SlideShare a Scribd company logo
1 of 57
Personal Information Protection in China -
Recent Development of the Chinese Civil and
Criminal Cases
Prepared for The Third Asian Privacy Scholars Network Conference, Faculty
of Law, UHK, 8-9 July, 2013
Dr George Tian
Senior Lecturer, Faculty of Law
University of Technology Sydney (UTS)
Email: George.Tian@uts.edu.au
 Part I: Overview of Personal Information Protection Laws in China
 Part II: Recent Cases on Personal Information Protection in China
 2.1. Recent Development of the Chinese Civil Cases
 2.2. Recent Development of the Chinese Criminal Cases
 Part III: Challenges & Recommendations
 3.1. Challenges of protecting personal information in China
 3.2. Suggestions for future Legal Reform
Structure
 1.1. General Feature
 1.2. Existing Laws and regulations
 1.3. Comments and Remarks
Part I: Overview of the Personal Information
Protection Regime in China
 China is still in the process of establishing
 a comprehensive legal framework to regulate the use and
disclosure of personal data
 not currently have
 a national level law that delineates how a company can legally
collect, process and retain personal data.
 “The country’s information protection regime consists of a
patchwork of
 sector-specific laws and guidelines,
 stand-alone provisions in broader laws, and
 regional laws”.
 --- (Cave, 2013)
1.1. General Feature
 But … it seems that such a situation is changing
gradually….
 New Efforts of Harmonization
 Particularly in the recent two or three years, China made a
good progress in harmonizing its personal data protection
laws.
 E.g. making law, regulations and guidelines for protecting
personal information protection on the Internet
 E.g. MIIT Guideline 2013 (more details will be discussed later)
 Draft of Personal Information Protection Law (since 2005)
1.1. General Feature
6
1.2. Existing Personal Data Protection Rules in China
1. Constitution Law Articles
38 and 40
Rights that relate to privacy, e.g.
- right of dignity of the person,
- prohibitions against insult, defamation,
false accusation or false information
directed against Chinese citizens, and
- right of freedom and secrecy of
correspondence.
2. Civil Law Article 120
the
General
Principles
of the Civil
Law
protect a citizen’s right of
- personal name,
- portrait,
- reputation or honor.
6
7
Existing Personal Data Protection Rules in China
3. Criminal Law
(7th Amendment)
Article
253
(1) make working personnel of state agencies, or of
organizations in particular industry sectors,
potentially subject to criminal liability,
- if they sell or illegally provide to other persons
individual information of citizens obtained
- during the course of such organization’s
performance of official duties or provision of
services.
(2) An organization and its responsible officers could
also be made subject to the same criminal liability,
- if it obtains information that had been
misappropriated in this way.
7
8
Existing Personal Data Protection Rules in China
4. Tort Liability Law 2009
(effective on July 1st,
2010)
Articles 2,
6, 3, 15, 36,
61, 62
contains provisions which establish
a right of a private citizen to sue for
damages or other remedies in tort,
- in cases where medical records
are mishandled and
- in cases where the internet is
used to harm the interests of the
private citizen or, more generally,
- in cases where the private
citizen’s right of privacy, health,
name, reputation, honor or
portrait has been infringed upon
and damages have occurred
5. Interpretation of the
Supreme People’s Court
on Issues regarding the
Ascertainment of Liability
for Compensation for
Psychological Damages in
Civil Torts
protect an individual’s rights of
personality, including an
individual’s privacy,
- by granting a right to claim for
psychological damages.
8
9
6 The Guidelines for
Payment and Clearing
Organizations on Anti-
money Laundering and
Anti-terrorist Financing
2009
(issued by the People’s
Bank of China)
require payment and clearing organizations and
their branches
- to establish internal control systems to prevent
money laundering and terrorist financing, and
- to establish systems for the ascertainment of
client identities, for the reporting of suspicious
transactions, and for the preservation of client
identity and transaction records..
7 Interim Measures for the
Administration of the
Basic Data of Individual
Credit Information 2005
(issued by the People’s
Bank of China)
prohibit governmental authorities and other
organizations, as well as their staff, from
disclosing personal information which they may
obtain in the course of their work.
Violators will be subject to administrative
punishment and civil compensation.
9
Existing Personal Data Protection Rules in China
10
Existing Personal Data Protection Rules in China
8. The Norms for Electronic
Medical Records of
Traditional Chinese
Medicine (for Trial
Implementation) 2010
(issued by the State
Administration of
Traditional Chinese
Medicine)
require medical organizations to
- set up information security schemes for
electronic medical records and
- establish corresponding powers for doctors,
nurses and other management staff in the
hospital to read, copy, and type electronic
medical records, and
require hospitals to establish usage records for the
electronic medical records.
prohibit any entity or individual from reading or
copying electronic medical records without due
authorization.
9. The Basic Norms for
Electronic Medical Records
2010
(issued by the Ministry of
Health)
prohibit unauthorized review of patients’ medical
records
- by other institutions and persons besides the
medical personnel that perform the medical
activity and quality control personnel.
[Exemption]
permit the review of medical records, after
obtaining consent of the medical institution, for the
purpose of scientific research and education.10
11
Existing Personal Data Protection Rules in China
10. Social Insurance Law 2010 prohibit governmental authorities and other
organizations, as well as their staff, from disclosing
personal information which they may obtain in the
course of their work.
Violators will be subject to administrative
punishment and civil compensation.
11. The Provisions on the
Management of Social
Insurance Records (for Trial
Implementation) 2009
(issued by the Ministry
of Human Resources and
Social Insurance and State
Archives Administration)
require
- that social insurance records, including medical
insurance records, comply with applicable
requirements on storage, confidentiality, use,
transfer, validation, and destruction of archives,
- that they be stored properly, and
- that damage to or destruction, loss, and
disclosure of social insurance records be
prevented.
11
12
Existing Personal Data Protection Rules in China
10. MIIT Regulation of December 2011 (effective 15 March
2012) - ‘Several Regulations on Standardizing Market Order
for Internet Information Services’
11. The Decision of the Standing Committee of the National
People’s Congress on Strengthening Information Protection
on Nation Network – December 28, 2012
12 MIIT Guidelines for Personal Information Protection within
Public and Commercial Services Information Systems (2013)
Sectorial and Provincial Laws..
Administrative Laws and regulations…
12
 Group 1: Laws on Internet: 2
 Decision of the Standing Committee of the National People’s
Congress on the Internet Security 2000
 Digital Signature Law 2004
 Group 2: Other laws related to Internet governance: 21
 E.g. Patent Law, Trade Mark Law, Copyright Law, et al
 Group 3: Administrative regulations & Ministerial Rules.
 Administrative regulations: 51
 Ministerial rules: 843.
China’s internet Laws & Regulations
PKU Report 2011 – Existing Internet Laws in China
 Group 4: Juridical interpretations
 E.g. digital copyright and ISP safe harbour provisions
 Group 5: Self-regulations: 46.
 After 2011….
 New Development in 2012:
 Laws on the Internet
 Decision of the Standing Committee of the National People’s
Congress on Strengthening Information Protection on Na
Network – December 28, 2012
China’s internet Laws & Regulations
PKU Report 2011 – Existing Internet Laws in China
 MIIT Guidelines for Personal Information Protection within
Public and Commercial Services Information Systems (2013)
 In theory, these voluntary guidelines are not as important as
the two regulatory instruments of 2011/12 covering part of the
same territory (primarily Internet IISPs),
 The Decision of the Standing Committee of the National People’s
Congress on Strengthening Information Protection on Nation
Network – December 28, 2012
 the MIIT Regulation of December 2011 (effective 15 March 2012) -
‘Several Regulations on Standardizing Market Order for Internet
Information Services’.
3.2. Recent development of the personal data regulations
3.2.1. MIIT Guidelines 2013
 However, these 2013 Guidelines apply to a much broader
range of businesses, and
 they cover key issues (such as data exports, sensitive data, and
subject access and correction rights), and
 provide some details, not covered in the earlier instruments.
 Definition of Personal Information
3.2. Recent development of the personal data regulations
3.2.1. MIIT Guidelines 2013 - PI
 Remarks:
 The current features of the Chinese personal
information protection framework
 do affect the effective enforcement of PI protection
laws at both civil and criminal levels.
1.3. Remarks: Existing Laws and regulations
 2.1. Recent Development of the Chinese Civil Cases
 2.1.1. Overviews
 2.1.2. Civil Case – Mr Guo vs Minsheng Bank
 2.2. Recent Development of the Chinese Criminal Cases
 2.2.1. Overview & Statistics
 2.2.2. Criminal Case against Individual - China vs. Xu [2013]
 2.2.3. Criminal Case against Company - China vs. Shanghai
XX IT Company [2013]
 2.2.4. Progress vs. Uncertainty
Part II: Recent Cases on Personal Information
Protection in China
 “The country’s information protection regime consists of a
patchwork of
 sector-specific laws and guidelines,
 stand-alone provisions in broader laws, and
 regional laws”.
 --- (Cave, 2013)
 Challenges to the Courts
 Civil Law Code
 Laws/regulations/guideline at different levels
2.1. Recent Development of the Chinese Civil Cases
2.1.1. Overview
 Case: Tort of Privacy Invasion by Bank
 Mr. Guo, a citizen in Nanjing (Capital city of Jiangshu Province) sued the
Minsheng Bank in the Nangjing Xuanwu District Court in 2012.
 The Court held that the bank’s conducts constitute the tort of privacy
invasion.
 Mr Guo was a former Credit Card users of the Minsheng Bank Nanjing
Branch.
 But, in May 2011, he surprisingly discovered that, although he got his
Minsheng credit card cancelled, without his authorization, the Minsheng
Bank, has twice investigated his personal credit information from the
Nanjing Branch of the People's Bank of China (his current bank) under the
names of credit card approval and loan approval in 2010 and in 2011
respectively.
2.1. Recent Development of the Chinese Civil Cases
2.1.2. Guo vs. Minsheng Bank [2012]
 Case: Tort of Privacy Invasion by Bank
 The explanation given by the Minsheng Bank Nanjing Branch was that the
bank is conducting “2nd Round customer development”.
 Mr. Guo did not accept this explanation, and filed a Complaint to the
Management Division of the People’s Bank Nanjing Branch.
 In December 2011, after investigation, the People’s Bank Nanjing Branch
found that Minsheng bank indeed inspected the credit record of Mr. Guo
without his authorization.
 According to the Interim Measures for the Administration of the Basic Data of
Individual Credit Information 2005 (issued by the People’s Bank of China),
 It imposed 20,000 CNY (3,278 USD) monetary penalty to Minsheng Bank.
2.1. Recent Development of the Chinese Civil Cases
2.1.2. Guo vs. Minsheng Bank [2012]
 Case: Tort of Privacy Invasion by Bank
 Mr. Guo believed that the conducts of the Minshen Bank infringed his
privacy right, and initiated a civil litigation against Minshen Bank in the
Nanjing Xuanwu District Court, and asked the bank to make a written
apology on Newspapers.
 In March 2012, the Xuanwu district court made a decision in favour of Mr.
Guo, and requested the Minsheng Bank Nanjing Branch to make a written
apology to Guo.
2.1. Recent Development of the Chinese Civil Cases
2.1.2. Guo vs. Minsheng Bank [2012]
 Hints from this Case: Tort of Privacy Invasion by Bank
 Enforcement Agencies
 The People’s Bank Nanjing Branch
 Nanjing Xuanwu District Court
 Relevant Laws and regulations:
 Civil Law
 Civil Tort of Liability Law
 Interim Measures for the Administration of the Basic Data of Individual Credit
Information 2005 (issued by the People’s Bank of China)
2.1. Recent Development of the Chinese Civil Cases
2.1.2. Guo vs. Minsheng Bank [2012]
 Criminal Law (7th Amendment 2009)
 Crime of selling Personal Information of Citizens
 Crime of illegally providing Personal Information of Citizens
 Crime of illegally obtaining Personal Information of Citizens
 Based on the information provided by the Public Prosecutate of
Beijing Haidian District,
 In 2010, they handled 31 cases (41 people involved), which were
related to a breach of the Criminal Law for illegally obtaining to
Personal Information of Citizens.
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
 VII. An Article is inserted after Article 253 of the Criminal Law as Article
253 (A):
 “Where any staff member of a state organ or an entity in such a field as
finance, telecommunications, transportation, education or medical
treatment, in violation of the state provisions, sells or illegally provides
personal information on citizens, which is obtained during the organ’s
or entity’s performance of duties or provision of services, to others
shall, if the circumstances are serious, be sentenced to fixed-term
imprisonment not more than three years or criminal detention, and/or
be fined.
 Whoever illegally obtains the aforesaid information by stealing or any
other means shall, if the circumstances are serious, be punished under
the preceding paragraph.
 Where any entity commits either of the crimes as described in the
preceding two paragraphs, it shall be fined, and the direct liable person
in charge and other directly liable persons shall be punished under the
applicable paragraph.”
 Key Features of this type of criminal cases:
 1. Measures of Crime – Online trading
 20 of 31 cases happened on the Internet – 64.5% of the total cases
 Step 1: Buyers search online via Baidu or Google to find Sellers
 Step 2: Join in special QQ Group
 Step 3: communicate via QQ or Emails
 Step 4: Bank transfer and Data Transfer
 7 of 31 cases – face-to-to trading – 22.5%
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
Measures of Crime
Via the Internet
Face-to-Face
Others
 Key Features of this type of criminal cases:
 …
 2. Purpose of Crimes – Expand their market & sell for money
 26 of 41 people used the obtained personal information for
marketing purposes – 63.4%
 14 of 41 is for selling to others – 34.1%.
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
Purposes of Crime
Marketing
purposes
Re-selling
purpose
Others
 Key Features of this type of criminal cases:
 …
 3. Targeted Information
 Car owner information – 15 of 31 cases – 48.3%
 Bank customer information – 10 of 31 cases – 32.2%
 Company CEO – 5 of 31 cases – 16.5%
 Phone records/ID card information/shopping records – 3 * 3 - 9.6%
respectively
 Customer information of Carrier company & new-born information –
2*2 – 6.4% respectively, et al…
 In many cases, parties involved obtained multi-type information
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
Targeted Information
Car owner
information
Bank customer
information
 Key Features of this type of criminal cases:
 …
 4. High Risk Group – employees in marketing and insurance
sectors
 11 of 41 people - salesman – 26.8%
 5. New High Risk Group: Company leaders & private detectors
companies
 Company leaders – 10 of 31 cases (13 of 41 people) – 32.2%
 Mangers of private detectors companies – 4 of 31 cases (5/41) – 12.9%
2.2. Recent Development of the Chinese Criminal Cases
2.2.1. Overview & Statistics
 Criminal Case against Individual
 Criminal Judgments by the People’s Court of Shanghai Pudong New District
 Case Number: (2013) Pu Criminal First 1087((2013)浦刑初字第1087号)
 Prosecutor: People's Procuratorate of Shanghai Pudong New District
 Defendant: Xu
 On April 1, 2013, the Prosecutor initiated a criminal litigation against the
Defendant on the ground that the Defendant breached the Criminal Law by
illegally obtaining personal information of citizens.

