Issued by: Supreme People’s Procuratorate. Document No.: none given in the published text. Notice dated November 2, 2026; released the same day. Document type: Typical cases (典型案例) issued by notice, “for reference”. Not a judicial interpretation (司法解释) and not a guiding case (指导性案例).
DCC translation note. The Supreme People’s Procuratorate (SPP) released this batch to mark the fifth anniversary of the Personal Information Protection Law, which took effect on November 1, 2021. DCC translates the issuing notice and all eight cases in full from the text the SPP published on its official WeChat account. The SPP’s own release note, and DCC’s case-by-case reading for companies, are in the accompanying brief.
Two points of Chinese practice matter for reading these. First, weight. Typical cases are exemplars, issued “for reference” (供参考借鉴). They do not bind courts or procuratorates the way a judicial interpretation does, and they rank below the guiding cases (指导性案例) of the SPP and the Supreme People’s Court. What they show is how the prosecution service wants procuratorates to charge, prove and settle these cases. Second, the procuratorate’s view. Each case sets out the facts and outcome, then the procuratorate’s own steps (检察机关履职过程), then the “typical significance” (典型意义), which is the SPP’s statement of the rule or practice the case stands for. The criminal thresholds the cases apply come from Article 5 of the 2017 PI Criminal Interpretation. “Serious circumstances” start at, for example, 50 items of whereabouts and tracks information, 5,000 items of ordinary personal information, or RMB 5,000 in illegal gains. “Particularly serious circumstances” start at ten times those figures, so RMB 50,000 in gains is enough on its own.
Names are anonymized in the original. Where it gives a surname and withholds the rest with 某, DCC writes the surname and “X”, keeping any character the original shows: 王某 is “Wang X”, 许某玲 is “Xu X-ling”, 王某某 is “Wang XX”. Courts, procuratorates, dates and amounts are as published.
Notice of the Supreme People’s Procuratorate on Issuing the Typical Cases of Procuratorial Organs Protecting Citizens’ Personal Information in Accordance with Law
To the People’s Procuratorates of all provinces, autonomous regions and municipalities directly under the Central Government, the Military Procuratorate of the People’s Liberation Army, and the People’s Procuratorate of the Xinjiang Production and Construction Corps:
On the occasion of the fifth anniversary of the implementation of the Personal Information Protection Law of the People’s Republic of China, and in order to fully implement Xi Jinping Thought on the Rule of Law, punish crimes of infringing upon citizens’ personal information in accordance with law, strengthen the protection of citizens’ personal information, and safeguard social security and stability, the Supreme People’s Procuratorate has selected and compiled a batch of typical cases on protecting citizens’ personal information in accordance with law. They are hereby issued for your reference.
Supreme People’s Procuratorate November 2, 2026
Case 1
Wang X and 10 Others: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / overseas networks / punishing the whole chain / governance at the source
Basic Facts
Defendant Wang X, male, born 1997, unemployed.
Defendant Xu X-ling, female, born 1991, unemployed.
Defendant Lan X, male, born 1992, unemployed.
Defendant Yang X-cheng, male, born 1997, unemployed.
Details of the other 7 defendants are omitted.
In June 2024, defendants Wang X and Xu X-ling discovered that the personal information of Chinese citizens could be bought from overseas “social-engineering databases” (社工库) online. They rented premises, recruited “salespeople” and set up a “studio” to resell citizens’ personal information on the internet for profit. Wang X was responsible for dealing with upstream sellers, managing the “salespeople” and distributing the proceeds; Xu X-ling handled the settlement of funds; and the “salespeople” found downstream buyers through telephone marketing, online posts and similar means. Using overseas communication tools, the “studio” contacted defendant Lan X and others as its upstream supply channel. It built a criminal chain of “finding downstream buyers in China — obtaining personal information overseas — reselling it in China at a markup”, trading in citizens’ household-registration, property and whereabouts and tracks information, with a total amount involved of more than RMB 1.98 million. To evade investigation, the “studio” issued its “salespeople” dedicated work phones and social-media accounts, collected payments through online payment platforms, and paid its overseas upstream sellers in virtual currency. Defendant Yang X-cheng, a downstream buyer, bought citizens’ personal information from the gang over a long period and resold it a second time for profit.
On August 8, 2025, the People’s Procuratorate of Wucheng District, Jinhua City, Zhejiang Province, initiated a public prosecution against Wang X and the 10 others for the crime of infringing upon citizens’ personal information. All defendants voluntarily pleaded guilty and accepted punishment. On November 10 of the same year, the People’s Court of Wucheng District, Jinhua City, sentenced Wang X and the 10 others for the crime of infringing upon citizens’ personal information to fixed-term imprisonment ranging from three years and six months to eight months, with fines. The judgment has taken effect.
