2015.
I. Legal framework
The legal framework for the crime of violating citizens' personal information includes the PRC Criminal Law and a judicial interpretation.
According to Article 253 of the PRC Criminal Law, the crime of violating citizens' personal information means that criminals illegally sell or provide citizens' personal information to others or illegally acquire such information by theft or other means, with aggravating circumstances.
Judicial Interpretation refers to the Interpretation of the Applicatioin of Law for Handling Criminal Cases Involving the Violation of Citizens' Personal Information ( the “Judicial Interpretation”, 关于办理侵犯公民个人信息刑事案件适用法律若干问题的解释) (Fa Shi (2017) No.10) (法释(2017)10号) jointly issued by the Supreme People's Court (SPC) and the Supreme People's Procuratorate.
The Judicial Interpretation clarifies specific details.
For example, a citizen's personal information refers to any type of information recorded in electronic form or other form that can be used independently or together with other information to identify a particular person or to reflect details about the activities of a particular person, including the person's name, ID number, correspondence and contact information, address, account password, property status, and whereabouts, etc.
- Violation of citizens' personal information is a criminal offense if aggravating circumstances are present. The Judicial Interpretation also lists out the following situations in which an aggravating circumstance is present when:
- the offender sells or provides information on individuals’ whereabouts which is used by another person to commit a crime;
- the offender knows or should know that any other person is to use the personal information of a citizen to commit a crime but still sells or provides such information to such person;
- the offender illegally obtains, sells or provides more than fifty pieces of information on citizens' whereabouts, communication details, credit and property information;
- the offender illegally obtains, sells or provides more than five hundred pieces of citizens' personal information likely to affect citizens’ personal and property safety such as accommodation information, communication records, health and physiological information and transaction information;
- the offender illegally obtains, sells or provides five thousand pieces of citizens' personal information other than that specified in Circumstance No.3 and Circumstance No. 4;
- the amount of illegal income derived by the offender from violating citizens' personal information reaches CNY5,000 or more; and
- other serious circumstances.
II. Observations
Li Nan, a judge at the People's Court of Ningbo High-tech Industrial Development Zone in Zhejiang Province, collects the statistics from all 11 primary courts in Ningbo with regard to the crime of violating citizens' personal information.
In China, the primary people’s courts (courts at the grassroots level) are the courts of first instance for most crimes, including violation of citizen's personal information. Ningbo is one of the most dynamic cities in China, with the 10th largest GDP among all Chinese cities.
We make a summary below from the article “Penalty of the Crime of violating citizens' personal information” (侵犯公民个人信息罪的罪刑样态), published in the journal, “People's Judicature” (人民司法) (No. 10, 2022). You can get a general idea of the situation of such crimes in China as follows.
From 2017 to 2021, a total of 166 first-instance criminal sentences for such crimes were handed down by primary courts in Ningbo, Zhejiang Province.
In terms of the means by which personal information was obtained, there were 90 cases involving the use of purchase, fraud, theft, and other illegal means and 37 cases involving the use of professional convenience to obtain personal information. In cases involving access to citizens' personal information through occupational convenience, the typical scenario is that personnel of a state organ or employees of a company that lawfully possess citizens' personal information collude with others to sell such personal information for profit.
In terms of the use of the obtained personal information, there are 72 cases of using such information for sale for profit, 32 for commercial marketing, 29 for illegally providing it to others, 8 for subsequent criminal activities such as fraud, theft and gambling, and 2 for private investigation and illegal stalking of others.
The total amount of revenue obtained by the offenders from the violation of citizens' personal information is recorded in 85 judgments, with an average amount of over RMB 41,000 per case.
The amount of personal information violated is recorded in 156 judgments, totaling 648 million pieces of personal information. On average, there are over 4.15 million pieces of personal information infringed per case. In terms of type of information, there are 68 cases involving real estate information, 12 cases involving online behavior information, 11 cases involving vehicle ownership information, 6 cases involving stock and securities information, 12 cases involving property information, 6 cases involving education information, 9 cases involving household registration information, 3 cases involving location information and 3 cases involving communication information, which shows the violation of citizens' personal information have penetrated into all aspects of citizens' lives.
These judgments involve 408 defendants, of whom 400 are natural persons and 8 are entities. Among the natural persons accused, 312 persons were given suspended sentences, accounting for 78% of the total, which shows a trend towards more lenient sentences for such offenses.
Photo by GuerrillaBuzz on Unsplash
Contributors: Guodong Du 杜国栋
