Skip to content
DCC · DATA COMPLIANCE CHINA China data law, for overseas counsel.
§ LAW · SPP PI CRIME REPLY

Reply of the Research Office of the Supreme People's Procuratorate on the Solicitation of Opinions Concerning the Application of Law in the Crime of Infringing upon Citizens' Personal Information.

最高人民检察院法律政策研究室关于侵犯公民个人信息罪有关法律适用问题征求意见的复函

Promulgated by: Research Office of the Supreme People’s Procuratorate.
Document No.: Fa Yan [2018] No. 11.
Issued in 2018. Effective in 2018.


To the Research Office of the Supreme People’s Procuratorate:

Your Office’s Letter Soliciting Opinions on Issues Concerning the Application of Law in the Crime of Infringing upon Citizens’ Personal Information (Gao Jian Yan Han Zi [2018] No. 1) has been received. Upon study, we agree in principle that “citizens’ personal information” as prescribed in Article 253a of the Criminal Law includes not only the personal information of Chinese citizens, but also the personal information of foreign citizens and other stateless persons. The principal considerations are as follows:

(1) In terms of the statutory wording, Article 253a of the Criminal Law provides for “citizens’ personal information” and does not limit it to “the personal information of citizens of the People’s Republic of China”; therefore, “citizens’ personal information” here should not be restricted to the personal information of Chinese citizens.

(2) In terms of legislative intent, the information of foreigners and stateless persons should receive equal protection under the Criminal Law in the same manner as the information of Chinese citizens.

(3) In terms of judicial practice, excluding the personal information of foreign nationals and stateless persons from the protection of the Criminal Law would let crimes go unpunished. In particular, where a case of infringing upon citizens’ personal information involves both the personal information of Chinese citizens and that of foreign citizens and stateless persons, punishing only the portion involving the personal information of Chinese citizens would be neither reasonable nor workable.

§ RELATED LAWS

See also.

§ COMMENTARY

Briefs on this law.

2 briefs reference this law.

  • § 01 · SPP

    Five Years of PIPL: The Supreme People's Procuratorate's Eight Typical Cases on Personal Information

    On November 2, 2026, the day after the fifth anniversary of the Personal Information Protection Law taking effect, the Supreme People's Procuratorate (SPP) issued eight typical cases on protecting citizens' personal information. Seven are prosecutions for the crime of infringing upon citizens' personal information (Criminal Law Article 253a); the eighth is a civil public-interest suit. DCC translates the SPP's release in full and maps the eight cases for counsel. Four points stand out. Information that is already public is 'not a public resource': compiling rental listings and selling them abroad, beyond the purpose for which they were posted, is the crime (Case 5). A passenger's upcoming flight is 'whereabouts and tracks' information, the most tightly protected criminal category (Case 6). Three of the eight leaks ran through people with legitimate access: insiders at source units, an airline's outsourced call-center agent, and bribed HR staff (Cases 1, 6, 7). And procuratorates now attach public-interest damages to PI crimes, set by sensitivity, scale, public value and cross-border risk rather than by what the offender earned: RMB 4 million against one recruitment-data seller (Case 7) and RMB 1.5 million against two people who scraped 3.86 million cancer-hospital records and moved them overseas, when their proven profit was RMB 10,800 (Case 8). The full notice and all eight cases are on the DCC law page.

    spp · supreme-peoples-procuratorate · typical-cases
  • § 02 · ENFORCEMENT

    公安部网安局 Publishes 10 Typical Cases of Infringing Citizens' Personal Information — Insiders, Order Decryption, and Article 253a in Practice

    On 11 August 2026 the MPS Cyber Security Bureau (公安部网安局) published ten typical cases (典型案例) of the crime of infringing upon citizens' personal information, brought under the Clean Net special campaign (净网专项行动). Across the batch: 123 suspects, more than 9.6 million items of personal information, and roughly 23.6 million yuan in case value. The striking feature is not the volume but the access route — in at least half the cases the data came out through someone with legitimate access: an employee, a planted hire, a service vendor, a hotel partner, or a school and hospital staffer. This DCC brief translates all ten fact patterns, sets them against Criminal Law Article 253a and the 2017 PI Criminal Interpretation thresholds, and draws out what the batch signals for companies whose exposure runs through their own staff and vendors.

    enforcement · criminal-liability · mps
§ SUBSCRIBE

The Monday brief.

One short email every Monday. New briefs on Chinese data-compliance rules from the previous week, with the source law cited.

Opt-in only. Unsubscribe anytime by replying "unsubscribe" to any issue.

SUPPORT DCC

Keep the publication free to read. Suggested support is $19.99, or choose your own amount.

Support →