How the Procuratorate Performed Its Duties
(1) Substantive review of electronic data to establish the facts accurately in accordance with law. In this case the defendants communicated through overseas encrypted messaging tools, the information came from overseas “social-engineering databases”, and settlement was in virtual currency; the volume of information was large and hard to verify. In handling the case, the procuratorate reviewed the electronic data at every stage, including the source of the information, its circulation and the settlement of funds. It established the complete path along which the information flowed, and so determined the manner of the criminal conduct accurately. By sorting through the transaction records and other material in full and tracing the funds through every layer, it pinned down the flow of money, “game-currency top-up payments — collection through payment-platform accounts — payment of upstream sellers in virtual currency”, and determined the amount involved accurately.
(2) Stronger guidance of evidence collection and supervision of case filing, to punish the whole chain. The criminal chain in this case was long, and the overseas accounts were well hidden, which made it hard to identify the upstream and downstream participants. The procuratorate stepped up its guidance of evidence collection and gave targeted opinions and recommendations. On that basis the public security organ arrested, in turn, Lan X, an upstream seller of information, Yang X-cheng, a downstream intermediary buying information, and others. In handling the case, the procuratorate fully performed its function of legal supervision. It supervised the public security organ, in accordance with law, to open investigations into persons involved who had been missed. As a result everyone at every link was punished: upstream supply, intermediate reselling, downstream purchase and secondary resale. At the same time, the procuratorate gave equal weight to handling the case and to recovering the proceeds and losses, and recovered the illegal gains in accordance with law.
(3) Focusing on regulatory gaps to promote governance at the source, and explaining the law through the case. In response to gaps in information oversight found while handling the case, the procuratorate promptly informed the relevant source units of the information about how the case had been handled. It convened joint meetings and pushed for special inspections. Insiders who had leaked information were investigated and dealt with in accordance with law, so that the parties together built a firm defense at the source. Taking advantage of key moments for legal publicity, such as Constitution Day and National Cybersecurity Awareness Week, it gave talks on the law tailored to the features of the case, so that social governance and legal publicity advanced together.
Typical Significance
In recent years, crimes of infringing upon citizens’ personal information committed with the help of overseas online black and grey markets have occurred from time to time. The criminal methods are increasingly covert and very likely to give rise to derivative crimes. They not only seriously infringe citizens’ personal rights but have also become an important source of disorder online. In handling such cases, procuratorates should adhere to the holistic approach to national security, focus on the criminal chain of personal-information infringement, review the transaction links and the flow of funds in full, and determine the criminal facts and the amounts involved accurately in accordance with law. In the course of handling such cases, they should strengthen their guidance of evidence collection, carry out supervision of criminal case filing in accordance with law, and punish upstream and downstream crimes along the whole chain. For management gaps found while handling cases, they should push the source units of the information to improve their internal oversight, and strengthen legal publicity around the cases, so as to protect the security of citizens’ personal information in earnest.
Case 2
Zhou X-xu and 8 Others: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / “private detectives” / whereabouts and tracks information / social governance
Basic Facts
Defendant Zhou X-xu, male, born 1981, unemployed.
Defendant Yang X, male, born 1994, worker.
Defendant Zhou X-hong, male, born 1982, worker.
Details of the other 6 defendants are omitted.
In 2019, defendant Zhou X-xu noticed demand on the internet for “marriage investigations” and conceived the idea of selling citizens’ personal information for profit through a “private detective” business. To bring in business, Zhou X-xu registered a consulting company and recruited people to post short videos on short-video platforms, under the name “private detective”, advertising paid “marriage investigations” to draw traffic. After charging clients fees according to their needs, Zhou X-xu, online, illegally obtained the whereabouts and tracks, property, accommodation records and other information of the persons the clients named from defendant Yang X and 4 others, through overseas chat software. Offline, he arranged for defendant Zhou X-hong and others to install GPS trackers and to follow people closely and photograph them covertly, so as to obtain their whereabouts and tracks information. By the time the case came to light, Zhou X-xu had illegally obtained and sold more than 18,000 items of citizens’ personal information of various kinds by these methods, making a profit of more than RMB 160,000. It was further established that Zhou X-xu had used the illegally obtained personal information to commit a number of unlawful and criminal acts of extortion.
In September 2022, the victim Ye X received the gang’s delivery of her accommodation information, photographs of her family, and a business card printed with an advertisement for “private detective” services, and found a GPS tracker under the chassis of her family car. She reported it to the police. The public security organ decided to open a case and investigate, and the defendants were arrested one after another. On May 10, 2024, the People’s Procuratorate of Longnan City, Jiangxi Province, initiated a public prosecution against Zhou X-xu for the crimes of infringing upon citizens’ personal information and extortion, and against Yang X and 7 others for the crime of infringing upon citizens’ personal information. All defendants voluntarily pleaded guilty and accepted punishment. On August 13 of the same year, the People’s Court of Longnan City, combining the punishments for the crimes of infringing upon citizens’ personal information and extortion, sentenced Zhou X-xu to four years’ fixed-term imprisonment and a fine of RMB 200,000. It sentenced Yang X and the 7 others, for the crime of infringing upon citizens’ personal information, to fixed-term imprisonment ranging from three years to eight months, with fines. The judgment has taken effect.
