Zhou Guangquan: Conviction controversy over obtaining publicly available personal information and selling it for profit

"Criminal-Civil (Line) Relations and Determination of Crimes"

Conviction disputes for obtaining publicly available personal information and selling it for profit

Author: Zhou Guangquan is a professor at Tsinghua University Law School

Source: Rule of Law Daily Law School, September 22, 2021, 9th edition

There has always been controversy in practice over whether to convict a person who obtains part of the enterprise registration information or credit information that has been made public on the public network and sells or provides it to others without the consent of the person being collected.

The "guilty theory" is the most common theory in practice (Article 5, Paragraph 3 of the 2017 Criminal Justice Interpretation also protects credit information as sensitive information, which may contain personal information that has been disclosed). The basic proposition of this statement is that personal information is different from personal privacy. The information that has been disclosed by individuals no longer has privacy characteristics, but it still does not lose its function of identifying individuals, and obtaining or using such information may still infringe on the tranquility of personal private life and endanger citizens' personal or property rights, so the personal name and identity document number, home address, communication method and other information stripped from the market entity information still have the essential attributes of personal information. Where the perpetrator strips personal information from enterprise information for processing without the consent of the individual, this crime may be established. For example, defendant Tian X used a QQ mailbox to illegally obtain documents containing citizens' personal credit information from others, including 166 articles after the demerit of citizens' personal credit information, and the court found that defendant Tian X violated relevant state regulations and illegally obtained citizens' personal information, the circumstances were particularly serious, and his conduct had constituted the crime of infringing on citizens' personal information. In order to promote the loan intermediary business, defendant Huang X purchased a total of 284 pieces of citizens' personal information from his colleague Luo At a price of 300 yuan and received it by e-mail, including 224 personal credit reports, and the procuratorial organs accused the defendant of constituting this crime.

In practice, a small number of verdicts agree with the "not guilty doctrine". For example, after trial, the court held that the public prosecution accused the defendant of "6260 pieces of information out of 16,165 pieces of information obtained from others, which were reflected in the judicial audit as legal person information, which is not citizens' personal information and should be excluded according to law." The main reason for the "innocence theory" is that, according to Article 8 of the Interim Regulations on the Disclosure of Enterprise Information (2014), enterprises should submit their previous annual report to the administrative department for industry and commerce through the enterprise credit information publicity system from January 1 to June 30 of each year, and make it public. Article 9 stipulates that the annual report of an enterprise shall include information such as the enterprise's mailing address, postal code, contact telephone number, and e-mail address. Therefore, in accordance with the provisions of laws and regulations or for the needs of business, enterprises must disclose their enterprise information through documents such as the annual report of the enterprise, and the above information has entered the public information system, and anyone can publicly inquire, of which the name of the enterprise and the name and telephone number of the legal representative can be easily queried in the "National Enterprise Credit Information Publicity System" set up by the market supervision department. The personal information that exists in the above-mentioned public network does not involve personal privacy, but also includes the consent of the individual to waive his rights, even if the legal representative is a natural person, but the information related to it should no longer be regarded as personal information, or can be said to be "personal information worthy of criminal law protection" does not exist, even if it contains the individual's name, contact information, mobile phone number, etc., it does not belong to the personal information to be protected by this crime.

