Library of Congress

Law Library of Congress

The Library of Congress > Law Library > News & Events > Global Legal Monitor

China: Judicial Interpretation on Infringement of Personal Information Released

(Sept. 1, 2017) In May 2017, China’s Supreme People’s Court (SPC) and the Supreme People’s Procuratorate (SPP, the prosecutor) released a judicial interpretation on infringement of personal information in criminal cases. Effective June 1, 2017, the interpretation defines the scope of personal information under the Criminal Law of the People’s Republic of China (PRC) and clarifies other issues relevant to the criminal offense of infringement of personal information.  (Zuigao Renmin Fayuan, Zuigao Renmin Jianchayuan Guanyu Banli Qinfan Gongmin Geren Xinxi Xingshi Anjian Shiyong Falü Ruogan Wenti de Jieshi [SPC and SPP Judicial Interpretation on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Involving Infringement of Citizens’ Personal Information] (May 8, 2017, effective June 1, 2017) (Interpretation), SPC website; Judicial Interpretation on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Involving Infringement of Citizens’ Personal Information, CHINA LAW TRANSLATE (May 9, 2017) (unofficial English translation).)

 Criminal Offense of Infringement of Personal Information 

In 2009, the Seventh Amendment to the Criminal Law added the offense of selling or otherwise illegally providing personal information and the offense of illegally obtaining personal information to the Law as the new article 253A. Article 253(A) was then revised by the Ninth Amendment to the Criminal Law in 2015.  (Seventh Amendment to the PRC Criminal Law (Feb. 28, 2009), Congressional-Executive Commission on China website; Zhonghua Renmin Gongheguo Xingfa Xiuzheng An (Jiu) [Amendments to the Criminal Law of the People’s Republic of China (9)] (Ninth Amendment) (Aug. 29, 2015, effective Nov. 1, 2019), National People’s Congress website.)

According to the currently effective article 253A, as revised by the Ninth Amendment, whoever sells or provides citizen’s personal information to others in violation of relevant state provisions or steals or otherwise illegally obtains a citizen’s personal information will be sentenced to imprisonment of not more than three years or criminal detention, and/or a fine when the circumstances are serious. If the circumstances are especially serious, the offense is punishable by three to seven years’ imprisonment and a fine.  The article, however, does not provide a definition of personal information or which circumstances may be deemed “serious” or “especially serious” in sentencing.  (Ninth Amendment, art. 253A.)

Definition of Personal Information 

According to the Interpretation, “citizen’s personal information” under the Criminal Law refers to information, whether recorded by electronic or other means, that can be used, independently or together with other information, to identify a particular natural person’s identity or to reflect particulars on the person’s activities. Such information includes the person’s name, ID number, correspondence and telecommunications contact information, resident address, account name and password, property ownership, whereabouts and tracking data, etc. (Interpretation, art. 1.)

“Serious” and “Especially Serious” Circumstances in Sentencing 

The Interpretation specifies which circumstances are “serious” or “especially serious” under article 253A. The following circumstances, for example, are considered “serious”:

  • selling or providing information about citizens’ whereabouts and tracking data that is used by others to commit a crime;
  • selling or providing citizens’ personal information to others, when the offender knows or should know that the information will be used to commit a crime;
  • illegally obtaining, selling, or providing 50 or more pieces of information about citizens’ whereabouts and tracking data, communication details, credit status, and property ownership information;
  • illegally obtaining, selling, or providing 500 or more pieces of citizens’ personal information that are likely to affect citizens’ personal or property safety, such as information about accommodations, telecommunications record, physical health, and business transactions;
  • illegally obtaining, selling, or providing 5,000 or more pieces of other personal information; and
  • illegally gaining over RMB5,000 (about US$744). (Id. art. 5.)

“Especially serious circumstances” under article 253A include the following:

  • causing serious consequences such as death, serious injury, or psychiatric disorder to or kidnapping of the victim;
  • causing major economic losses or evil social influences; and
  • illegally obtaining, selling, or providing a quantity of information or illegally gaining an amount over ten times as much as specified above. (Id.)

Other Clarifications 

The Interpretation clarifies other issues relevant to infringement of personal information, including the definition of “providing personal information” and the liabilities of Internet service providers (ISPs). According to the Interpretation, providing personal information to a particular individual and making the information public by means such as the Internet both fall under “providing information” under article 253A of the Criminal Law.  (Id. art. 3.)  ISPs may be held criminally liable if they fail to perform the network security obligations and refuse to make corrections as ordered by the regulatory authority, which result in leaking of personal information and cause serious consequences.  (Id. art. 9.)