How the Procuratorate Performed Its Duties
(1) Stronger guidance of evidence collection, to complete the body of evidence. For the online reselling of citizens’ personal information, the procuratorate guided the public security organ to extract the more than 18,000 items of illegally obtained personal information from Zhou X-xu’s computer, and to collect evidence in more than 20 cities, including Shanghai. This established accurately the quantity of personal information involved and the amount of illegal gains. For the offline following and covert photography, it guided the public security organ to fix evidence around the features of whereabouts and tracks information, which corroborated the defendants’ statements, the testimony of the clients concerned and other evidence, forming a complete chain of evidence. With the evidence firmed up both online and offline, it was established in accordance with law that Zhou X-xu and others had illegally obtained other people’s whereabouts and tracks information by installing GPS trackers and following and covertly photographing them at close range, seriously endangering citizens’ personal and property safety.
(2) Performing the duty of supervision to dig out related crimes. While handling the case, the procuratorate found that the personal information Zhou X-xu illegally obtained came from Yang X and 4 others. As the upstream sources of the information, these 5 were suspected of the crime of infringing upon citizens’ personal information, so the procuratorate recommended that the public security organ merge them into the investigation. At the same time, evidence in the file showed that Zhou X-xu had also used the illegally obtained personal information to commit unlawful and criminal extortion against a number of people, seriously infringing their personal and property safety, so the procuratorate recommended that the public security organ investigate and collect evidence on the related crimes. The public security organ adopted the procuratorate’s opinions and recommendations. After investigation, it transferred Zhou X-xu, suspected of the crimes of infringing upon citizens’ personal information and extortion, and Yang X and others, suspected of the crime of infringing upon citizens’ personal information, to the procuratorate for review and prosecution.
(3) Issuing procuratorial recommendations, and explaining the law through the case. Some online platforms still carried advertising that lured people into buying citizens’ personal information under the names “private detective” and “marriage investigation”. The Longnan City Procuratorate issued a procuratorial recommendation to the competent department concerned, prompting it to carry out a campaign to clean up illegal online information involving “private detectives”. Some members of the public did not understand that buying and selling citizens’ personal information in the name of “private detectives” is unlawful. The Longnan City Procuratorate and the Longnan City Public Security Bureau therefore jointly explained the law through the case and worked with central mainstream media to produce a television program. Drawing on the case, it urged citizens to be more aware of protecting their own personal information, to defend their rights through lawful channels when facing marriage, family and property disputes, and to resist the unlawful business of so-called “private detectives”. The program drew wide attention when it aired.
Typical Significance
No business model or technical means should become a tool for infringing citizens’ personal information. Where offenders, through such forms as setting up consulting companies and under the name of “private detectives”, illegally obtain, buy or sell citizens’ personal information, and the circumstances are serious, this is the crime of infringing upon citizens’ personal information, and procuratorates insist on punishing it in accordance with law. This is a typical case of the crime committed by several means: reselling online, and abusing GPS location technology and following and covert photography offline. Once sensitive personal information such as whereabouts and tracks is illegally obtained and abused, it can very easily threaten citizens’ personal and property safety. In handling such cases, procuratorates should keep a close watch on the black and grey industry chains that endanger the security of citizens’ personal information, investigate the upstream and downstream criminal chain thoroughly, and prosecute related crimes. By working both to punish crime and to promote social governance, they should keep raising the public’s sense of security. Where their personal information is infringed, victims should be more aware of protecting themselves and defend their lawful rights and interests in accordance with law.
Case 3
Pan X and 24 Others: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / elderly people / prosecuting omitted offenders / combining leniency with severity
Basic Facts
Defendant Pan X, male, born 1992, unemployed.
Defendant Fan X, male, born 1996, unemployed.
Details of the other 23 defendants are omitted.
While promoting online mini-programs offline, defendant Pan X discovered that some elderly people had a real need to activate their electronic medical insurance credentials (医保电子凭证), but were not good at using mobile apps and had little awareness of risk, so their personal information was easy to obtain by deception. Defendant Fan X learned that Alipay accounts that had passed real-name verification could be sold for profit. Fan X then conspired with Pan X and others. From November 2022 to September 2023 they formed a “village promotion” (村推) gang with 8 teams. In more than 500 villages across more than 10 prefecture-level cities in 6 provinces, including Henan, under the pretext of helping elderly people activate their electronic medical insurance credentials, they obtained by deception the names, ID card numbers, facial biometric information and other personal information of more than 20,000 elderly people. They used it to complete real-name verification of Alipay accounts in bulk, which Fan X then sold online, for illegal profits of more than RMB 1.8 million.