 On the same day, the Court filed the case and applied a summary procedure
(simplified) to this case. A single judge was appointed and the case was
concluded.
2.2. Recent Development of the Chinese Criminal Cases
2.2.2. China vs. Xu [2013]
 The Prosecutor claimed that:
 On April 25, 2012, the Defendant Xu spent 500 Yuan (around 80 USD),
and purchased more than one million pieces of Customer Order
Information of the “No.1 Store” site - personal information of citizens –
from Zhang (handled separately) via the Internet.
 On November 23, 2013, the Defendant Xu was arrested and confessed all
above facts.
 The Defendant Xu has indicated no objection to the facts that the
Prosecutor claimed above in the court proceeding.
2.2. Recent Development of the Chinese Criminal Cases
2.2.2. China vs. Xu [2013]
 The Court also took into account the evidences, such as:
 - Testimonies made by Witness Wang and Witness Zhang
 - QQ Screenshots,
 - Chat records
 - Alipay transaction records (Chinese PayPal)
 - the list of seized items,
 - and other evidences.
 ‘The Court found that the Defendant Xu illegally obtained personal
information of citizens, and the circumstances are serious. As such,
his conducts constituted a breach of the Criminal Law.’
2.2. Recent Development of the Chinese Criminal Cases
2.2.2. China vs. Xu [2013]
 ‘The Court upheld the claims made by the Prosecutor.
 By virtue of Article 253 (1)(2), Article 67(3), Article 72, Article
73(2)(3) and Article 53 of the Criminal Law, the Court made a
judgment as follows:
 Defendant Xu beached the provision of illegally obtaining to
personal information of citizens, and
 was sentenced to six months imprisonment, suspended for
one year (probation) and
 a monetary penalty of one thousand Yuan (around 163 USD)
applied.’
2.2. Recent Development of the Chinese Criminal Cases
2.2.2. China vs. Xu [2013]
 上海市浦东新区人民法院 刑事判决 (2013)浦刑初字第1087号
被告人徐某,因本案于2012年11月23日被刑事拘留,同年12月21日被逮捕,2013年1月29日被上海市公安局浦东
分局取保候审,同年3月22日被上海市浦东新区人民检察院取保候审。 辩护人赵振华,上海市世通律师事务所
律师。 上海市浦东新区人民检察院以沪浦检刑诉〔2013〕969号起诉书指控被告人徐某犯非法获取公民个人信
息罪,于2013年4月1日向本院提起公诉。本院于同日立案并依法适用简易程序,实行独任审判,公开开庭审理了本
案。上海市浦东新区人民检察院指派代理检察员席娜出庭支持公诉,被告人徐某及其辩护人赵振华到庭参加诉讼。
现已审理终结。 上海市浦东新区人民检察院指控,2012年4月25日,被告人徐某在互联网上从张某某(另案处
理)处,以人民币500元的价格购得一号店网站100余万条(以收货人姓名为关键项去除重复处理后共计28万余条)
订单信息数据的公民个人信息。 2013年11月23日,被告人徐某被公安机关抓获,到案后如实供述了上述犯罪事
实。 上述事实,被告人徐某在开庭审理过程中亦无异议,并有经庭审质证属实的证人王某某、张某某的证
言,QQ截屏图片、聊天记录、支付宝交易记录,扣押物品清单,公安机关出具的案发经过及工作情况,被告人徐
某的户籍资料等证据证实,足以认定。 本院认为,被告人徐某非法获取公民个人信息,情节严重,其行为已
构成非法获取公民个人信息罪。公诉机关指控的事实及罪名成立,予以支持。被告人徐某到案后能如实供述并自愿
认罪,系坦白,依法从轻处罚。依照《中华人民共和国刑法》第二百五十三条之一第一、二款、第六十七条第三
款、第七十二条、第七十三条第二、三款、第五十三条之规定,判决如下: 被告人徐某犯非法获取公民个人
信息罪,判处有期徒刑六个月,缓刑一年,罚金人民币一千元。 (缓刑考验期限,自判决确定之日起计算;
罚金自判决生效后一个月内缴纳。) 被告人徐某回到社区后,应当遵守法律、法规,服从监督、管理,接受
教育,参加公益劳动,做一名有益于社会的公民。 如不服本判决,可在接到判决书的第二日起十日内,通过
本院或者直接向上海市第一中级人民法院提出上诉。书面上诉的,应当提交上诉状正本一份,副本二份。
代理审判员 师坤鹏
 二〇一三年四月十八日
 书记员 陆玮
 Criminal Case against Company
 Criminal Judgments by the People’s Court of Shanghai Pudong New District
 Case Number: (2013) Pu Criminal First 864((2013)浦刑初字第864号)
 Prosecutor: People's Procuratorate of Shanghai XX District
 Defendants: Shanghai XX Information Technology Company (referred to XX
company); Legal Representative: Bai XX.
 On March 13, 2013, the Prosecutor initiated a criminal litigation against the
Defendant on the ground that the Defendant breached the Criminal Law by
illegally obtaining personal information of citizens.

