Internet firms urged to tighten up data privacy

A Beijing court has urged internet companies, the defendants in most personal information lawsuits, to strengthen self-discipline and strictly regulate their behaviors while handling personal data.

From September 2018, when the Beijing Internet Court was set up, to September this year, it heard 58 disputes concerning personal information protection, of which 46 cases involved internet enterprises, according to a report issued by the court on Wednesday.

Internet users initiated lawsuits against the companies, such as those in social, search, e-commerce, education and finance, claiming that the platforms improperly handled their personal information, including names and mobile phone numbers, as well as consumption, transaction and health records, the report said.

Some financial platforms were sued for data leaks that caused users to suffer from telecom fraud, while some education apps were claimed to have forcibly collected users' personal data, it added.

"A few new types of cases involving personal information protection have also been emerging, as more people have realized the significance of safeguarding their personal data," Zhao Ruigang, vice-president of the court, told a news conference while introducing the report on Wednesday.

For example, four relatives of a deceased man surnamed Li, who was a deliveryman, turned to the court after they did not agree with Li's former employer about reading and copying Li's personal information on the enterprise's online platform.

"The relatives tried to log into Li's account to check his personal data on their own, but considering the former deliveryman's account involved the information of buyers and other companies, the employer, a company in Shenzhen, Guangdong province, did not allow the move," said Sun Mingxi, a judge from the court.

After a trial, the court supported the Shenzhen company.

"Although the Personal Information Protection Law, which took effect on Nov 1, 2021, allows families or relatives of a deceased to search and copy the deceased's personal data, there is also a line to be drawn," she explained.

"Taking Li's case as an example, the relatives were not satisfied with Li's ex-employer because it didn't permit them to log into Li's account. However, the ex-employer had already provided the information the relatives wanted through other channels," she said.

"In addition, the deceased's account involved the personal data of other people, and even business secrets of other companies, so prudently handling the account was also legitimate and reasonable," she added.

To improve the protection of personal information while promoting information development in the digital era, the judges called for internet platforms not to excessively collect the personal data of their users.

They also suggested the country's top court issue judicial interpretations to clarify how to define mental damage caused by violations of personal information.