From January 2024 to August 2025, the People’s Procuratorate of Mengzhou City, Henan Province, initiated public prosecutions in turn against Pan X and the 24 others for the crime of infringing upon citizens’ personal information. All defendants voluntarily pleaded guilty and accepted punishment. The People’s Court of Mengzhou City sentenced Pan X and the 24 others for the crime of infringing upon citizens’ personal information to fixed-term imprisonment ranging from three years and nine months to nine months, with fines. The judgment has taken effect.
How the Procuratorate Performed Its Duties
(1) Using the mechanisms of investigation supervision and of cooperation to punish the crime jointly. The procuratorate gave the public security organ detailed guidance on collecting electronic data in accordance with law. Following proper procedure, the police extracted the Alipay account information from the seized phones of the persons involved, removed the accounts that had not completed real-name verification, and extracted the corresponding names, ID card numbers and other personal information from the verified accounts. This established accurately, in accordance with law, the quantity of personal information infringed. As for the other persons who took part in the “village promotion”, where the quantity of personal information infringed and the illegal gains did not reach the threshold for criminal prosecution, the procuratorate recommended that the public security organ impose administrative penalties on them. The public security organ adopted the recommendation, and the public security organs with jurisdiction over administrative penalties imposed them.
(2) Prosecuting omitted offenders, and punishing crimes against elderly people’s personal information severely. The case was a crime that seriously infringed the rights and interests of elderly people. During review for prosecution, the procuratorate sorted through the evidence in full: the criminal organization’s structure, its ranks of personnel, the flow of funds, the division of profits, and so on. It found that Pan X had conspired with Fan X and others, and that Fan X was the principal offender in the case. It then required the public security organ, in accordance with law, to transfer Fan X and 10 other omitted offenders for review and prosecution as a supplement. According to each defendant’s rank and role in the crime, it treated Pan X, Fan X and 7 others, who organized and directed it, as principal offenders, and the 16 who were hired temporarily, played a smaller role and profited less as accessories. It recommended fixed-term imprisonment for every defendant in the case, and the court adopted all of its sentencing recommendations.
(3) Taking several measures together to help elderly people remove hidden dangers and protect themselves. When the procuratorate heard the victims’ views, some elderly people said they feared the Alipay accounts involved could be used for illegal and criminal activity, but did not know what to do about it. To remove the hidden dangers and stop the harm from spreading, the procuratorate, together with the public security organ and township grassroots organizations, went door to door to check on and warn local elderly victims, and helped them close the Alipay accounts involved. For accounts belonging to elderly people elsewhere, it urged the platform concerned to flag them as risky and restrict their transactions. At the same time, it issued procuratorial recommendations to the functional departments concerned, to standardize the promotion of electronic medical insurance credentials and strengthen face-to-face help and guidance for elderly people. It combined case-handling with legal education through leaflets, case-based talks on the law, short videos and other forms. These aimed to raise elderly people’s awareness of protecting their own personal information and their ability to use the internet safely, and to make them wary of the various “tricks” by which offenders lure people into giving up personal information for profit.
Typical Significance
The internet is deeply woven into social life, and digital services such as online government services, electronic authentication and mobile payment are widespread. While these make life easier, some elderly people are not good at recognizing risks and are relatively unguarded. Their personal information is easily obtained illegally by offenders under various pretexts, and their lawful rights and interests are infringed. Procuratorates adhere to serving the people through justice and punish crimes against elderly people’s personal information severely in accordance with law. Because such crimes are typically committed by gangs, procuratorates review the evidence in full and prosecute omitted offenders in accordance with law, so that the whole chain is punished. They focus on the urgent needs of elderly victims and promptly remove the hidden risks the crime has left behind, so as to protect elderly people’s information security in earnest. For hidden dangers of personal-information leakage found in handling cases, they issue procuratorial recommendations in accordance with law, to push for sound risk-prevention mechanisms and close gaps in the management of personal information. Alongside this they run legal publicity on safe internet use, guiding elderly people to recognize risks, understand the internet and protect themselves, and to keep strengthening their awareness of personal-information protection and their ability to spot and avoid scams.
Case 4
Chen X-cheng and 5 Others: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / online doxxing (“box-opening”) / combined punishment for multiple crimes / governance at the source
Basic Facts
Defendant Chen X-cheng, male, born 2002.
Defendant Lu X-peng, male, born 1997.
Defendant Ma X-li, male, born 2002.