 The Court filed the case and applied a (simplified) summary procedure to
this case. A single judge was appointed and the case was concluded.
2.2. Recent Development of the Chinese Criminal Cases
2.2.3. China vs. Shanghai XX Information Technology Company
[2013]
 The Prosecutor claimed that:
 In July 2012, in order to expand the Company’s market, the Defendant
Bai authorized Zuo (handled separately), the Manger of the Marketing
Division of the Company, to purchase more than one million pieces of
Customer Order Information - personal information of citizens – from Liu
(handled separately) at the price of 900 Yuan (around 146 USD) via the
Internet.
 On February 21, 2013, the Defendant Bai went to the Public Security
authority and make a voluntary confession.
 The Defendants, XX Company and Bai, have indicated no objection to the
facts that Prosecutor claimed above in the Court proceeding.

2.2. Recent Development of the Chinese Criminal Cases
2.2.3. China vs. Shanghai XX IT Company [2013]
 The Court has also taken into account the evidences, such as:
 - Alipay transaction screenshot (Chinese PayPal)
 - Relevant invoices
 - Testimony by Witness Cui
 - Testimonies by related parties Zuo and Liu
 the list of seized items,
 - and other evidences.
2.2. Recent Development of the Chinese Criminal Cases
2.2.3. China vs. Shanghai XX IT Company [2013]
 ‘The Court found that the Defendants, XX Company and Bai, illegally
obtained personal information of citizens, and the circumstances were
serious.
 The conducts of Bai, who was directly in charge of personnel of the
Company, has constituted a breach of the Criminal Law.
 Given that the XX Compand and Bai voluntarily confessed to the Public
Security Authority and pleaded guilty in the Court, by virtues of
relevant laws, the Court decided to apply a lighter punishment.’
2.2. Recent Development of the Chinese Criminal Cases
2.2.3. China vs. Shanghai XX IT Company [2013]
 By virtue of Article 253 (1), Article 67(1), Article 72(1)(3), Article
73(2)(3) and Article 53 of the Criminal Law, the Court made a
judgment as follows:
 1. Defendant XX Company beached the provision of illegally
obtaining to personal information of citizens, and needs to
pay a monetary penalty of 30,000 Yuan (around 5,000 USD).
 2. Defendant BAI beached the provision of illegally obtaining
personal information of citizens, and was sentenced to six
months imprisonment, suspended for one year and a
monetary penalty of 10,000 Yuan (around 1,630 USD).

 Judge Ling Hong
 March 21, 2013
2.2. Recent Development of the Chinese Criminal Cases
2.2.3. China vs. Shanghai XX IT Company [2013]
 VII. An Article is inserted after Article 253 of the Criminal Law as Article
253 (A):
 “Where any staff member of a state organ or an entity in such a field as
finance, telecommunications, transportation, education or medical
treatment, in violation of the state provisions, sells or illegally provides
personal information on citizens, which is obtained during the organ’s
or entity’s performance of duties or provision of services, to others
shall, if the circumstances are serious, be sentenced to fixed-term
imprisonment not more than three years or criminal detention, and/or
be fined.
 Whoever illegally obtains the aforesaid information by stealing or any
other means shall, if the circumstances are serious, be punished under
the preceding paragraph.
 Where any entity commits either of the crimes as described in the
preceding two paragraphs, it shall be fined, and the direct liable person
in charge and other directly liable persons shall be punished under the
applicable paragraph.”
 Progress:
 The new amendment started to be well enforced.
 Uncertainty:
 Lack of a clear definition of “personal information”
 The meaning of “state provisions”
 The meaning of “if the circumstances are serious”/ “severe
consequence”
 Next, BACK to the issues at the national level…
2.2. Recent Development of the Chinese Criminal Cases
2.2.4. Remarks: Progress vs. Uncertainty
 3.1. General Challenges of protecting personal data in China
 3.1.1. Hints from 2013 BSA Global Cloud Computing Scorecard
 Ranking improved
 Lack of laws and industrial rules
 3.1.2. Challenges from Legal Tradition
 3.2. Suggestions for future reform
 3.2.1. Three models: US, EU and Australia
 3.2.2. Enforcement Agencies
Part III: Challenges & Recommendations
 The BSA survey examined the policy environment for
CC in several countries around the world.
 The BSA survey examined 24 countries, which
together account for 80 percent of the global ICT
market.
 The BSA Scorecard Measuring CC Readiness
3.1. General Challenges
3.1.1. Hints from 2013 BSA Global Cloud Computing Scorecard
 The BSA Scorecard Measuring CC Readiness
 It examines major laws and regulations relevant to CC in
seven policy categories as well as each country’s ICT-
related infrastructure and broadband deployment.
 1. Data Privacy
 2. Security
 3. Cybercrime
 4. IPRs
 5. Support for Industry-Led Standards & International
Harmonization of Rules
 6. Promoting Free Trade
 7. ICT Readiness, Broadband Deployment.
2013 BSA Global Cloud Computing Scorecard
 China’s Ranking
 +2 (in comparison with 2011)
 19th of 24
3.1. General Challenges
3.1.1. Hints form 2013 BSA Global CC Scorecard
 Screen Shot 2013-07-05 at 1.08.10 PM
 As mentioned above….
 Progress:
 Recent development – all about protecting personal
information on the Internet (rather than general protection
measures)
 Further improvements:
 Lack of the Personal Information Protection Law at the
national level
 Lack of unified privacy enforcement authority at the national
level
 Challenges for the quick growth of Innovation Industry
3.1. General Challenges
3.1.1. Hints form 2013 BSA Global CC Scorecard
 China’s overall regulatory approach may presents challenges to the
development of innovation industry, such as cloud computing.
 1. China’s preference for top-down mandatory regulation is often at
odds with the type of public-private collaboration and industry self-
regulation so critical to growing new technologies.
 2. data protection and data sovereignty fears, as well as
cybersecurity concerns, are creating barriers for deployment of
leading global technologies.
 3. complicating the policy environment is China’s drive to promote
domestic industry, as well as preserve its existing market access
controls.
 (USITO, 2012)
3.1. General Challenges
3.1.2. Challenges from Legal Tradition
 EU Model: Centralized
 US Model: Decentralized
 Australia Model: Centralized law and principles + detailed
industrial guidelines.
 Recommendation 1 – May consider drawing on lessons
from the experiences of Australian Model to harmonize
the existing laws on personal data protection
3.2. Suggestions for future laws and policies reform
3.2.1. Three models: US, EU and Australia
 Recommendation 2:
 May consider leaving privacy cases to Intellectual Property
Courts (IP, Antitrust, Personal Information Protection)
 Recommendation 3:
 Courts may play a more active role in explaining how existing
data protection laws could be applied
 Chinese Supreme Court may issue a Guideline on this issue –
more judicial interpretations
3.2. Suggestions for future laws and policies reform
3.2.2. Enforcement Agencies
 “Based on the global opportunity that Cloud
Computing presents, each country’s policy changes
will alter not just that country’s environment but the
global market for CC as a whole.”
 (BSA, 2013)
 …. apply this idea broadly….
Conclusion and Remarks
 “Based on the global opportunity that Information
Economy presents, each country’s policy changes will
alter not just that country’s environment but the
global Information Economy as a whole.”
Conclusion and Remarks
 Prof. Graham Greenleaf, Faculty of Law, UNSW
 Mr. Yun Xuan, Director of IP Policy and Enforcement
Division, Microsoft (China) Co., Ltd
 Ms. Sophia Wang, Director & Chief Representative, China,
BSA, The Software Alliance
Acknowledgment
Thank You !

More Related Content

What's hot

Data Protection: balancing convenience, privacy and security
Data Protection: balancing convenience, privacy and securityData Protection: balancing convenience, privacy and security
Data Protection: balancing convenience, privacy and securityEthical Sector
 
GDPR Data Subject Rights - What You Need to Know
GDPR Data Subject Rights - What You Need to KnowGDPR Data Subject Rights - What You Need to Know
GDPR Data Subject Rights - What You Need to KnowPiwik PRO
 
General Data Protection Regulations (GDPR): Do you understand it and are you ...
General Data Protection Regulations (GDPR): Do you understand it and are you ...General Data Protection Regulations (GDPR): Do you understand it and are you ...
General Data Protection Regulations (GDPR): Do you understand it and are you ...Cvent
 
Tietosuojavaatimukset markkinointiviestinnässä
Tietosuojavaatimukset markkinointiviestinnässäTietosuojavaatimukset markkinointiviestinnässä
Tietosuojavaatimukset markkinointiviestinnässäHarto Pönkä
 
GDPR Presentation slides
GDPR Presentation slidesGDPR Presentation slides
GDPR Presentation slidesNaomi Holmes
 
Personal data protection bill
Personal data protection bill Personal data protection bill
Personal data protection bill Mathew Chacko
 
Privacy in India: Legal issues
Privacy in India: Legal issuesPrivacy in India: Legal issues
Privacy in India: Legal issuesSagar Rahurkar
 
Privacy right under it act, 2000 and under other law
Privacy right under it act, 2000 and under other lawPrivacy right under it act, 2000 and under other law
Privacy right under it act, 2000 and under other lawNitya Nand Pandey
 
Cyber Crime Investigation
Cyber Crime InvestigationCyber Crime Investigation
Cyber Crime InvestigationHarshita Ved
 
Legal framework for the protection of refugees in India
Legal framework for the protection of refugees in IndiaLegal framework for the protection of refugees in India
Legal framework for the protection of refugees in IndiaFazal Abdali
 
China's PIPL: How to Comply in Under 60 Days
China's PIPL: How to Comply in Under 60 DaysChina's PIPL: How to Comply in Under 60 Days
China's PIPL: How to Comply in Under 60 DaysTrustArc
 
LGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEI
LGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEILGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEI
LGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEIWellington Monaco
 
EU's General Data Protection Regulation (GDPR)
EU's General Data Protection Regulation (GDPR)EU's General Data Protection Regulation (GDPR)
EU's General Data Protection Regulation (GDPR)Kimberly Simon MBA
 
GDPR: Data Breach Notification and Communications
GDPR: Data Breach Notification and CommunicationsGDPR: Data Breach Notification and Communications
GDPR: Data Breach Notification and CommunicationsCharlie Pownall
 
Reasonable security practices and procedures and sensitive personal data or i...
Reasonable security practices and procedures and sensitive personal data or i...Reasonable security practices and procedures and sensitive personal data or i...
Reasonable security practices and procedures and sensitive personal data or i...Vijay Dalmia
 

What's hot (20)

Data Protection: balancing convenience, privacy and security
Data Protection: balancing convenience, privacy and securityData Protection: balancing convenience, privacy and security
Data Protection: balancing convenience, privacy and security
 
EU-US Data Privacy Framework
EU-US Data Privacy FrameworkEU-US Data Privacy Framework
EU-US Data Privacy Framework
 
GDPR Data Subject Rights - What You Need to Know
GDPR Data Subject Rights - What You Need to KnowGDPR Data Subject Rights - What You Need to Know
GDPR Data Subject Rights - What You Need to Know
 
General Data Protection Regulation
General Data Protection RegulationGeneral Data Protection Regulation
General Data Protection Regulation
 
General Data Protection Regulations (GDPR): Do you understand it and are you ...
General Data Protection Regulations (GDPR): Do you understand it and are you ...General Data Protection Regulations (GDPR): Do you understand it and are you ...
General Data Protection Regulations (GDPR): Do you understand it and are you ...
 
