SPC and SPP Interpretation on Handling Criminal Cases of Violations of Citizens' Private Information

Title: Supreme People's Court and Supreme People's Procuratorate Interpretation on Several Issues Regarding the Applicable Law in Criminal Cases of Citizens' Personal Information
Promulgating Entities:The Supreme People's Court, The Supreme People's Procuratorate
Reference number: 
Promulgation Date: 2017-5-8
Expiration date: 
Source of text: http://news.jcrb.com/jszx/201705/t20170509_1750990.html

The "Supreme People's Court and Supreme People's Procuratorate Interpretation on Several Issues Regarding the Applicable Law in Criminal Cases of Violations of Citizens' Personal Information" was passed on March 20, 2017 by the 1712th meeting of the Adjudication Committee of the Supreme People's Court, and on April 26, 2017 by the 63rd meeting of the 12th Prosecutorial Committee of the Supreme People 's Procuratorate, to take effect on June 1, 2017.

The Supreme People's Court, The Supreme People's Procuratorate

May 8, 2017

The Supreme People's Court and Supreme People's Procuratorate Interpretation on Several Issues Regarding the Applicable Law in Criminal Cases of Violations of Citizens' Personal Information

(Passed on March 20, 2017 by the 1712th meeting of the Adjudication Committee of the Supreme People's Court, and on April 26, 2017 by the 63rd meeting of the 12th Prosecutorial Committee of the Supreme People's Procuratorate, to take effect on June 1, 2017)

The following Interpretation on Several Issues Regarding the Applicable Law in Criminal Cases of Violations of Citizens' Personal Information is made on the basis of the relevant provisions of the "People's Republic of China Criminal Law"; and the "People's Republic of China Criminal Procedure Law" so as to punish such crimes:

Article 1: “Citizens' personal information” as provided for in article 253-1 of the Criminal Law refers to all kinds of information, recorded electronically or otherwise, that, either alone or together with other information, can identify certain natural persons' identities or reflect certain natural persons' activities, including full names, identification numbers, communications and contact information, addresses, account passwords, asset status, whereabouts, and so forth.

Article 2: Those violating laws, administrative regulations, or departmental rules' provisions on protecting citizens' personal information shall be found to have 'violated relevant state provisions' as provided for in Criminal Law article 253-1.

Article 3: Those providing citizens' personal information to specific individuals, as well as those publishing citizens' personal information through information networks or other routes, shall be found to have 'provided citizens' personal information' as provided for in Criminal Law article 253-1.

Those providing citizens' personal information that was lawfully acuired to others, without obtaining the consent of the person whose information is gathered, is "providing citizens' personal information' as provided for in Criminal Law article 253-1, except where it has been processed so that there is no way to identify specific individuals and it cannot be restored.

Article 4: Those violating relevant national provisions by purchasing, accepting, or exchanging or obtaining citizens' personal information through other means, or those gathering citizens' personal information in the course of performing duties or providing services, are 'using other illegal methods to acquire citizens' personal information' as provided for in article 253-1 paragraph 2.

Article 5: In any of the following situations, illegally acquiring, selling, or providing citizens' personal information shall be found to be 'serious circumstances' as provided for in Criminal Law article 253-1：

(1) Selling or providing tracking information used by others in the commission of a crime;

(2) Selling or providing citizens' personal information to others that one knows, or should know, will be used to perpetrate crimes;

(3) Illegally acquiring, selling, or providing 50 or more items of tracking information, communications content, credit rating information, or information on assets;

(4) Illegally acquiring, selling, or providing 500 or more items of housing information, communications records, physical health information, transaction information, and other such citizens' personal information that might impact security in one's person or property；

(5) Illegally acquiring, selling, or providing 5,000 or more items of citizens' personal information other than that provided for in items (3) and (4);

(6) Where the amounts do not reach the standards provided in items 3-5, but if taken together according to the relevant rations, the relevant quantity standards are met.

(7) unlawful gains are 5,000 RMB or more;

(8) Selling or providing others with citizens' personal data that was obtained in the course of performing professional duties, and reaching half or more of the volume or quantity standard provided for in items (3)-(7).

(9) Having previously received a criminal punishment for violating citizens' personal information or having received an administrative punishment within the last 2 years, and again illegally acquiring, selling, or providing citizens' personal information.

（10）Other situations of serious circumstances.

In any of the following situations, carrying out the conduct provided for in the preceding paragraph shall be found to be 'especially serious circumstances' as provided for in Criminal Law article 253-1, paragraph 1:

(1) Causing serious consequences to the victim such as death, serious injury, psychiatric abnormalities, or being kidnapped;

(2) Causing major economic losses or vile social impact;

(3) The quantity or amount reaches 10 times or more the standards provided for items (3)-(8) in the preceding paragraph;

(4) other situations where circumstances are especially serious.

Article 6: In any of the following situations, illegally acquiring, selling, or providing citizens' personal information shall be found to be 'serious circumstances' as provided for in Criminal Law article 253-1:

(1) using illegally purchased or accepted citizens' personal information to earn 50,000 RMB or more.;

(2) Having previously received a criminal punishment for violating citizens' personal information or having received an administrative punishment within the last 2 years, and again illegally purchasing or accepting citizens' personal information.

（3） Other situations of serious circumstances.

Where any of the acts provided for in the preceding paragraph are acquired and the citizens' personal information that was purchased or acquired is then illegally sold or provided, the standards for conviction and sentencing provided in article 5 of this Interpretation are applied.

Article 7: Where units commit the crimes provided for in Criminal Law article 253-1, follow the relevant standards of this interpretation's for conviction and punishment of natural persons, to convict and punish the directly responsible managers and other directly responsible personnel, and impose fines on the unit.

Article 8: Where a website or communications group is set up for the illegal criminal activities of unlawful acquisition, sale, or provision of citizens' personal information, and the circumstances are serious, it shall be convicted and punished as the crime of illegally use of information networks in accordance with the provisions of Criminal Law article 287-1; and where it simultaneously constitutes a violation of citizens' personal information, convict and sentence in accordance with the crime of violating citizens' personal information.

Article 9: Where network service providers refuse to perform information network security management obligations provided for in laws and administrative regulations, and refuse to make corrections after being ordered to take corrective measures by the oversight and regulatory departments, leading to a leak of user citizens' personal information and causing serious consequences, it shall be be convicted and punished in accordance with Criminal Law article 286-1 as the crime of refusing to perform information network security management obligations.

Article 10: Where commission of the crime of violating citizens' personal information is not 'especially serious circumstances', the offender is a first time offender, restitution was made in full, and they truly express remorse about the crime, the circumstances may be found to be minor, and it may be not prosecuted or have criminal punishment waived; where judgment and punishment is truly necessary, it shall be lenient.

Article 11: Where after unlawfully acquiring citizens' personal information, it is also sold or provided, the number of items of citizens' personal information is not double counted.

Where the same citizen personal information is separately sold or provided to different units or individuals, the number of items of citizens' personal information is to be double counted.

The number of items in batches of citizens' personal information is directly determined on the basis of the quantity uncovered, except where there is evidence showing that information is untrue or redundant.

Article 12: Fines for the crime of violating citizens' personal information shall be lawfully imposed based on comprehensive consideration of the degree of harm, the amount of unlawful gains, and the defendants' criminal record and attitude of repentence and remorse, and so forth. Fines are usually between 1 and 5 times the unlawful gains.

Article 13: This Interpretation takes effect on June 1, 2017.