Details of the other 3 defendants are omitted.
Online doxxing, or “box-opening” (网络”开盒”), is a new type of unlawful and criminal conduct online. Offenders illegally collect and mine citizens’ personal information online and publish it on the internet; it is an important source of online violence. From 2020, defendants Chen X-cheng and Lu X-peng, seeking influence in cyberspace, together with defendant Ma X-li and others, doxxed netizens who disagreed with them on a number of online platforms. To build a personal-information database for doxxing, Chen X-cheng, Lu X-peng and Ma X-li used their familiarity with information technology and technical means such as script code to intrude into the affairs platform system of a certain province, illegally obtaining more than 16 million items of citizens’ personal information, such as ID card numbers and telephone numbers. At the same time, Chen X-cheng and Ma X-li wrote and ran script code to steal more than 1 billion items of personal information, such as registered user accounts and telephone numbers, from a number of online forums (贴吧) and cloud-storage services. Using the illegally obtained personal information, Chen X-cheng and the others doxxed 47 victims across the country, including online game players and forum moderators (5 of them minors), harassed them online and disturbed them offline. This seriously affected the victims’ normal study, work and life. Five victims sought medical treatment for depression, and a number of minors and university students became averse to school as a result.
In 2022, an online game company in Chengdu reported to the public security organ that several of its game players had been doxxed and abused online. On September 30, 2024, the People’s Procuratorate of Longquanyi District, Chengdu City, Sichuan Province, initiated a public prosecution against Chen X-cheng and the 5 others for the crime of infringing upon citizens’ personal information and other crimes respectively. On December 19, 2025, the People’s Court of Longquanyi District, Chengdu City, adopted the charges brought by the procuratorate and sentenced Chen X-cheng and the 5 others to fixed-term imprisonment ranging from four years and five months to nine months, with fines. After the judgment, some defendants refused to accept it and appealed. On April 30, 2026, the Chengdu Intermediate People’s Court ruled to reject the appeals and uphold the original judgment.
How the Procuratorate Performed Its Duties
(1) Closer cooperation to investigate the doxxing crimes in full. The public security organ opened the case for investigation as the crime of picking quarrels and provoking trouble. Because this was a new, difficult and complex “non-contact” case, the public security organ, under the mechanism for seeking the procuratorate’s opinions on major and difficult cases, asked the procuratorate to intervene early and guide the investigation and evidence collection. After hearing the briefing on the case and reviewing the file, the procuratorate found leads suggesting that Chen X-cheng and the others had illegally obtained citizens’ personal information in order to dox and abuse people online. It therefore recommended that the investigating organ seize the computers, phones and removable storage media involved in accordance with law, extract and fix the online platforms’ electronic data according to proper procedure, and establish in full the channels through which the information was sourced. After adopting the procuratorate’s opinions, the public security organ established all the criminal facts: Chen X-cheng and the others had used technical means to intrude into a number of online platforms, illegally obtained citizens’ personal information, and doxxed and abused people online.
(2) Applying the law accurately to punish the series of doxxing crimes severely. Doxxing and online abuse usually involve several acts, such as intruding into a computer information system, illegally obtaining information, and abusing and harassing people online, and may violate several criminal provisions at once. During review for prosecution, the procuratorate carried out a technical review of the electronic data in accordance with law and had network-information experts assess it. It determined as follows:
- Lu X-peng used a script program to intrude into a computer information system concerning state affairs, provided technical support for others’ doxxing, and abused people online himself. He committed the crime of illegally intruding into a computer information system and the crime of picking quarrels and provoking trouble, and should receive combined punishment for the multiple crimes.
- Chen X-cheng and Ma X-li used the script program Lu X-peng provided to intrude into the affairs platform and obtain citizens’ personal information. They thereby committed both the crime of illegally intruding into a computer information system and the crime of infringing upon citizens’ personal information. The two crimes stand in notional concurrence (想象竞合), so the heavier is punished, and they were held to have committed the crime of infringing upon citizens’ personal information. Chen X-cheng also abused people online and so separately committed the crime of picking quarrels and provoking trouble, to be punished in combination for the multiple crimes in accordance with law.
- The other 3 defendants doxxed and abused others online and committed the crime of picking quarrels and provoking trouble.
(3) Explaining the law through the case, and urging the information platform to fulfill its primary responsibility for oversight. The online platform involved had a large number of users and a wide audience, but weak user-privacy protections and inadequate content review and control. The procuratorate issued a procuratorial recommendation, in accordance with law, to the website’s operator, a certain digital technology company (某数码科技有限公司), urging it to fulfill its primary responsibility for platform oversight. After receiving the recommendation, the company actively carried out rectification. It optimized its models to identify, intercept and deal with content earlier and more effectively, improved its content-assessment system, and upgraded its information-security protections, further raising its level of network-security control. Drawing on this case, the procuratorate worked with central mainstream media on special reports exposing the online disorder of “human-flesh box-opening” (人肉开盒), and urged the units concerned and the public to be more aware of protecting citizens’ personal information.