Tietosuojavaatimukset markkinointiviestinnässä
Tietosuojavaatimukset markkinointiviestinnässäTietosuojavaatimukset markkinointiviestinnässä
Tietosuojavaatimukset markkinointiviestinnässä
 
Personal Data Protection in Malaysia
Personal Data Protection in MalaysiaPersonal Data Protection in Malaysia
Personal Data Protection in Malaysia
 
GDPR Presentation slides
GDPR Presentation slidesGDPR Presentation slides
GDPR Presentation slides
 
GDPR infographic
GDPR infographicGDPR infographic
GDPR infographic
 
Personal data protection bill
Personal data protection bill Personal data protection bill
Personal data protection bill
 
Privacy in India: Legal issues
Privacy in India: Legal issuesPrivacy in India: Legal issues
Privacy in India: Legal issues
 
Privacy right under it act, 2000 and under other law
Privacy right under it act, 2000 and under other lawPrivacy right under it act, 2000 and under other law
Privacy right under it act, 2000 and under other law
 
GDPR for Dummies
GDPR for DummiesGDPR for Dummies
GDPR for Dummies
 
Cyber Crime Investigation
Cyber Crime InvestigationCyber Crime Investigation
Cyber Crime Investigation
 
Legal framework for the protection of refugees in India
Legal framework for the protection of refugees in IndiaLegal framework for the protection of refugees in India
Legal framework for the protection of refugees in India
 
China's PIPL: How to Comply in Under 60 Days
China's PIPL: How to Comply in Under 60 DaysChina's PIPL: How to Comply in Under 60 Days
China's PIPL: How to Comply in Under 60 Days
 
LGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEI
LGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEILGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEI
LGPD - LEI GERAL DE PROTEÇÃO DE DADOS - ESTRUTURA DA LEI
 
EU's General Data Protection Regulation (GDPR)
EU's General Data Protection Regulation (GDPR)EU's General Data Protection Regulation (GDPR)
EU's General Data Protection Regulation (GDPR)
 
GDPR: Data Breach Notification and Communications
GDPR: Data Breach Notification and CommunicationsGDPR: Data Breach Notification and Communications
GDPR: Data Breach Notification and Communications
 
Reasonable security practices and procedures and sensitive personal data or i...
Reasonable security practices and procedures and sensitive personal data or i...Reasonable security practices and procedures and sensitive personal data or i...
Reasonable security practices and procedures and sensitive personal data or i...
 

Similar to Personal Information Protection in China - Recent Development of the Chinese Civil and Criminal Cases

Ronit Mathur Cyber Security assesment.pptx
Ronit Mathur Cyber Security assesment.pptxRonit Mathur Cyber Security assesment.pptx
Ronit Mathur Cyber Security assesment.pptxManuGupta344215
 
An Indian Outline on Database Protection
An Indian Outline on Database ProtectionAn Indian Outline on Database Protection
An Indian Outline on Database ProtectionSinghania2015
 
Data Protection in India
Data Protection in IndiaData Protection in India
Data Protection in IndiaHome
 
Pubcon Privacy Legal Presentation by David Mink
Pubcon Privacy Legal Presentation by David MinkPubcon Privacy Legal Presentation by David Mink
Pubcon Privacy Legal Presentation by David MinkMatt Siltala
 
THE BRAZILIAN LAW ON PERSONAL DATA PROTECTION
THE BRAZILIAN LAW ON PERSONAL DATA PROTECTIONTHE BRAZILIAN LAW ON PERSONAL DATA PROTECTION
THE BRAZILIAN LAW ON PERSONAL DATA PROTECTIONIJNSA Journal
 
Breve sintesi della "Personal Information Protection Law" cinese
Breve sintesi della "Personal Information Protection Law" cineseBreve sintesi della "Personal Information Protection Law" cinese
Breve sintesi della "Personal Information Protection Law" cineseEdoardo Ferraro
 
Biometric Personal Data, Legal and Technological Utilization Issues
Biometric Personal Data, Legal and Technological Utilization IssuesBiometric Personal Data, Legal and Technological Utilization Issues
Biometric Personal Data, Legal and Technological Utilization IssuesGiannisBasa
 
Privacy and Data Protection in South Africa
Privacy and Data Protection in South AfricaPrivacy and Data Protection in South Africa
Privacy and Data Protection in South Africablogzilla
 
CCSP_Self_Domain_6.ppt
CCSP_Self_Domain_6.pptCCSP_Self_Domain_6.ppt
CCSP_Self_Domain_6.pptSamir Jha
 
Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...
Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...
Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...Terrance Tong
 
高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...
高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...
高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...mhmjapan
 
Jamaica's Data Protection Act: Compliance required from the business community
Jamaica's Data Protection Act: Compliance required from the business communityJamaica's Data Protection Act: Compliance required from the business community
Jamaica's Data Protection Act: Compliance required from the business communityEmerson Bryan
 
Data Protection Guide – What are your rights as a citizen?
Data Protection Guide – What are your rights as a citizen?Data Protection Guide – What are your rights as a citizen?
Data Protection Guide – What are your rights as a citizen?Edouard Nguyen
 
Know your rights protection against facial recognition software.
Know your rights  protection against facial recognition software.Know your rights  protection against facial recognition software.
Know your rights protection against facial recognition software.Diganth Raj Sehgal
 
Indonesian Legislatives Passes Personal Data Protection Bill.pdf
Indonesian Legislatives Passes Personal Data Protection Bill.pdfIndonesian Legislatives Passes Personal Data Protection Bill.pdf
Indonesian Legislatives Passes Personal Data Protection Bill.pdfAHRP Law Firm
 
E Commerce Platform Data Ownership and Legal Protection
E Commerce Platform Data Ownership and Legal ProtectionE Commerce Platform Data Ownership and Legal Protection
E Commerce Platform Data Ownership and Legal Protectionijtsrd
 
What are the new laws under Canada Digital Privacy Act.pdf
What are the new laws under Canada Digital Privacy Act.pdfWhat are the new laws under Canada Digital Privacy Act.pdf
What are the new laws under Canada Digital Privacy Act.pdfRiley Claire
 
security issue in e-commerce
security issue in e-commercesecurity issue in e-commerce
security issue in e-commercePalavesa Krishnan
 
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...Yar Chaikovsky
 

Similar to Personal Information Protection in China - Recent Development of the Chinese Civil and Criminal Cases (20)

Cie 2 cyber law
Cie 2  cyber lawCie 2  cyber law
Cie 2 cyber law
 
Ronit Mathur Cyber Security assesment.pptx
Ronit Mathur Cyber Security assesment.pptxRonit Mathur Cyber Security assesment.pptx
Ronit Mathur Cyber Security assesment.pptx
 
An Indian Outline on Database Protection
An Indian Outline on Database ProtectionAn Indian Outline on Database Protection
An Indian Outline on Database Protection
 
Data Protection in India
Data Protection in IndiaData Protection in India
Data Protection in India
 
Pubcon Privacy Legal Presentation by David Mink
Pubcon Privacy Legal Presentation by David MinkPubcon Privacy Legal Presentation by David Mink
Pubcon Privacy Legal Presentation by David Mink
 
THE BRAZILIAN LAW ON PERSONAL DATA PROTECTION
THE BRAZILIAN LAW ON PERSONAL DATA PROTECTIONTHE BRAZILIAN LAW ON PERSONAL DATA PROTECTION
THE BRAZILIAN LAW ON PERSONAL DATA PROTECTION
 
Breve sintesi della "Personal Information Protection Law" cinese
Breve sintesi della "Personal Information Protection Law" cineseBreve sintesi della "Personal Information Protection Law" cinese
Breve sintesi della "Personal Information Protection Law" cinese
 
Biometric Personal Data, Legal and Technological Utilization Issues
Biometric Personal Data, Legal and Technological Utilization IssuesBiometric Personal Data, Legal and Technological Utilization Issues
Biometric Personal Data, Legal and Technological Utilization Issues
 
Privacy and Data Protection in South Africa
Privacy and Data Protection in South AfricaPrivacy and Data Protection in South Africa
Privacy and Data Protection in South Africa
 
CCSP_Self_Domain_6.ppt
CCSP_Self_Domain_6.pptCCSP_Self_Domain_6.ppt
CCSP_Self_Domain_6.ppt
 
Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...
Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...
Strengthening the Great Cyber-Wall of China — An Effort in Protecting the Mas...
 
高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...
高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...
高谷知佐子講演_PERSONAL DATA AND PRIVACY ISSUES IN CROSS-BORDER M&A PROCESS Japan ca...
 
Jamaica's Data Protection Act: Compliance required from the business community
Jamaica's Data Protection Act: Compliance required from the business communityJamaica's Data Protection Act: Compliance required from the business community
Jamaica's Data Protection Act: Compliance required from the business community
 
Data Protection Guide – What are your rights as a citizen?
Data Protection Guide – What are your rights as a citizen?Data Protection Guide – What are your rights as a citizen?
Data Protection Guide – What are your rights as a citizen?
 
Know your rights protection against facial recognition software.
Know your rights  protection against facial recognition software.Know your rights  protection against facial recognition software.
Know your rights protection against facial recognition software.
 