In addition, according to Article 21 of the Regulations on the Administration of the Credit Reporting Industry (promulgated by the State Council on January 21, 2013), credit reporting establishments may collect enterprise information through channels such as information subjects, enterprise counterparties, industry associations, information that has been disclosed by relevant government departments in accordance with law, and judgments and rulings published by people's courts in accordance with law. After the relevant information disclosed by an enterprise in the course of its business is collected by the credit reporting agency, the personal information in it also falls within the scope of the enterprise's public credit reporting information. In this sense, citizens' personal information in the sense of the Criminal Law cannot be absolutely equated with information such as the name and contact information of natural persons contained in the enterprise credit information. This view can be confirmed by Article 13 of the Regulations on the Administration of the Credit Reporting Industry. This article clearly stipulates: "The collection of personal information shall be subject to the consent of the information subject himself/ her, and shall not be collected without the consent of the individual." However, information disclosed in accordance with laws and administrative regulations is excluded. Information related to the performance of duties by directors, supervisors, and senior management of an enterprise shall not be regarded as personal information. "The information related to the directors, supervisors, and senior management of an enterprise in connection with the performance of their duties is not regarded as personal information" here explicitly negates that the identity information of natural persons related to the disclosure of enterprise information is not personal information. The establishment of the crime of infringing on citizens' personal information must be premised on the violation of relevant state provisions. It is inappropriate to make it the target of this crime for personal information in publicly available information that is no longer protected by such departmental laws, otherwise it will be improperly expanded.

The Supreme People's Procuratorate's Guidelines for Procuratorial Organs to Handle Cases of Infringement of Citizens' Personal Information (Gao Jian Fa Investigation and Supervision Zi [2018] No. 13) points out that for information such as mobile phones and telephone numbers contained in the enterprise's industrial and commercial registration, the purpose of the number should be clarified. Mobile phones, telephone numbers, and other information purchased and used by the company do not fall within the scope of personal information, thus strictly distinguishing between two different situations: "mobile phones, telephone numbers, etc. are purchased by the company and used by the company" and "the company's manager registers personal telephones and mobile phone numbers in industrial and commercial registration and other activities". This guidance still seems to uphold the view that information belonging to individuals in publicly available information is the subject of this crime, but lacks operability. Because in the implementation of the real-name system to buy mobile phone numbers today, the mobile phone number purchased by the company is difficult to do, whether the mobile phone number belongs to the company is more difficult to judge, the final result is that once the infringement occurs, even if the company purchases the mobile phone number, the victim unit may also advocate that the company and the individual are mixed, so that it is always possible to conclude that the perpetrator has established the crime of infringing personal information.

The overall criminalization of the acquisition of citizens' personal information from publicly disclosed corporate information seems to have been reversed to a certain extent after the adoption of the Civil Code, which is a trend worthy of attention. For example, from May to July 2020, Wu downloaded the public industrial and commercial registration information of enterprises in various places on websites such as Tianyancha and Qichacha, and sold more than 18,000 pieces of information after combing and classifying, making a profit of more than 10,000 yuan. The public security organ summoned Wu for suspected infringement of citizens' personal information, and the case was later transferred to the People's Procuratorate of Taizhou Pharmaceutical High-tech Zone in Jiangsu Province for review and prosecution. The procurator believes that the public security organs provided for "providing the legally collected citizens' personal information to others without the consent of the person being collected" according to article 3 of the 2017 Criminal Justice Interpretation, which is to provide citizens' personal information, and thus determined that Wu's behavior is suspected of this crime. However, the Civil Code came into force on January 1, 2021, bringing new changes to the handling of cases. Article 1036 of the Civil Code stipulates that where information disclosed by the natural person or otherwise lawfully disclosed is reasonably handled, the perpetrator shall not bear civil liability. However, this is the exception where the natural person explicitly refuses or processes the information that infringes upon his or her major interests. According to this provision, since there is no evidence to prove that Wu's sale of lawfully disclosed information was rejected by the right holder or infringed upon his major interests, it should not be found to constitute the crime of infringing on citizens' personal information. To this end, the procuratorate recommended that the public security organs withdraw the case. On January 7, 2021, the public security organs released Wu on guarantee pending further investigation and withdrew the case (see Lu Zhijian, Bai Yixuan, and Tian Jing, "Selling Public Enterprise Information for Profit: The Procuratorate Determines that the Perpetrator Does Not Constitute a Crime", Procuratorial Daily, January 20, 2021, first edition).

Although the continued effect of this trend remains to be seen, if the act of obtaining citizens' personal information from publicly disclosed corporate information is treated innocently, such a way of thinking is obviously too extensive and should be considered in conjunction with the purpose and purpose of handling public information.