Typical Significance
Online doxxing seriously infringes citizens’ personal rights, undermines order online, threatens public information security, breeds black and grey industry chains such as the infringement of citizens’ personal information, and gives rise to a range of crimes such as illegally intruding into computer information systems and picking quarrels and provoking trouble. Procuratorates should make full use of mechanisms such as seeking opinions on major and difficult cases, and work with public security organs to establish the criminal facts in full. They should apply the law accurately and determine the crimes in accordance with law; where several crimes are committed, they should be punished in combination. The series of doxxing crimes should be punished severely, to safeguard citizens’ personal rights and interests and regulate order in cyberspace. By issuing procuratorial recommendations, procuratorates advance “punishment, prevention and governance” (惩防治) together, and urge online platforms to take on their primary responsibility for oversight. Through legal education, they should keep sending the clear message that “the internet is not a place beyond the law”, lead the whole of society to say a firm no to doxxing, build consensus on protecting citizens’ personal information, and work together for a clean and healthy cyberspace.
Case 5
Liu X: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / publicly available personal information / housing rental and sale information / comprehensive governance
Basic Facts
Defendant Liu X, female, born 1988, unemployed.
In 2023, while working overseas, defendant Liu X learned that certain personal information of Chinese citizens could be sold abroad for profit. After returning to China, Liu X set up a real-estate agency company specifically for this purpose and recruited people to collect, on various platforms, the housing rental and sale listings posted by “female landlords listing directly” (一手女房东). Liu X screened and compiled the information of women with a certain level of financial means and sold it to people overseas. From October 2023 to July 2024, Liu X illegally obtained and sold more than 24,000 items of citizens’ personal information in total, with illegal profits of more than RMB 190,000.
Because of the leak of her personal information, the victim Li X was defrauded of more than RMB 290,000 by overseas criminals, and reported it to the public security organ. On May 30, 2025, the People’s Procuratorate of Binhu District, Wuxi City, Jiangsu Province, initiated a public prosecution against Liu X for the crime of infringing upon citizens’ personal information. Liu X voluntarily pleaded guilty and accepted punishment. On July 4, 2025, the People’s Court of Binhu District, Wuxi City, sentenced Liu X for the crime of infringing upon citizens’ personal information to three years and six months’ fixed-term imprisonment and a fine of RMB 200,000. The judgment has taken effect.
How the Procuratorate Performed Its Duties
(1) Using the opinion-seeking mechanism to determine precisely how the sale of public information abroad should be characterized. During the investigation, the public security organ, under the mechanism for seeking the procuratorate’s opinions on major and difficult cases, asked the procuratorate for its opinion on how to characterize Liu X’s collection of publicly available online housing listings and their sale abroad. The procuratorate considered the evidence in the file: Liu X’s subjective knowledge, the source and use of the information, the counterparties to the transactions, the harm caused, and so on. It advised the public security organ that the investigation should proceed on the footing that the conduct was suspected of being the crime of infringing upon citizens’ personal information. It guided the public security organ to collect and fix evidence on Liu X’s capacity to understand, her past experience and other matters, and to establish in full the content of the personal information sold. The public security organ adopted the procuratorate’s opinion and established that the information Liu X sold abroad included the location of the property, its floor area, the rental or sale price, and the sex and contact details of the person renting or selling. The public security organ then transferred Liu X to the procuratorate for review and prosecution for the crime of infringing upon citizens’ personal information.
(2) Determining the circumstances of the crime accurately, to punish the sale of citizens’ personal information abroad in accordance with law. During review for prosecution, the procuratorate reviewed the electronic data and other evidence in the file substantively. After de-duplicating the information involved, it determined in accordance with law that Liu X had illegally sold more than 24,000 items of citizens’ personal information in total. It sorted through the evidence of fund flows, transfer records and the like in full and, together with the chat records of Liu X’s sales, determined in accordance with law that her illegal gains amounted to more than RMB 190,000. Under the law, because Liu X sold more than 5,000 items of citizens’ personal information and made illegal profits of more than RMB 50,000, the circumstances were particularly serious, and she should be sentenced to fixed-term imprisonment of not less than three years. The procuratorate initiated a public prosecution against Liu X for the crime of infringing upon citizens’ personal information, as conduct of great social harm and particularly serious circumstances. It made a sentencing recommendation for a fixed term, which the court’s judgment upheld.