Indonesian Legislatives Passes Personal Data Protection Bill.pdf
Indonesian Legislatives Passes Personal Data Protection Bill.pdfIndonesian Legislatives Passes Personal Data Protection Bill.pdf
Indonesian Legislatives Passes Personal Data Protection Bill.pdf
 
E Commerce Platform Data Ownership and Legal Protection
E Commerce Platform Data Ownership and Legal ProtectionE Commerce Platform Data Ownership and Legal Protection
E Commerce Platform Data Ownership and Legal Protection
 
What are the new laws under Canada Digital Privacy Act.pdf
What are the new laws under Canada Digital Privacy Act.pdfWhat are the new laws under Canada Digital Privacy Act.pdf
What are the new laws under Canada Digital Privacy Act.pdf
 
security issue in e-commerce
security issue in e-commercesecurity issue in e-commerce
security issue in e-commerce
 
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...
 

More from Marcelo Gomes Freire (20)

Aircraft Airworthiness
Aircraft AirworthinessAircraft Airworthiness
Aircraft Airworthiness
 
Child Rights Toolkit
Child Rights ToolkitChild Rights Toolkit
Child Rights Toolkit
 
Marijuana in Uruguay and beyond
Marijuana in Uruguay and beyondMarijuana in Uruguay and beyond
Marijuana in Uruguay and beyond
 
Immigration
ImmigrationImmigration
Immigration
 
Decriminalization of Drugs in Portugal
Decriminalization of Drugs in PortugalDecriminalization of Drugs in Portugal
Decriminalization of Drugs in Portugal
 
Civil law codes
Civil law codesCivil law codes
Civil law codes
 
American Airlines
American AirlinesAmerican Airlines
American Airlines
 
Experience and Implication
Experience and ImplicationExperience and Implication
Experience and Implication
 
South Korea’s Foreign Relations
South Korea’s Foreign RelationsSouth Korea’s Foreign Relations
South Korea’s Foreign Relations
 
Cuba under Castro
Cuba under Castro Cuba under Castro
Cuba under Castro
 
Latin American Governments
Latin American GovernmentsLatin American Governments
Latin American Governments
 
Cuban revolution
Cuban revolution Cuban revolution
Cuban revolution
 
Thailand: an overview
Thailand: an overviewThailand: an overview
Thailand: an overview
 
SWOT Analysis: Thailand
SWOT Analysis: ThailandSWOT Analysis: Thailand
SWOT Analysis: Thailand
 
Business Law
Business LawBusiness Law
Business Law
 
The Chicago Convention
The Chicago ConventionThe Chicago Convention
The Chicago Convention
 
To Privatize or Not to Privatize, that is the Question
To Privatize or Not to Privatize, that is the QuestionTo Privatize or Not to Privatize, that is the Question
To Privatize or Not to Privatize, that is the Question
 
7th ESPI Autumn Conference
7th ESPI Autumn Conference7th ESPI Autumn Conference
7th ESPI Autumn Conference
 
Get on the Fast-Track
Get on the Fast-TrackGet on the Fast-Track
Get on the Fast-Track
 
Work on development from a human rights perspective
Work on development from a human rights perspective Work on development from a human rights perspective
Work on development from a human rights perspective
 

Recently uploaded

Trial Tilak t 1897,1909, and 1916 sedition
Trial Tilak t 1897,1909, and 1916 seditionTrial Tilak t 1897,1909, and 1916 sedition
Trial Tilak t 1897,1909, and 1916 seditionNilamPadekar1
 
POLICE ACT, 1861 the details about police system.pptx
POLICE ACT, 1861 the details about police system.pptxPOLICE ACT, 1861 the details about police system.pptx
POLICE ACT, 1861 the details about police system.pptxAbhishekchatterjee248859
 
如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书
如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书
如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书SD DS
 
如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书
如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书
如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书SD DS
 
国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》
国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》
国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》o8wvnojp
 
Comparison of GenAI benchmarking models for legal use cases
Comparison of GenAI benchmarking models for legal use casesComparison of GenAI benchmarking models for legal use cases
Comparison of GenAI benchmarking models for legal use casesritwikv20
 
如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书
 如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书 如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书
如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书Sir Lt
 
Why Every Business Should Invest in a Social Media Fraud Analyst.pdf
Why Every Business Should Invest in a Social Media Fraud Analyst.pdfWhy Every Business Should Invest in a Social Media Fraud Analyst.pdf
Why Every Business Should Invest in a Social Media Fraud Analyst.pdfMilind Agarwal
 
定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一
定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一
定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一st Las
 
如何办理纽约州立大学石溪分校毕业证学位证书
 如何办理纽约州立大学石溪分校毕业证学位证书 如何办理纽约州立大学石溪分校毕业证学位证书
如何办理纽约州立大学石溪分校毕业证学位证书Fir sss
 
Law360 - How Duty Of Candor Figures In USPTO AI Ethics Guidance
Law360 - How Duty Of Candor Figures In USPTO AI Ethics GuidanceLaw360 - How Duty Of Candor Figures In USPTO AI Ethics Guidance
Law360 - How Duty Of Candor Figures In USPTO AI Ethics GuidanceMichael Cicero
 
如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书
如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书
如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书FS LS
 
如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书
如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书
如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书Fir L
 
如何办理澳洲南澳大学(UniSA)毕业证学位证书
如何办理澳洲南澳大学(UniSA)毕业证学位证书如何办理澳洲南澳大学(UniSA)毕业证学位证书
如何办理澳洲南澳大学(UniSA)毕业证学位证书Fir L
 
Key Factors That Influence Property Tax Rates
Key Factors That Influence Property Tax RatesKey Factors That Influence Property Tax Rates
Key Factors That Influence Property Tax RatesHome Tax Saver
 
如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书
如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书
如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书FS LS
 
如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书
如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书
如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书SD DS
 
如何办理(USF文凭证书)美国旧金山大学毕业证学位证书
如何办理(USF文凭证书)美国旧金山大学毕业证学位证书如何办理(USF文凭证书)美国旧金山大学毕业证学位证书
如何办理(USF文凭证书)美国旧金山大学毕业证学位证书Fs Las
 
如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书
如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书
如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书Fs Las
 
An Introduction guidance of the European Union Law 2020_EU Seminar 4.pptx
An Introduction guidance of the European Union Law 2020_EU Seminar 4.pptxAn Introduction guidance of the European Union Law 2020_EU Seminar 4.pptx
An Introduction guidance of the European Union Law 2020_EU Seminar 4.pptxKUHANARASARATNAM1
 

Recently uploaded (20)

Trial Tilak t 1897,1909, and 1916 sedition
Trial Tilak t 1897,1909, and 1916 seditionTrial Tilak t 1897,1909, and 1916 sedition
Trial Tilak t 1897,1909, and 1916 sedition
 
POLICE ACT, 1861 the details about police system.pptx
POLICE ACT, 1861 the details about police system.pptxPOLICE ACT, 1861 the details about police system.pptx
POLICE ACT, 1861 the details about police system.pptx
 
如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书
如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书
如何办理(UCD毕业证书)加州大学戴维斯分校毕业证学位证书
 
如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书
如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书
如何办理(ISU毕业证书)爱荷华州立大学毕业证学位证书
 
国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》
国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》
国外大学毕业证《奥克兰大学毕业证办理成绩单GPA修改》
 
Comparison of GenAI benchmarking models for legal use cases
Comparison of GenAI benchmarking models for legal use casesComparison of GenAI benchmarking models for legal use cases
Comparison of GenAI benchmarking models for legal use cases
 
如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书
 如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书 如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书
如何办理(MSU文凭证书)密歇根州立大学毕业证学位证书
 
Why Every Business Should Invest in a Social Media Fraud Analyst.pdf
Why Every Business Should Invest in a Social Media Fraud Analyst.pdfWhy Every Business Should Invest in a Social Media Fraud Analyst.pdf
Why Every Business Should Invest in a Social Media Fraud Analyst.pdf
 
定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一
定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一
定制(BU文凭证书)美国波士顿大学毕业证成绩单原版一比一
 
如何办理纽约州立大学石溪分校毕业证学位证书
 如何办理纽约州立大学石溪分校毕业证学位证书 如何办理纽约州立大学石溪分校毕业证学位证书
如何办理纽约州立大学石溪分校毕业证学位证书
 
Law360 - How Duty Of Candor Figures In USPTO AI Ethics Guidance
Law360 - How Duty Of Candor Figures In USPTO AI Ethics GuidanceLaw360 - How Duty Of Candor Figures In USPTO AI Ethics Guidance
Law360 - How Duty Of Candor Figures In USPTO AI Ethics Guidance
 
如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书
如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书
如何办理伦敦南岸大学毕业证(本硕)LSBU学位证书
 
如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书
如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书
如何办理新加坡南洋理工大学毕业证(本硕)NTU学位证书
 
如何办理澳洲南澳大学(UniSA)毕业证学位证书
如何办理澳洲南澳大学(UniSA)毕业证学位证书如何办理澳洲南澳大学(UniSA)毕业证学位证书
如何办理澳洲南澳大学(UniSA)毕业证学位证书
 
Key Factors That Influence Property Tax Rates
Key Factors That Influence Property Tax RatesKey Factors That Influence Property Tax Rates
Key Factors That Influence Property Tax Rates
 
如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书
如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书
如何办理密德萨斯大学毕业证(本硕)Middlesex学位证书
 
如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书
如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书
如何办理(CQU毕业证书)中央昆士兰大学毕业证学位证书
 
如何办理(USF文凭证书)美国旧金山大学毕业证学位证书
如何办理(USF文凭证书)美国旧金山大学毕业证学位证书如何办理(USF文凭证书)美国旧金山大学毕业证学位证书
如何办理(USF文凭证书)美国旧金山大学毕业证学位证书
 
如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书
如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书
如何办理(SFSta文凭证书)美国旧金山州立大学毕业证学位证书
 
An Introduction guidance of the European Union Law 2020_EU Seminar 4.pptx
An Introduction guidance of the European Union Law 2020_EU Seminar 4.pptxAn Introduction guidance of the European Union Law 2020_EU Seminar 4.pptx
An Introduction guidance of the European Union Law 2020_EU Seminar 4.pptx
 

Personal Information Protection in China - Recent Development of the Chinese Civil and Criminal Cases

