Firms urged to tighten data protection

Courts stress employers should be more vigilant with personal information

Beijing judges have urged employers to strengthen the management of employees' personal data after a surge in infringements this year, and to step up scrutiny on job applicants in order to weed out those previously punished for such offenses.

Data released by the Beijing High People's Court last week showed that the capital's courts have dealt with 233 criminal cases of personal information infringement since 2018, with 229 having been concluded.

After a brief rise in 2019, the number of such cases heard by Beijing courts has dropped every year, falling to just nine last year.

But it has rebounded this year, with 27 cases filed since January, the high court said.

In the concluded cases, mobile phone numbers and identity-card information were the two major types of personal data most frequently stolen or purchased, it said, followed by internet browsing content and addresses.

"Defendants in more than half of the concluded lawsuits had jobs before they committed the crime, and many were well-educated and worked for large internet enterprises or companies in e-commerce, finance, telecom, real estate and education," it said.

"Some defendants sought profits by selling their clients' personal data, while some used the information to engage in illegal business activities after they left their companies."

The high court said personal information infringements are associated with other offenses, including telecom fraud, debt collection through violent means, blackmail and intentional injury.

In one case given as an example, two defendants, both former employees of a telecom company, were each sentenced to one year in prison and fined by the Daxing District People's Court for helping two others obtain people's phone numbers to commit fraud.

"It's a typical case of defrauders colluding with enterprise insiders to infringe upon people's personal data and then cheat them out of money," the Daxing court said, adding that the stolen phone numbers were used to fraudulently obtain more than 1.7 million yuan ($230,000).

Xiao Jiangfeng, chief judge of the high court's first criminal adjudication tribunal, said telecom fraud was the most common crime infringing on people's personal rights, and it seriously harmed society.

"It's a must to harshly punish fraudsters, as well as those helping them obtain people's personal information, so that we can prevent the data from being used to commit other crimes," he said.

The high court suggested employers intensify scrutiny on job applicants to determine whether they had received administrative or criminal punishments for infringing upon others' personal data.

It said that classifying employees' personal information and clarifying who had the right to read or handle it were also crucial tasks for employers, and called on enterprises, especially those engaged in the telecom, transportation and finance fields, to make specific rules on data management, use and storage.

Xu Hao, a lawyer at Beijing Jingsh Law Firm, agreed with the suggestions, adding that "employers should also mark or record which employees view, process or download clients' personal data".

He said such records could "help remind employees, especially those given the right to read clients' data, not to disobey rules to use the information, or increase monitoring of their work".

As to why so many employees still sold personal data despite the risk of imprisonment, he said they thought they would be lucky enough to get away with it.

"In other words, what frightens them is not the harsher punishment, but the bigger chance of being punished," he added.

He said there were also concerns people might reoffend at a new workplace, which, as well as having an impact on those whose data was misused, would also affect the reputation of the new employer.

Early this month, the Beijing Internet Court urged internet companies to strictly regulate their handling of personal data, after discovering that defendants in many personal information lawsuits it heard worked in that sector.

"Some internet financial platforms were sued for data leaks that caused users to suffer from telecom fraud, and some education apps were alleged to have forcibly collected users' personal data," said Zhao Ruigang, vice-president of the court.

To improve protection of personal information while promoting information development in the digital era, he suggested the country's top court formulate judicial interpretations to clarify how to define mental damage caused by violations of personal information.