On 9 May 2017, the Supreme People’s Court (“SPC”) and the Supreme People’s Procuratorate (“SPP”) jointly released the Interpretation on Several Issues on the Application of Law to the Adjudication of Criminal Cases involving the Infringement of Citizens’ Personal Information, which takes effect 1 June 2017.
The interpretation clarifies certain terms related to criminal infringement of citizens’ personal information under the ninth amendment to the Criminal Law of the People’s Republic of China 1997, which provides for criminal sentences for “serious” and “particularly serious” offences.
The interpretation defines “personal information” as various information recorded by electronic or other means that can be used alone or in combination with other information to identify a natural person’s identity or reflect the activities of a natural person, such as name, identity document number, account password, property status, and location.
“Serious” offences include obtaining, selling or providing citizens’ personal information:
- On the whereabouts, communications content, credit information or property information, and of 50 pieces or more.
- On personal factors that may affect personal and property security (such as health and transaction information), and of 500 pieces or more.
- On other personal information, and of 5,000 pieces or more.
- That generates illegal gain of RMB5,000 or more.
- When obtained while performing duties or providing services, and the sum of the quantities or amounts exceed half of these thresholds.
- When one has been subject to criminal penalties for infringing upon a citizen’s personal information or has been subject to administrative penalties within two years.
- When certain kinds of personal information are illegally obtained during legitimate business activities, and either the offence generates illegal gain of RMB50,000 or more, or the perpetrator has been subject to criminal penalties for infringing upon a citizen’s personal information or has been subject to administrative penalties within two years.
“Particularly serious” offences include infringement involving quantities or amounts ten times these thresholds, or where the act either:
- Causes serious consequences such as death, serious injury, mental disorder or kidnapping.
- Results in significant economic losses or an adverse social impact.
The person in charge and other directly responsible persons are subject to punishment as individuals where a business or other unit infringes upon a citizen’s personal information.
Jeanette Chan, Partner, Paul, Weiss, Rifkind, Wharton & Garrison, Hong Kong
“In addition to providing much needed definitions for the key terms in Art. 253 of the 1997 Criminal Law, the interpretation sets forth more clearly the conviction and sentencing criteria for the infringement of personal information. The sentencing criteria in general have been lowered to crack down on the rampant leaking of personal data. In particular, companies that violate Art. 253 will be fined and senior management and other persons directly responsible will be sanctioned.”
General Counsel for any company that gathers or stores the personal information of Chinese nationals, including employees, customers, suppliers, will want to review the interpretation and Art. 253 of the 1997 Criminal Law, explain to senior management the corporate penalties and personal liability at stake, and ensure that documented steps are taken to avoid leaks and unauthorised uses of this personal data.