F REIGN TRADE - 中国国际贸易促进委员会

In summary, persons or entitieswho engage in the following three activitieswill be subject to criminal liabilityup to three year’s imprisonment and/or criminal fines: (i) sale of citizens’ personalinformation; (ii) illegal provisionof citizens’ personal information; and(iii) illegally obtaining citizens’ personalinformation. In April 2012, China’spolice authority launched a campaignto crack down on infringing on citizen’sright of personal information, with 1,936suspects arrested. In August 2011, theBeijing Second Intermediate People’sCourt issued its ruling on a famous caseconcerning selling, illegally providingand obtaining personal information. Inthis case, 23 defendants were accusedof engaging in illegal actions leading toselling, illegally providing and obtainingpersonal information, and would faceprison terms or suspended sentences.Particularly, among these 23 defendants,5 defendants were employees of ChinaMobile, China Unicom and ChinaTelecom which are the three biggest telecommunicationscarriers in China. Thesecases indicate China’s law enforcementagencies are increasingly taking measuresto protect personal information.Civil LawAt present, a unified and overarchingcivil law has not been codified inChina. Over the past twenty-six years,the General Principles of Civil Law(“Civil Law Principles”) has played animportant role governing the civil relationshipsamong civil entities. The CivilLaw Principles do not provide for aseparate right of privacy or personal information,while the Supreme People’sCourt merges the privacy right withthe reputation right by interpreting theprovisions of the Civil Law Principles.That means a victim can not sue to protecthis/her privacy right unless his/herreputation has also been damaged.Such rules was overturned whenthe Tort Liability Law (“Tort Law”)was enacted on December 26, 2009.Under Tort Law which entered intoforce on July 1, 2010, the privacy rightbecame a unique type of right independentfrom other civil rights. A victimwhose privacy and personal informationhas been infringed is entitled to sue todemand cessation of such infringement,reputation rehabilitation, eliminationof adverse impact, issuance of apologyand payment of damages. The mostimportant provision under the Tort Lawfor the website operators is the Article36, stipulating that a victim whose civilrights are infringed due to informationdisclosure via internet may ask relevantwebsite operators or internet serviceproviders to delete or block such informationin order to avoid any furtherloss. If the website operators or internetservice providers fail to take necessaryactions on a timely basis, they mayjointly and severally bear any additionallosses caused to such victim.Besides typical civil laws andregulations, other laws or rules alsoshed light on the privacy and personalinformation protection. Although theConsumer Rights and Benefits ProtectionLaw (“Consumer Law”) issued bystate-level lawmaker does not contain aprovision relating to consumers’ privacyor personal information protection, localconsumer protection regulationsin China have extended protectionover customers’ personal data. Certainprovincial-level rules implementingthe Consumer Law have impacted thecollection and use of customers’ personaldata, by prohibiting commercialenterprises from disclosing customers’personal information without their consentor collecting consumers’ personalinformation irrelevant to the goods orservices they purchase. Additionally, itis reported that a draft amendment tothe Consumer Law creates an explicitright to privacy of consumers.Rules specifically applicable tointernet industryIn addition to complying by thegeneral criminal or civil laws, websiteoperators or internet service providersneed to pay attention to the privacy andpersonal information protection rulesissued by regulators specifically for theinternet industry. With respect to theonline privacy protection, the ComputerInformation Network and InternetSecurity, Protection and ManagementRegulations (“Computer Regulations”),which was issued by the Ministry ofPublic Security and became effective in1997, stipulated that the freedom andprivacy of internet users is protected bylaw and can not be infringed by any entityor person. The Computer Regulationsalso urge entities connected to theinternet to take solid measures to ensurethe security of information.Recently, the Ministry of Industryand Information Technology (“MIIT”)promulgated the Several Provisions onRegulating the Market Order of InternetInformation Services (“MarketOrder Provisions”) which entered intoforce on March 15, 2012. Under theMarket Order Provisions, the issue ofusers’ personal data protection is highlighted.Pursuant to the Market OrderProvisions, website operators are prohibitedfrom providing users’ personalinformation to third parties, unless otherwisespecified in laws or regulations.Website operators are also prohibitedfrom collecting users’ personal informationwithout users’ consent. Websiteoperators are requested to duly retainusers’ personal information and takeremedial measures immediately whenusers’ personal information has beenleaked or may be undermined by therisk of leakage. Since other key ruleskeep silent on the internet privacy issue,the Market Order Provisions will havea pro-founding impact on China’s internetprivacy protection practice.FutureGiven the rapidly changing landscapeof the internet industry, it is difficultfor lawmakers to devise rules whichcan always address upcoming issuestimely and soundly. It is reported thatChina will issue the Guideline for PersonalInformation Protection as a noncompulsoryindustrial standard in late2012. But, there is no sign showing acomprehensive personal data protectionlaw will be adopted in the near future.In order to contain potential risksassociated with online privacy and personalinformation protection, websiteoperators or other market players in theinternet industry may develop a set ofbest practice, such as assessing the typesof personal data collected, keeping theproper internet security measures inplace, scrutinizing the purpose of useof personal data, obtaining necessaryconsent regarding data collection, andlimiting scope of persons who have accessto personal information database.53