2017.5.8
James Cheng
On May 8, 2017, the Supreme People’s Court and the Supreme People’s Procuratorate jointly promulgated the Interpretation on the Applicable Law in Criminal Cases Involving Infringement of the Personal Information of citizens (the “Judicial Interpretation”), which came into effect on June 1, 2017. In addition, the Judicial Interpretation is the first ever judicial interpretation that is jointly released by “Two Supreme” agencies to combat offenses involving infringement of citizens’ personal information. The Judicial Interpretation contains comprehensive and systematic provisions concerning the conviction and sentencing standards and the application of relevant laws for offenses involving infringement of citizens’ personal information.
1. The scope of the “citizens’ personal information” is set out.
Article 1 of the Judicial Interpretation provides that “citizens’ personal information” under Article 253-1 of the Criminal Law refers to all kinds of information that are recorded electronically or via other methods, and may, independently or in combination with other information, identify the identity of a natural person or reflect the activities of that specific natural person, including names, identification card numbers, communications and contact methods, addresses, accounts and passwords, property status, whereabouts, etc.
2. The determination criteria for “material violation” and “particularly serious violation” are clarified.
Ten criteria are established for a “material violation” based on factors such as the type and quantity of information, amount of proceeds from legal violation, purposes of the information, the identity of the actor and recidivism (including one miscellaneous clause): (1) sale or provision of whereabouts information used by others in a crime; (2) sale or provision of citizens’ personal information to others known or presumably known to use such information for criminal activities; (3) illegal acquisition, sale or provision of over 50 entries of whereabouts information, contents of communications, credit information or financial information; (4) illegal acquisition, sale or provision of over 500 entries of other information which may affect personal or property safety such as residence information, communications records, health and physiological information or trading information; (5) illegal acquisition, sale or provision of over 5,000 entries of citizens’ personal information other than as set forth in Subparagraphs (3) and (4); (6) quantities which do not reach the thresholds under Subparagraphs (3) through (5) but reach the relevant quantity thresholds cumulatively percentage-wise; (7) illegal proceeds in excess of RMB 5000; (8) sale or provision of citizens’ personal information obtained in performance of duties or during the provision of services to others by a volume or quantity in excess of half of the thresholds set forth in Subparagraphs (3) through (7); (9) any actor who has been previously convicted or has been subject to administrative penalty in the past two years for infringement of citizens’ personal information; or (10) other material violations. The Judicial Interpretation stipulates that an act that violates any of the above-mentioned 10 provisions in any of the following four circumstances will be deemed “particularly serious” under Article 253-1, Paragraph 1 of the Criminal Law based on the resulting harm from an offense against personal information of citizens: (1) a serious consequence such as the death, severe injury, mental disorder or kidnapping of the victim; (2) major economic losses or harmful social impact; (3) quantity or amount reaching more than ten times the thresholds set forth in Subparagraphs (3) through (8); or (4) other particularly serious violations.
3. The illegal acquisition or acceptance of citizens’ personal information for lawful activities still constitutes a “material” offense.
Article 6 of the Judicial Interpretation specifically provides that the illegal acquisition or acceptance of citizens’ personal information for lawful activities, other than as set forth in Article 5, Paragraph 1, Subparagraph 3 of the Judicial Interpretation (illegal acquisition, sale or provision of over 50 entries of whereabouts information, communications contents, credit information or financial information) and Paragraph 4 (illegal acquisition, sale or provision of over 500 entries of other information which may affect personal or property safety such as residence information, communications records, health and physiological information or trading information) shall be deemed a “material” violation under Article 253-1 of the Criminal Law under any of the following circumstances: (1) use of illegally acquired or accepted citizens’ personal information for a profit of over RMB 50,000; (2) prior history of criminal conviction or administrative penalty in the past two years before the illegal acquisition or acceptance of citizens’ personal information; or (3) other material violations. If citizens’ personal information so acquired is further resold or provided to others, the penal and sentencing standards would be governed by Article 5 of the Judicial Interpretation.
4. The criminal liability of entities infringing on citizens’ personal information is clarified.
Article 7 of the Judicial Interpretation provides that the penal and sentencing standards for corresponding offenses committed by natural persons shall apply to an entity that commits an offense in violation of Article 253-1 of the Criminal Law by penalizing and sanctioning those management personnel that are directly responsible and others who are directly responsible, as well as imposing a fine on the entity.
5. Offsetting up a website for infringing on the personal information of others shall constitute illegal use of information and the Internet, and the service provider will be liable under the Criminal Law if it refuses to perform its management obligations.
The Judicial Interpretation also elaborates on its interpretation of illegal use of information and the Internet under the Criminal Law. Article 8 provides that if a website or communication group is set up for criminal activities such as the illegal acquisition, sale or provision of personal information, it shall constitute illegal use of information and the Internet and is punishable under Article 287-1 of the Criminal Law. If the offense of violating citizens’ personal information is also constituted at the same time, the penalty will be set according to that offense instead. Article 9 provides that if an Internet service provider refuses to perform its information and Internet security management obligations under the relevant laws and regulations and still refuses to rectify even after being ordered by the regulator to do so, to the extent the subscribers’ personal information is disclosed with serious consequences, the service provider shall be penalized for the refusing to perform its information and Internet security management obligations in accordance with Article 286-1 of the Criminal Law.