(3) Performing its duties in step with case-handling, to promote regulatory accountability and governance of the industry at the source. In this case, Liu X catered to “market demand” by targeting specific people. She deliberately scraped specific personal information that was public online and, without the consent of the right holders and contrary to the purpose for which the information was made public, processed and compiled it and sold it abroad illegally for profit. Drawing on the case, the procuratorate gave a risk alert to the competent industry department concerned and recommended that it strengthen its oversight of online platforms and promote better governance of the real-estate agency industry. Together with the competent industry department, it visited a number of real-estate agencies in its jurisdiction. Through case-based talks, discussions and other means, it helped them improve their mechanisms for reviewing and securing the online posting of housing rental and sale information, and raised their awareness of protecting citizens’ personal information.
Typical Significance
Citizens’ personal information that has already been made public is not a “public resource” that may be resold at will. Providing citizens’ personal information that was lawfully collected to others without the consent of the person from whom it was collected is “providing citizens’ personal information in violation of state provisions” as stipulated in the Criminal Law. Changing the scope, purpose and use for which the information was made public without authorization, clearly exceeding the limits of reasonable use, and illegally providing or selling the compiled citizens’ personal information, where the circumstances are serious, constitutes the crime of infringing upon citizens’ personal information. Such conduct very easily gives rise to telecom and online fraud and other crimes, seriously infringes citizens’ personal and property safety, and should be punished severely in accordance with law. Procuratorates give equal weight to punishing crime and to governance. For the gaps in managing online housing listings that the case exposed, the procuratorate used risk alerts, case-based explanation of the law and other means to push the competent industry department to strengthen oversight and to promote governance of the real-estate agency industry at the source.
Case 6
Shu X-ping: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / “fan circle” disorder / supervision of trials / incidental civil public-interest litigation in a criminal case
Basic Facts
Defendant Shu X-ping, female, born 1990, a telephone customer-service agent at an outsourcing company of an airline.
Shu X-ping was a keen celebrity fan who had long been active in online “fan circle” (饭圈) groups. She knew that in these groups fans habitually followed and photographed celebrities, took paid photos for others, and sold celebrities’ whereabouts and tracks information for profit. Finding that celebrities’ flight information could be sold for illegal profit, she used the convenience of her position to log in to the airline’s system, look up celebrities’ flight information and sell it outside through the online groups. Once the flight information leaked, fans used it to follow and photograph celebrities, to fly with them, or to “rush the gate” (刷关, buying tickets so as to follow a celebrity through security). This seriously infringed citizens’ right to privacy, disrupted the normal operation of airports and airlines, and created potential public-safety risks. From October 2021 to April 2024, Shu X-ping used the airline’s system to look up and sell celebrities’ flight information involving more than 30 people and more than 100 flights, with illegal profits of more than RMB 10,000.
On December 18, 2024, the People’s Procuratorate of Chaoyang District, Beijing, initiated a public prosecution against Shu X-ping for the crime of infringing upon citizens’ personal information, recommended that her illegal gains be confiscated in accordance with law, and at the same time filed incidental civil public-interest litigation. Shu X-ping voluntarily pleaded guilty and accepted punishment. On February 11, 2025, the court of first instance sentenced Shu X-ping for the crime of infringing upon citizens’ personal information to ten months’ fixed-term imprisonment, suspended for one year, and a fine of RMB 30,000. It also ordered her to bear civil liability, including paying public-interest damages and making an apology. Because the first-instance judgment did not recover Shu X-ping’s illegal gains in accordance with law, the procuratorate lodged a protest on February 21, 2025. On April 28, 2025, the court of second instance rendered a final judgment ordering the recovery of Shu X-ping’s illegal gains.
How the Procuratorate Performed Its Duties
(1) Applying the law accurately to determine the nature of upcoming flight information. On review, the procuratorate found that the information Shu X-ping sold to others was all individuals’ information on flights they had yet to take, which is citizens’ personal information as provided by law. Because such information can pinpoint where a specific passenger will be during a specific future period, it is whereabouts and tracks information. Shu X-ping sold more than 100 items of whereabouts and tracks information and made illegal profits of more than RMB 10,000. This met the standard of “serious circumstances” and constituted the crime of infringing upon citizens’ personal information, for which she should be held criminally liable in accordance with law.
(2) Lodging a protest to strengthen legal supervision over the recovery of illegal gains. Under the law, all property illegally obtained by an offender shall be recovered, or restitution shall be ordered. While scrutinizing the substantive findings in the case, the procuratorate also attached great importance to disposing of the property involved in accordance with law. After the first-instance judgment, it found on review that although the judgment convicted and sentenced Shu X-ping, it had not recovered the illegal gains from her sale of citizens’ personal information, as the law requires. This was an improper application of law, and the procuratorate lodged a protest. The court of second instance adopted the procuratorate’s protest and amended the judgment accordingly.
