Answer: Yes. While generally, a violation of the Personal Information Law leads to civil infringement and administrative penalties, under certain conditions and to a certain extent, it may also constitute a crime as per Article 235 of the ‘Criminal Law.’ This crime involves infringing upon the personal information of citizens, and the legal consequences include potential imprisonment for up to three years or detention, along with a fine or a single fine. In cases where the circumstances are particularly severe, the perpetrator may face a prison sentence ranging from three to seven years, in addition to a fine.”
According to the Criminal Law and its relevant judicial interpretations, for an act to constitute the crime of infringing upon citizens’ personal information, it must satisfy all of the following three necessary conditions:
The first condition is that the act falls into one of three categories: the first category is the provision type, which includes providing and selling personal information to others; the second category is the collection type, which involves stealing, using one’s position or providing services to collect personal information; and the third category is the acquisition type, which includes buying, exchanging, and receiving personal information.
The second condition is that the aforementioned provision, collection and acquisition of personal information violates relevant state regulations, including the Personal Information Protection Act, the Standard Contractual Measures for the Exit of Personal Information, the Measures for the Safety Assessment of Data Exit, the Regulations on the Protection of Personal Information of Telecommunications and Internet Users, the Regulations on the Network Protection of Personal Information of Children, the Guidelines for the Protection of Personal Information Security on the Internet, and other State-level laws and regulations, departmental regulations, etc.
The third condition is that the aforementioned violation of the relevant state regulations constitutes “serious circumstances”. The seriousness of the circumstances includes one of the following situations: 1) the person has made a profit of more than RMB 5,000 in violation of the relevant state regulations on personal information; 2) the person has previously been criminally or administratively punished for infringing on the personal information of citizens and has again committed the aforementioned illegal act of providing collection and acquisition; 3) the person has provided personal information to another person whose whereabouts and trajectories have been used to commit a crime or knows that another person has used personal information to commit a crime; 4) the person has illegally acquired or provided more than 50 pieces of information on whereabouts and trajectories, communication contents, credibility information, property information (but only 25 pieces if the act is committed in the performance of duties or provision of services); (5) the person has illegally acquired or provided more than 500 pieces of information on accommodations, communication records, health and physiological information, transaction information and other personal information of citizens that may affect personal or property safety (but only 250 pieces if the act is committed in the performance of duties or provision of services) (6) the person has illegally acquired or providing more than 5,000 pieces of other kinds of personal information of citizens (but only up to 2,500 pieces if the act is performed in the performance of duties or provision of services).12017 Interpretation of the Supreme People’s Court Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases Involving Infringement of Citizens’ Personal Information Article 5
Therefore, an employee or manager of a foreign company in China may commit a crime if he or she provides other people’s property information or 25 text message contents to the parent company abroad without registering the departure of personal information. As long as the foreign company registers as soon as possible, it however should be able to achieve compliance and there will be no question of violating the Personal Information Protection Act or even incurring criminal liability for serious circumstances.
Private detective work in China is likely to be a crime, as it usually provides information on the whereabouts and trajectories of the person being followed. Commercial investigation practices, including lawyers acquiring information on the property of the natural person being enforced in the enforcement procedure of court judgments, are also likely to be criminal, as their access to relevant bank account and property information may has reached 25 pieces of personal information, the threshold of the crime. However, in the case of general website platforms and service software apps, if they clearly commit to not illegally using personal information during the collection process of registered members, and if members voluntarily provide their personal information, it usually does not constitute a crime.
Mr. Dong Wang has been in practice for over 20 years, specializing in business law, including employment law, commercial law, company law, and intellectual property law. Mr. Wang has earned respect and trust from his clients due to his professionalism, fidielty, and kindness.
Email: wangdong@royalaw.com
- 12017 Interpretation of the Supreme People’s Court Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases Involving Infringement of Citizens’ Personal Information Article 5