  • 1. Personal Information Protection in China - Recent Development of the Chinese Civil and Criminal Cases Prepared for The Third Asian Privacy Scholars Network Conference, Faculty of Law, UHK, 8-9 July, 2013 Dr George Tian Senior Lecturer, Faculty of Law University of Technology Sydney (UTS) Email: George.Tian@uts.edu.au
  • 2.  Part I: Overview of Personal Information Protection Laws in China  Part II: Recent Cases on Personal Information Protection in China  2.1. Recent Development of the Chinese Civil Cases  2.2. Recent Development of the Chinese Criminal Cases  Part III: Challenges & Recommendations  3.1. Challenges of protecting personal information in China  3.2. Suggestions for future Legal Reform Structure
  • 3.  1.1. General Feature  1.2. Existing Laws and regulations  1.3. Comments and Remarks Part I: Overview of the Personal Information Protection Regime in China
  • 4.  China is still in the process of establishing  a comprehensive legal framework to regulate the use and disclosure of personal data  not currently have  a national level law that delineates how a company can legally collect, process and retain personal data.  “The country’s information protection regime consists of a patchwork of  sector-specific laws and guidelines,  stand-alone provisions in broader laws, and  regional laws”.  --- (Cave, 2013) 1.1. General Feature
  • 5.  But … it seems that such a situation is changing gradually….  New Efforts of Harmonization  Particularly in the recent two or three years, China made a good progress in harmonizing its personal data protection laws.  E.g. making law, regulations and guidelines for protecting personal information protection on the Internet  E.g. MIIT Guideline 2013 (more details will be discussed later)  Draft of Personal Information Protection Law (since 2005) 1.1. General Feature
  • 6. 6 1.2. Existing Personal Data Protection Rules in China 1. Constitution Law Articles 38 and 40 Rights that relate to privacy, e.g. - right of dignity of the person, - prohibitions against insult, defamation, false accusation or false information directed against Chinese citizens, and - right of freedom and secrecy of correspondence. 2. Civil Law Article 120 the General Principles of the Civil Law protect a citizen’s right of - personal name, - portrait, - reputation or honor. 6
  • 7. 7 Existing Personal Data Protection Rules in China 3. Criminal Law (7th Amendment) Article 253 (1) make working personnel of state agencies, or of organizations in particular industry sectors, potentially subject to criminal liability, - if they sell or illegally provide to other persons individual information of citizens obtained - during the course of such organization’s performance of official duties or provision of services. (2) An organization and its responsible officers could also be made subject to the same criminal liability, - if it obtains information that had been misappropriated in this way. 7
  • 8. 8 Existing Personal Data Protection Rules in China 4. Tort Liability Law 2009 (effective on July 1st, 2010) Articles 2, 6, 3, 15, 36, 61, 62 contains provisions which establish a right of a private citizen to sue for damages or other remedies in tort, - in cases where medical records are mishandled and - in cases where the internet is used to harm the interests of the private citizen or, more generally, - in cases where the private citizen’s right of privacy, health, name, reputation, honor or portrait has been infringed upon and damages have occurred 5. Interpretation of the Supreme People’s Court on Issues regarding the Ascertainment of Liability for Compensation for Psychological Damages in Civil Torts protect an individual’s rights of personality, including an individual’s privacy, - by granting a right to claim for psychological damages. 8
  • 9. 9 6 The Guidelines for Payment and Clearing Organizations on Anti- money Laundering and Anti-terrorist Financing 2009 (issued by the People’s Bank of China) require payment and clearing organizations and their branches - to establish internal control systems to prevent money laundering and terrorist financing, and - to establish systems for the ascertainment of client identities, for the reporting of suspicious transactions, and for the preservation of client identity and transaction records.. 7 Interim Measures for the Administration of the Basic Data of Individual Credit Information 2005 (issued by the People’s Bank of China) prohibit governmental authorities and other organizations, as well as their staff, from disclosing personal information which they may obtain in the course of their work. Violators will be subject to administrative punishment and civil compensation. 9 Existing Personal Data Protection Rules in China
  • 10. 10 Existing Personal Data Protection Rules in China 8. The Norms for Electronic Medical Records of Traditional Chinese Medicine (for Trial Implementation) 2010 (issued by the State Administration of Traditional Chinese Medicine) require medical organizations to - set up information security schemes for electronic medical records and - establish corresponding powers for doctors, nurses and other management staff in the hospital to read, copy, and type electronic medical records, and require hospitals to establish usage records for the electronic medical records. prohibit any entity or individual from reading or copying electronic medical records without due authorization. 9. The Basic Norms for Electronic Medical Records 2010 (issued by the Ministry of Health) prohibit unauthorized review of patients’ medical records - by other institutions and persons besides the medical personnel that perform the medical activity and quality control personnel. [Exemption] permit the review of medical records, after obtaining consent of the medical institution, for the purpose of scientific research and education.10
  • 11. 11 Existing Personal Data Protection Rules in China 10. Social Insurance Law 2010 prohibit governmental authorities and other organizations, as well as their staff, from disclosing personal information which they may obtain in the course of their work. Violators will be subject to administrative punishment and civil compensation. 11. The Provisions on the Management of Social Insurance Records (for Trial Implementation) 2009 (issued by the Ministry of Human Resources and Social Insurance and State Archives Administration) require - that social insurance records, including medical insurance records, comply with applicable requirements on storage, confidentiality, use, transfer, validation, and destruction of archives, - that they be stored properly, and - that damage to or destruction, loss, and disclosure of social insurance records be prevented. 11
  • 12. 12 Existing Personal Data Protection Rules in China 10. MIIT Regulation of December 2011 (effective 15 March 2012) - ‘Several Regulations on Standardizing Market Order for Internet Information Services’ 11. The Decision of the Standing Committee of the National People’s Congress on Strengthening Information Protection on Nation Network – December 28, 2012 12 MIIT Guidelines for Personal Information Protection within Public and Commercial Services Information Systems (2013) Sectorial and Provincial Laws.. Administrative Laws and regulations… 12
  • 13.  Group 1: Laws on Internet: 2  Decision of the Standing Committee of the National People’s Congress on the Internet Security 2000  Digital Signature Law 2004  Group 2: Other laws related to Internet governance: 21  E.g. Patent Law, Trade Mark Law, Copyright Law, et al  Group 3: Administrative regulations & Ministerial Rules.  Administrative regulations: 51  Ministerial rules: 843. China’s internet Laws & Regulations PKU Report 2011 – Existing Internet Laws in China
  • 14.  Group 4: Juridical interpretations  E.g. digital copyright and ISP safe harbour provisions  Group 5: Self-regulations: 46.  After 2011….  New Development in 2012:  Laws on the Internet  Decision of the Standing Committee of the National People’s Congress on Strengthening Information Protection on Na Network – December 28, 2012 China’s internet Laws & Regulations PKU Report 2011 – Existing Internet Laws in China
  • 15.  MIIT Guidelines for Personal Information Protection within Public and Commercial Services Information Systems (2013)  In theory, these voluntary guidelines are not as important as the two regulatory instruments of 2011/12 covering part of the same territory (primarily Internet IISPs),  The Decision of the Standing Committee of the National People’s Congress on Strengthening Information Protection on Nation Network – December 28, 2012  the MIIT Regulation of December 2011 (effective 15 March 2012) - ‘Several Regulations on Standardizing Market Order for Internet Information Services’. 3.2. Recent development of the personal data regulations 3.2.1. MIIT Guidelines 2013
  • 16.  However, these 2013 Guidelines apply to a much broader range of businesses, and  they cover key issues (such as data exports, sensitive data, and subject access and correction rights), and  provide some details, not covered in the earlier instruments.  Definition of Personal Information 3.2. Recent development of the personal data regulations 3.2.1. MIIT Guidelines 2013 - PI
  • 17.  Remarks:  The current features of the Chinese personal information protection framework  do affect the effective enforcement of PI protection laws at both civil and criminal levels. 1.3. Remarks: Existing Laws and regulations
  • 18.  2.1. Recent Development of the Chinese Civil Cases  2.1.1. Overviews  2.1.2. Civil Case – Mr Guo vs Minsheng Bank  2.2. Recent Development of the Chinese Criminal Cases  2.2.1. Overview & Statistics  2.2.2. Criminal Case against Individual - China vs. Xu [2013]  2.2.3. Criminal Case against Company - China vs. Shanghai XX IT Company [2013]  2.2.4. Progress vs. Uncertainty Part II: Recent Cases on Personal Information Protection in China
  • 19.  “The country’s information protection regime consists of a patchwork of  sector-specific laws and guidelines,  stand-alone provisions in broader laws, and  regional laws”.  --- (Cave, 2013)  Challenges to the Courts  Civil Law Code  Laws/regulations/guideline at different levels 2.1. Recent Development of the Chinese Civil Cases 2.1.1. Overview
  • 20.  Case: Tort of Privacy Invasion by Bank  Mr. Guo, a citizen in Nanjing (Capital city of Jiangshu Province) sued the Minsheng Bank in the Nangjing Xuanwu District Court in 2012.  The Court held that the bank’s conducts constitute the tort of privacy invasion.  Mr Guo was a former Credit Card users of the Minsheng Bank Nanjing Branch.  But, in May 2011, he surprisingly discovered that, although he got his Minsheng credit card cancelled, without his authorization, the Minsheng Bank, has twice investigated his personal credit information from the Nanjing Branch of the People's Bank of China (his current bank) under the names of credit card approval and loan approval in 2010 and in 2011 respectively. 2.1. Recent Development of the Chinese Civil Cases 2.1.2. Guo vs. Minsheng Bank [2012]
  • 21.  Case: Tort of Privacy Invasion by Bank  The explanation given by the Minsheng Bank Nanjing Branch was that the bank is conducting “2nd Round customer development”.  Mr. Guo did not accept this explanation, and filed a Complaint to the Management Division of the People’s Bank Nanjing Branch.  In December 2011, after investigation, the People’s Bank Nanjing Branch found that Minsheng bank indeed inspected the credit record of Mr. Guo without his authorization.  According to the Interim Measures for the Administration of the Basic Data of Individual Credit Information 2005 (issued by the People’s Bank of China),  It imposed 20,000 CNY (3,278 USD) monetary penalty to Minsheng Bank. 2.1. Recent Development of the Chinese Civil Cases 2.1.2. Guo vs. Minsheng Bank [2012]
  • 22.  Case: Tort of Privacy Invasion by Bank  Mr. Guo believed that the conducts of the Minshen Bank infringed his privacy right, and initiated a civil litigation against Minshen Bank in the Nanjing Xuanwu District Court, and asked the bank to make a written apology on Newspapers.  In March 2012, the Xuanwu district court made a decision in favour of Mr. Guo, and requested the Minsheng Bank Nanjing Branch to make a written apology to Guo. 2.1. Recent Development of the Chinese Civil Cases 2.1.2. Guo vs. Minsheng Bank [2012]
  • 23.  Hints from this Case: Tort of Privacy Invasion by Bank  Enforcement Agencies  The People’s Bank Nanjing Branch  Nanjing Xuanwu District Court  Relevant Laws and regulations:  Civil Law  Civil Tort of Liability Law  Interim Measures for the Administration of the Basic Data of Individual Credit Information 2005 (issued by the People’s Bank of China) 2.1. Recent Development of the Chinese Civil Cases 2.1.2. Guo vs. Minsheng Bank [2012]
  • 24.  Criminal Law (7th Amendment 2009)  Crime of selling Personal Information of Citizens  Crime of illegally providing Personal Information of Citizens  Crime of illegally obtaining Personal Information of Citizens  Based on the information provided by the Public Prosecutate of Beijing Haidian District,  In 2010, they handled 31 cases (41 people involved), which were related to a breach of the Criminal Law for illegally obtaining to Personal Information of Citizens. 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics
  • 25.  VII. An Article is inserted after Article 253 of the Criminal Law as Article 253 (A):  “Where any staff member of a state organ or an entity in such a field as finance, telecommunications, transportation, education or medical treatment, in violation of the state provisions, sells or illegally provides personal information on citizens, which is obtained during the organ’s or entity’s performance of duties or provision of services, to others shall, if the circumstances are serious, be sentenced to fixed-term imprisonment not more than three years or criminal detention, and/or be fined.  Whoever illegally obtains the aforesaid information by stealing or any other means shall, if the circumstances are serious, be punished under the preceding paragraph.  Where any entity commits either of the crimes as described in the preceding two paragraphs, it shall be fined, and the direct liable person in charge and other directly liable persons shall be punished under the applicable paragraph.”
