Promulgated by: Supreme People’s Court; Supreme People’s Procuratorate.
Document No.: Fa Shi [2017] No. 10.
Adopted at the 1712th Meeting of the Judicial Committee of the Supreme People’s Court on March 20, 2017 and at the 63rd Meeting of the Twelfth Procuratorial Committee of the Supreme People’s Procuratorate on April 26, 2017. Effective June 1, 2017.
In order to punish, in accordance with the law, criminal activities that infringe upon citizens’ personal information, and to protect the security of citizens’ personal information and their lawful rights and interests, the following interpretation on several issues concerning the application of law in handling such criminal cases is hereby given pursuant to the relevant provisions of the Criminal Law of the People’s Republic of China and the Criminal Procedure Law of the People’s Republic of China:
Article 1. “Citizens’ personal information” as prescribed in Article 253a of the Criminal Law refers to various kinds of information recorded electronically or by other means that can, alone or in combination with other information, identify a specific natural person or reflect the activities of a specific natural person, including a person’s name, identification-document number, communication and contact information, address, account passwords, property status, whereabouts and tracks, and the like.
Article 2. Violating the provisions of laws, administrative regulations or departmental rules concerning the protection of citizens’ personal information shall be determined as “violating the relevant provisions of the State” as prescribed in Article 253a of the Criminal Law.
Article 3. Providing citizens’ personal information to a specific person, as well as publishing citizens’ personal information through an information network or other channels, shall be determined as “providing citizens’ personal information” as prescribed in Article 253a of the Criminal Law.
Providing to others, without the consent of the person from whom the information was collected, citizens’ personal information that was lawfully collected falls under “providing citizens’ personal information” as prescribed in Article 253a of the Criminal Law, except where the information has been processed such that a specific individual cannot be identified and the information cannot be restored.
Article 4. Obtaining citizens’ personal information by purchase, receipt, exchange or other means in violation of the relevant provisions of the State, or collecting citizens’ personal information in the course of performing duties or providing services, falls under “obtaining citizens’ personal information by other illegal methods” as prescribed in the third paragraph of Article 253a of the Criminal Law.
Article 5. Where citizens’ personal information is illegally obtained, sold or provided under any of the following circumstances, it shall be determined as “serious circumstances” as prescribed in Article 253a of the Criminal Law:
(I) selling or providing whereabouts and tracks information that is used by another person to commit a crime;
(II) selling or providing information to another person while knowing or having reason to know that the person uses citizens’ personal information to commit a crime;
(III) illegally obtaining, selling or providing 50 or more items of whereabouts and tracks information, communication content, credit-reporting information, or property information;
(IV) illegally obtaining, selling or providing 500 or more items of accommodation information, communication records, health and physiological information, transaction information, or other citizens’ personal information that may affect personal or property safety;
(V) illegally obtaining, selling or providing 5,000 or more items of citizens’ personal information other than those prescribed in items (III) and (IV);
(VI) where the quantity does not reach the standards prescribed in items (III) through (V), but the aggregate reaches the relevant quantity standard when calculated in the corresponding proportion;
(VII) where the illegal gains amount to RMB 5,000 or more;
(VIII) selling or providing to others citizens’ personal information obtained in the course of performing duties or providing services, where the quantity or amount reaches more than half of the standards prescribed in items (III) through (VII);
(IX) where the person has previously been subject to criminal punishment for infringing upon citizens’ personal information, or has been subject to administrative punishment within two years, and again illegally obtains, sells or provides citizens’ personal information; or
(X) other circumstances that are serious.
Where any of the acts prescribed in the preceding paragraph is committed under any of the following circumstances, it shall be determined as “particularly serious circumstances” as prescribed in the first paragraph of Article 253a of the Criminal Law:
(I) causing serious consequences such as the death, serious injury, mental disorder, or kidnapping of the victim;
(II) causing major economic losses or an adverse social impact;
(III) where the quantity or amount reaches ten or more times the standards prescribed in items (III) through (VIII) of the preceding paragraph; or
(IV) other circumstances that are particularly serious.
Article 6. Where, for the purpose of lawful business operations, citizens’ personal information other than those prescribed in items (III) and (IV) of the first paragraph of Article 5 of this Interpretation is illegally purchased or received under any of the following circumstances, it shall be determined as “serious circumstances” as prescribed in Article 253a of the Criminal Law:
(I) gaining a profit of RMB 50,000 or more by using illegally purchased or received citizens’ personal information;
(II) where the person has previously been subject to criminal punishment for infringing upon citizens’ personal information, or has been subject to administrative punishment within two years, and again illegally purchases or receives citizens’ personal information; or
(III) other circumstances that are serious.
Where any of the acts prescribed in the preceding paragraph is committed and the purchased or received citizens’ personal information is illegally sold or provided, the standards for conviction and sentencing prescribed in Article 5 of this Interpretation shall apply.
Article 7. Where an entity commits the crime prescribed in Article 253a of the Criminal Law, the persons directly in charge and other directly responsible persons shall be convicted and punished in accordance with the standards for conviction and sentencing for the corresponding natural-person crime prescribed in this Interpretation, and a fine shall be imposed on the entity.
Article 8. Where a website or communication group is established for the purpose of carrying out illegal and criminal activities of illegally obtaining, selling or providing citizens’ personal information, and the circumstances are serious, the person shall be convicted and punished for the crime of illegally using an information network in accordance with the provisions of Article 287a of the Criminal Law; where the act also constitutes the crime of infringing upon citizens’ personal information, the person shall be convicted and punished for the crime of infringing upon citizens’ personal information.
Article 9. Where a network service provider refuses to perform the information-network security management obligations prescribed by laws and administrative regulations, and after being ordered by the regulatory authority to take corrective measures still refuses to make corrections, thereby causing the leakage of users’ citizens’ personal information and serious consequences, the provider shall be convicted and punished for the crime of refusing to perform information-network security management obligations in accordance with the provisions of Article 286a of the Criminal Law.
Article 10. Where a person commits the crime of infringing upon citizens’ personal information, the circumstances do not fall under “particularly serious circumstances”, and the offender is a first-time offender who has returned all illegal gains and has shown genuine remorse, the case may be determined to be a minor circumstance, and the offender may not be prosecuted or may be exempted from criminal punishment; where it is genuinely necessary to impose a penalty, a lenient punishment shall be imposed.
Article 11. Where citizens’ personal information is illegally obtained and subsequently sold or provided, the number of items of citizens’ personal information shall not be counted repeatedly.
Where the same citizens’ personal information is separately sold or provided to different entities or individuals, the number of items of citizens’ personal information shall be calculated cumulatively.
The number of items of citizens’ personal information obtained in batches shall be determined directly on the basis of the quantity seized, except where there is evidence proving that the information is untrue or duplicated.
Article 12. With respect to the crime of infringing upon citizens’ personal information, a fine shall be imposed in accordance with the law, taking into comprehensive consideration the degree of harm of the crime, the amount of illegal gains, the defendant’s prior criminal record, and the attitude of confession and remorse. The amount of the fine shall generally be not less than one time but not more than five times the illegal gains.
Article 13. This Interpretation shall come into force as of June 1, 2017.