Is my company liable for civil damages for violating the Personal Information Protection Act?

Answer: The purpose of the Personal Information Protection Act is to protect the security of personal information and individual privacy, and therefore the subject of personal information is entitled to seek civil liability in tort from the perpetrator of a breach of the Act.

Firstly, the subject of personal information has the right of access and reproduction. In the case of 2022 Guangzhou Vipshop in the Guangzhou Intermediate Court of Guangdong Province, where Vipshop refused a member’s request to access and reproduce information collected by Vipshop about himself, the court held that the subject of personal information has the right of access and reproduction of his own information, without taking the premise that personal information is at risk of disclosure.¹

Secondly, infringements of personal information protection may be liable for public apologies and civil damages depending on the nature and impact of the act. In the 2021 case of Li Bolun at the Zigong City Intermediate Court in Sichuan Province, the defendant lured customers with gifts to provide personal information, which he used to purchase mobile phone sim cards and then sold them. The court found that the conduct not only constituted a criminal offence, but that the illegal proceeds of over RMB16,000 should be awarded as public interest damages and ordered them to make a public apology.²

Processing of personal information is exempt from civil liability if it meets the conditions for statutory exemption. The Civil Code provides that the following circumstances are statutory exemptions from liability for handling personal information: consent of the subject of personal information, use of information that has been lawfully disclosed (unless the natural person expressly refuses or the information infringes on his or her vital interests), and reasonable use in the public interest or in the interest of the subject of personal information.³For example, in the 2021 case of Tencent at the Shenzhen Intermediate Court in Guangdong Province, the court held that the information used by Tencent’s WeChat App was the plaintiff’s public information in WeChat, and that such use of personal information was a use of information that had been made public within the original scope, and therefore did not constitute an infringement.⁴

Mr. Wangdong

Mr. Dong Wang has been in practice for over 20 years, specializing in business law, including employment law, commercial law, company law, and intellectual property law. Mr. Wang has earned respect and trust from his clients due to his professionalism, fidielty, and kindness.

Email: wangdong@royalaw.com

1
Guangzhou Vipshop E-commerce Co., Ltd. and Zhou Yancong Personal Information Protection Dispute Civil Judgment (2022) Guangdong Guangzhou Intermediate People’s Court (粤01民终3937号), a member of Vipshop requested access to copy the member’s personal information kept by Vipshop, the court held that it was not necessary to prove that there was a risk of disclosure by Vipshop and that the scope of the right covered all the member’s personal information collected by Vipshop. The court held that it was not necessary to prove that there was a risk of disclosure by Vipshop and that the right covered all personal information collected by Vipshop.
2
Sichuan Zigong City People’s Procuratorate, Li Bolun and other personal information protection disputes civil first instance civil judgment Sichuan Zigong City Intermediate People’s Court Civil Judgment (2021) Chuan 03 Civil No. 102, the criminal defendant collected customers’ personal information for the purchase of mobile phone sim cards for sale belongs to the infringement of personal information, after bearing criminal liability for fines, the court ordered that the illegal proceeds of more than 10,000 as compensation for public interest damages.
3
Article 1036 The perpetrator shall not be held civilly liable for handling personal information under any of the following circumstances: (1) Acts reasonably carried out within the scope of the consent of the natural person or his or her guardian; (2) Acts reasonably carried out to handle information that the natural person has disclosed on his or her own initiative or has otherwise lawfully disclosed, except where the natural person has expressly refused or where the handling of such information infringes upon his or her vital interests; (3) Acts reasonably carried out to safeguard (c) other acts reasonably carried out to safeguard the public interest or the lawful rights and interests of the natural person.
4
Article 69 of the Personal Information Protection Act Where the handling of personal information infringes upon the rights and interests of personal information and causes damage, and the personal information processor cannot prove that it is not at fault, it shall bear tort liability such as compensation for damage. The liability for damages under the preceding paragraph shall be determined in accordance with the losses suffered by the individual or the benefits obtained by the personal information processor as a result; if the losses suffered by the individual or the benefits obtained by the personal information processor as a result are difficult to determine, the amount of compensation shall be determined in accordance with the actual situation. Wang Mou, Shenzhen Tencent Computer System Co., Ltd. Personal Information Protection Dispute Civil Judgment of Second Instance Shenzhen Intermediate People’s Court of Guangdong Province Civil Judgment (2021)粤03民终9583, After the Appellant Wang Mou’s refusal to tick the consent for WeChat APP to find his WeChat friends through the solicitation option proposed by WeChat APP itself indicated his clear withdrawal of his previous authorised consent, WeChat APP’s continued retention of his WeChat friend relationship in the background was improper. Tencent’s use of the plaintiff’s public information in WeChat for use in the WeTV APP did not expand the scope of use of that personal information, nor did it cause moral or personal harm, so it was not an infringement. Here the infringement of personal information handler as well as the violation of the Act is distinguished.