  • 26.  Key Features of this type of criminal cases:  1. Measures of Crime – Online trading  20 of 31 cases happened on the Internet – 64.5% of the total cases  Step 1: Buyers search online via Baidu or Google to find Sellers  Step 2: Join in special QQ Group  Step 3: communicate via QQ or Emails  Step 4: Bank transfer and Data Transfer  7 of 31 cases – face-to-to trading – 22.5% 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics
  • 27. 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics Measures of Crime Via the Internet Face-to-Face Others
  • 28.  Key Features of this type of criminal cases:  …  2. Purpose of Crimes – Expand their market & sell for money  26 of 41 people used the obtained personal information for marketing purposes – 63.4%  14 of 41 is for selling to others – 34.1%. 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics
  • 29. 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics Purposes of Crime Marketing purposes Re-selling purpose Others
  • 30.  Key Features of this type of criminal cases:  …  3. Targeted Information  Car owner information – 15 of 31 cases – 48.3%  Bank customer information – 10 of 31 cases – 32.2%  Company CEO – 5 of 31 cases – 16.5%  Phone records/ID card information/shopping records – 3 * 3 - 9.6% respectively  Customer information of Carrier company & new-born information – 2*2 – 6.4% respectively, et al…  In many cases, parties involved obtained multi-type information 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics
  • 31. 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics Targeted Information Car owner information Bank customer information
  • 32.  Key Features of this type of criminal cases:  …  4. High Risk Group – employees in marketing and insurance sectors  11 of 41 people - salesman – 26.8%  5. New High Risk Group: Company leaders & private detectors companies  Company leaders – 10 of 31 cases (13 of 41 people) – 32.2%  Mangers of private detectors companies – 4 of 31 cases (5/41) – 12.9% 2.2. Recent Development of the Chinese Criminal Cases 2.2.1. Overview & Statistics
  • 33.  Criminal Case against Individual  Criminal Judgments by the People’s Court of Shanghai Pudong New District  Case Number: (2013) Pu Criminal First 1087((2013)浦刑初字第1087号)  Prosecutor: People's Procuratorate of Shanghai Pudong New District  Defendant: Xu  On April 1, 2013, the Prosecutor initiated a criminal litigation against the Defendant on the ground that the Defendant breached the Criminal Law by illegally obtaining personal information of citizens.   On the same day, the Court filed the case and applied a summary procedure (simplified) to this case. A single judge was appointed and the case was concluded. 2.2. Recent Development of the Chinese Criminal Cases 2.2.2. China vs. Xu [2013]
  • 34.  The Prosecutor claimed that:  On April 25, 2012, the Defendant Xu spent 500 Yuan (around 80 USD), and purchased more than one million pieces of Customer Order Information of the “No.1 Store” site - personal information of citizens – from Zhang (handled separately) via the Internet.  On November 23, 2013, the Defendant Xu was arrested and confessed all above facts.  The Defendant Xu has indicated no objection to the facts that the Prosecutor claimed above in the court proceeding. 2.2. Recent Development of the Chinese Criminal Cases 2.2.2. China vs. Xu [2013]
  • 35.  The Court also took into account the evidences, such as:  - Testimonies made by Witness Wang and Witness Zhang  - QQ Screenshots,  - Chat records  - Alipay transaction records (Chinese PayPal)  - the list of seized items,  - and other evidences.  ‘The Court found that the Defendant Xu illegally obtained personal information of citizens, and the circumstances are serious. As such, his conducts constituted a breach of the Criminal Law.’ 2.2. Recent Development of the Chinese Criminal Cases 2.2.2. China vs. Xu [2013]
  • 36.  ‘The Court upheld the claims made by the Prosecutor.  By virtue of Article 253 (1)(2), Article 67(3), Article 72, Article 73(2)(3) and Article 53 of the Criminal Law, the Court made a judgment as follows:  Defendant Xu beached the provision of illegally obtaining to personal information of citizens, and  was sentenced to six months imprisonment, suspended for one year (probation) and  a monetary penalty of one thousand Yuan (around 163 USD) applied.’ 2.2. Recent Development of the Chinese Criminal Cases 2.2.2. China vs. Xu [2013]
  • 37.  上海市浦东新区人民法院 刑事判决 (2013)浦刑初字第1087号 被告人徐某,因本案于2012年11月23日被刑事拘留,同年12月21日被逮捕,2013年1月29日被上海市公安局浦东 分局取保候审,同年3月22日被上海市浦东新区人民检察院取保候审。 辩护人赵振华,上海市世通律师事务所 律师。 上海市浦东新区人民检察院以沪浦检刑诉〔2013〕969号起诉书指控被告人徐某犯非法获取公民个人信 息罪,于2013年4月1日向本院提起公诉。本院于同日立案并依法适用简易程序,实行独任审判,公开开庭审理了本 案。上海市浦东新区人民检察院指派代理检察员席娜出庭支持公诉,被告人徐某及其辩护人赵振华到庭参加诉讼。 现已审理终结。 上海市浦东新区人民检察院指控,2012年4月25日,被告人徐某在互联网上从张某某(另案处 理)处,以人民币500元的价格购得一号店网站100余万条(以收货人姓名为关键项去除重复处理后共计28万余条) 订单信息数据的公民个人信息。 2013年11月23日,被告人徐某被公安机关抓获,到案后如实供述了上述犯罪事 实。 上述事实,被告人徐某在开庭审理过程中亦无异议,并有经庭审质证属实的证人王某某、张某某的证 言,QQ截屏图片、聊天记录、支付宝交易记录,扣押物品清单,公安机关出具的案发经过及工作情况,被告人徐 某的户籍资料等证据证实,足以认定。 本院认为,被告人徐某非法获取公民个人信息,情节严重,其行为已 构成非法获取公民个人信息罪。公诉机关指控的事实及罪名成立,予以支持。被告人徐某到案后能如实供述并自愿 认罪,系坦白,依法从轻处罚。依照《中华人民共和国刑法》第二百五十三条之一第一、二款、第六十七条第三 款、第七十二条、第七十三条第二、三款、第五十三条之规定,判决如下: 被告人徐某犯非法获取公民个人 信息罪,判处有期徒刑六个月,缓刑一年,罚金人民币一千元。 (缓刑考验期限,自判决确定之日起计算; 罚金自判决生效后一个月内缴纳。) 被告人徐某回到社区后,应当遵守法律、法规,服从监督、管理,接受 教育,参加公益劳动,做一名有益于社会的公民。 如不服本判决,可在接到判决书的第二日起十日内,通过 本院或者直接向上海市第一中级人民法院提出上诉。书面上诉的,应当提交上诉状正本一份,副本二份。 代理审判员 师坤鹏  二〇一三年四月十八日  书记员 陆玮
  • 38.  Criminal Case against Company  Criminal Judgments by the People’s Court of Shanghai Pudong New District  Case Number: (2013) Pu Criminal First 864((2013)浦刑初字第864号)  Prosecutor: People's Procuratorate of Shanghai XX District  Defendants: Shanghai XX Information Technology Company (referred to XX company); Legal Representative: Bai XX.  On March 13, 2013, the Prosecutor initiated a criminal litigation against the Defendant on the ground that the Defendant breached the Criminal Law by illegally obtaining personal information of citizens.   The Court filed the case and applied a (simplified) summary procedure to this case. A single judge was appointed and the case was concluded. 2.2. Recent Development of the Chinese Criminal Cases 2.2.3. China vs. Shanghai XX Information Technology Company [2013]
  • 39.  The Prosecutor claimed that:  In July 2012, in order to expand the Company’s market, the Defendant Bai authorized Zuo (handled separately), the Manger of the Marketing Division of the Company, to purchase more than one million pieces of Customer Order Information - personal information of citizens – from Liu (handled separately) at the price of 900 Yuan (around 146 USD) via the Internet.  On February 21, 2013, the Defendant Bai went to the Public Security authority and make a voluntary confession.  The Defendants, XX Company and Bai, have indicated no objection to the facts that Prosecutor claimed above in the Court proceeding.  2.2. Recent Development of the Chinese Criminal Cases 2.2.3. China vs. Shanghai XX IT Company [2013]
  • 40.  The Court has also taken into account the evidences, such as:  - Alipay transaction screenshot (Chinese PayPal)  - Relevant invoices  - Testimony by Witness Cui  - Testimonies by related parties Zuo and Liu  the list of seized items,  - and other evidences. 2.2. Recent Development of the Chinese Criminal Cases 2.2.3. China vs. Shanghai XX IT Company [2013]
  • 41.  ‘The Court found that the Defendants, XX Company and Bai, illegally obtained personal information of citizens, and the circumstances were serious.  The conducts of Bai, who was directly in charge of personnel of the Company, has constituted a breach of the Criminal Law.  Given that the XX Compand and Bai voluntarily confessed to the Public Security Authority and pleaded guilty in the Court, by virtues of relevant laws, the Court decided to apply a lighter punishment.’ 2.2. Recent Development of the Chinese Criminal Cases 2.2.3. China vs. Shanghai XX IT Company [2013]
  • 42.  By virtue of Article 253 (1), Article 67(1), Article 72(1)(3), Article 73(2)(3) and Article 53 of the Criminal Law, the Court made a judgment as follows:  1. Defendant XX Company beached the provision of illegally obtaining to personal information of citizens, and needs to pay a monetary penalty of 30,000 Yuan (around 5,000 USD).  2. Defendant BAI beached the provision of illegally obtaining personal information of citizens, and was sentenced to six months imprisonment, suspended for one year and a monetary penalty of 10,000 Yuan (around 1,630 USD).   Judge Ling Hong  March 21, 2013 2.2. Recent Development of the Chinese Criminal Cases 2.2.3. China vs. Shanghai XX IT Company [2013]
  • 43.  VII. An Article is inserted after Article 253 of the Criminal Law as Article 253 (A):  “Where any staff member of a state organ or an entity in such a field as finance, telecommunications, transportation, education or medical treatment, in violation of the state provisions, sells or illegally provides personal information on citizens, which is obtained during the organ’s or entity’s performance of duties or provision of services, to others shall, if the circumstances are serious, be sentenced to fixed-term imprisonment not more than three years or criminal detention, and/or be fined.  Whoever illegally obtains the aforesaid information by stealing or any other means shall, if the circumstances are serious, be punished under the preceding paragraph.  Where any entity commits either of the crimes as described in the preceding two paragraphs, it shall be fined, and the direct liable person in charge and other directly liable persons shall be punished under the applicable paragraph.”
  • 44.  Progress:  The new amendment started to be well enforced.  Uncertainty:  Lack of a clear definition of “personal information”  The meaning of “state provisions”  The meaning of “if the circumstances are serious”/ “severe consequence”  Next, BACK to the issues at the national level… 2.2. Recent Development of the Chinese Criminal Cases 2.2.4. Remarks: Progress vs. Uncertainty
  • 45.  3.1. General Challenges of protecting personal data in China  3.1.1. Hints from 2013 BSA Global Cloud Computing Scorecard  Ranking improved  Lack of laws and industrial rules  3.1.2. Challenges from Legal Tradition  3.2. Suggestions for future reform  3.2.1. Three models: US, EU and Australia  3.2.2. Enforcement Agencies Part III: Challenges & Recommendations
  • 46.  The BSA survey examined the policy environment for CC in several countries around the world.  The BSA survey examined 24 countries, which together account for 80 percent of the global ICT market.  The BSA Scorecard Measuring CC Readiness 3.1. General Challenges 3.1.1. Hints from 2013 BSA Global Cloud Computing Scorecard
  • 47.  The BSA Scorecard Measuring CC Readiness  It examines major laws and regulations relevant to CC in seven policy categories as well as each country’s ICT- related infrastructure and broadband deployment.  1. Data Privacy  2. Security  3. Cybercrime  4. IPRs  5. Support for Industry-Led Standards & International Harmonization of Rules  6. Promoting Free Trade  7. ICT Readiness, Broadband Deployment. 2013 BSA Global Cloud Computing Scorecard
  • 48.  China’s Ranking  +2 (in comparison with 2011)  19th of 24 3.1. General Challenges 3.1.1. Hints form 2013 BSA Global CC Scorecard
  • 49.  Screen Shot 2013-07-05 at 1.08.10 PM
  • 50.  As mentioned above….  Progress:  Recent development – all about protecting personal information on the Internet (rather than general protection measures)  Further improvements:  Lack of the Personal Information Protection Law at the national level  Lack of unified privacy enforcement authority at the national level  Challenges for the quick growth of Innovation Industry 3.1. General Challenges 3.1.1. Hints form 2013 BSA Global CC Scorecard
  • 51.  China’s overall regulatory approach may presents challenges to the development of innovation industry, such as cloud computing.  1. China’s preference for top-down mandatory regulation is often at odds with the type of public-private collaboration and industry self- regulation so critical to growing new technologies.  2. data protection and data sovereignty fears, as well as cybersecurity concerns, are creating barriers for deployment of leading global technologies.  3. complicating the policy environment is China’s drive to promote domestic industry, as well as preserve its existing market access controls.  (USITO, 2012) 3.1. General Challenges 3.1.2. Challenges from Legal Tradition
  • 52.  EU Model: Centralized  US Model: Decentralized  Australia Model: Centralized law and principles + detailed industrial guidelines.  Recommendation 1 – May consider drawing on lessons from the experiences of Australian Model to harmonize the existing laws on personal data protection 3.2. Suggestions for future laws and policies reform 3.2.1. Three models: US, EU and Australia
  • 53.  Recommendation 2:  May consider leaving privacy cases to Intellectual Property Courts (IP, Antitrust, Personal Information Protection)  Recommendation 3:  Courts may play a more active role in explaining how existing data protection laws could be applied  Chinese Supreme Court may issue a Guideline on this issue – more judicial interpretations 3.2. Suggestions for future laws and policies reform 3.2.2. Enforcement Agencies
  • 54.  “Based on the global opportunity that Cloud Computing presents, each country’s policy changes will alter not just that country’s environment but the global market for CC as a whole.”  (BSA, 2013)  …. apply this idea broadly…. Conclusion and Remarks
  • 55.  “Based on the global opportunity that Information Economy presents, each country’s policy changes will alter not just that country’s environment but the global Information Economy as a whole.” Conclusion and Remarks
  • 56.  Prof. Graham Greenleaf, Faculty of Law, UNSW  Mr. Yun Xuan, Director of IP Policy and Enforcement Division, Microsoft (China) Co., Ltd  Ms. Sophia Wang, Director & Chief Representative, China, BSA, The Software Alliance Acknowledgment

Editor's Notes

  1. http://www.bryancave.com/files/Publication/9211acb7-57b3-4a59-8c24-9036bd005bad/Presentation/PublicationAttachment/cfbdbe93-f867-4810-9445-9270e5a32ffb/IRB506.pdf
  2. http://www.bryancave.com/files/Publication/9211acb7-57b3-4a59-8c24-9036bd005bad/Presentation/PublicationAttachment/cfbdbe93-f867-4810-9445-9270e5a32ffb/IRB506.pdf
  3. få= íÜÉçêóI= íÜÉëÉ= îçäìåí~êó= ÖìáÇÉJ äáåÉë=~êÉ=åçí=~ë=áãéçêí~åí=~ë=íÜÉ=íïç êÉÖìä~íçêó= áåëíêìãÉåíë= çÑ= OMNNLNO ÅçîÉêáåÖ= é~êí= çÑ= íÜÉ= ë~ãÉ= íÉêêáíçêó Eéêáã~êáäó= fåíÉêåÉí= ffpmëFI= íÜÉ
  4. få= íÜÉçêóI= íÜÉëÉ= îçäìåí~êó= ÖìáÇÉJ äáåÉë=~êÉ=åçí=~ë=áãéçêí~åí=~ë=íÜÉ=íïç êÉÖìä~íçêó= áåëíêìãÉåíë= çÑ= OMNNLNO ÅçîÉêáåÖ= é~êí= çÑ= íÜÉ= ë~ãÉ= íÉêêáíçêó Eéêáã~êáäó= fåíÉêåÉí= ffpmëFI= íÜÉ
  5. http://www.huntonfiles.com/files/webupload/PrivacyLaw_Personal_Information_Protection_in_China.pdf http://www.huntonfiles.com/files/webupload/PrivacyLaw_Personal_Information_Protection_in_China_update.pdf
  6. Source: http://www.njxwfy.gov.cn/www/xwfy/fydt6_mb_a3912112336389.htm  
  7. Source: http://www.njxwfy.gov.cn/www/xwfy/fydt6_mb_a3912112336389.htm  
  8. Source: http://www.njxwfy.gov.cn/www/xwfy/fydt6_mb_a3912112336389.htm  
  9. Car owner information – 15 of 31 cases – 48.3% Bank customer information – 10 of 31 cases – 32.2% Company CEO – 5 of 31 cases – 16.5% Phone records/ID card information/shopping records – 3 * 3 - 9.6% respectively Customer information of Carrier company & new-born information – 2*2 – 6.4% respectively Et al…
  10. Car owner information – 15 of 31 cases – 48.3% Bank customer information – 10 of 31 cases – 32.2% Company CEO – 5 of 31 cases – 16.5% Phone records/ID card information/shopping records – 3 * 3 - 9.6% respectively Customer information of Carrier company & new-born information – 2*2 – 6.4% respectively Et al…
  11. Car owner information – 15 of 31 cases – 48.3% Bank customer information – 10 of 31 cases – 32.2% Company CEO – 5 of 31 cases – 16.5% Phone records/ID card information/shopping records – 3 * 3 - 9.6% respectively Customer information of Carrier company & new-born information – 2*2 – 6.4% respectively Et al…
  12. ‘The Court hold that the Defendant, XX Company and Bai, illegally obtained personal information of citizens. The conducts of Bai, who was directly in charge of personnel, had constituted the crime of illegal access to personal information of citizens.’
  13. ‘The Court hold that the Defendant, XX Company and Bai, illegally obtained personal information of citizens. The conducts of Bai, who was directly in charge of personnel, had constituted the crime of illegal access to personal information of citizens.’
  14. http://www.huntonfiles.com/files/webupload/PrivacyLaw_Personal_Information_Protection_in_China.pdf http://www.huntonfiles.com/files/webupload/PrivacyLaw_Personal_Information_Protection_in_China_update.pdf