(3) Integrating its functions to file incidental civil public-interest litigation in the criminal case. In handling the case, the procuratorate found that by illegally obtaining and selling celebrities’ whereabouts and tracks information, Shu X-ping had infringed the personal information of many people. Her conduct could easily cause public disorder, created hidden dangers to public safety, fed “fan circle” disorder and harmed the public interest, so she should bear the corresponding civil liability. The procuratorate started incidental civil public-interest proceedings in accordance with law. It asked that Shu X-ping pay more than RMB 10,000 in public-interest damages and apologize publicly, in news media at the provincial level or above, for infringing citizens’ personal information, so as to safeguard the public interest. The court’s judgment upheld both claims. After the judgment took effect, Shu X-ping performed these obligations.
Typical Significance
In recent years “fan circle” disorder has been frequent. Chasing celebrities by “rushing the gate”, crowding airports, and mobbing them with paid photographers persist despite repeated bans. They infringe citizens’ privacy, disturb order in public places, and easily create safety risks. Illegally obtaining and selling the personal information of celebrities and other public figures is an important source of all kinds of “fan circle” disorder, and procuratorates insist on punishing it in accordance with law. Where flight information can pinpoint where a specific natural person will be during a specific future period, it is personal information of the whereabouts-and-tracks type. Crimes of infringing upon citizens’ personal information often involve disposing of property connected with the case. Where a court’s judgment does not recover the illegal gains, the procuratorate should make full use of its function of supervising trials and lodge a protest in accordance with law. While pursuing criminal liability, procuratorates take the initiative to assess whether the criminal conduct harms the public interest. Where appropriate, they start incidental civil public-interest proceedings in accordance with law and ask that the defendant, besides handing over illegal gains and paying a fine, bear the corresponding civil liability, such as public-interest damages. Criminal accountability and protection of the public interest are thus achieved together.
Case 7
Lin X-feng and 20 Others: Infringing upon Citizens’ Personal Information
Keywords: crime of infringing upon citizens’ personal information / online recruitment / virtual currency / incidental civil public-interest litigation in a criminal case
Basic Facts
Defendant Lin X-feng, male, born 1992, head of a company.
Defendant Ning X, male, born 1998, unemployed.
Details of the other 19 defendants are omitted.
In May 2024, defendant Lin X-feng learned through his company’s recruiting that job applicants’ information could be sold abroad for profit. He registered a company account on an online recruitment platform and posted fake job advertisements to obtain applicants’ personal information illegally. The company accounts in his name could obtain only a limited amount of personal information, and were banned for repeatedly breaching the recruitment platform’s rules. Lin X-feng then changed his method. He recruited the other defendants in this case and set up a front-end traffic team and a back-end data team. The front-end team posed as job seekers, contacted human-resources staff at other companies, and induced them with offers of money to obtain applicants’ personal information illegally through their company accounts. The back-end team gave the HR staff it had bought a template for collecting citizens’ personal information, and pooled and organized the information it purchased. Lin X-feng then sold this illegally obtained personal information abroad over the internet for profit. To evade punishment, all of Lin X-feng’s illegal gains from selling citizens’ personal information abroad were settled in virtual currency and then converted into RMB through defendant Ning X; the amount involved was more than RMB 7.46 million. By count, the gang illegally obtained and sold more than 870,000 items of citizens’ personal information in total.
From October 2025 to February 2026, the People’s Procuratorate of Taijiang District, Fuzhou City, Fujian Province, initiated public prosecutions in turn against Lin X-feng and 19 others for the crime of infringing upon citizens’ personal information, and against Ning X for the crime of aiding information network criminal activities. It also filed incidental civil public-interest litigation against Lin X-feng and others. The People’s Court of Taijiang District, Fuzhou City, convicted Lin X-feng and the 20 others of the crime of infringing upon citizens’ personal information and the crime of aiding information network criminal activities respectively. It sentenced them to fixed-term imprisonment or criminal detention ranging from five years and three months to six months, with fines, and ordered them to bear civil liability, including paying public-interest damages and making an apology. The judgment has taken effect.
How the Procuratorate Performed Its Duties
(1) Verifying the quantity of virtual currency to determine the amount involved accurately. This was a new type of personal-information crime, and the public security organ asked the procuratorate to take part in discussing the case. The procuratorate focused on the core points: the characterization of the case, the electronic data, the cross-border nature of the crime, and settlement in virtual currency. It recommended that the investigating organ extract key evidence, such as server data, electronic transaction records, chat records of the persons involved and settlement vouchers, so as to establish the criminal facts accurately in accordance with law. Because virtual currency is anonymous, moves quickly and is hard to trace, the procuratorate guided the public security organ to sort through the transaction flows in full and, with the chat records, pin down the upstream accounts involved. Lin X-feng identified them one by one, the quantity of virtual currency was verified precisely, and the amount involved was determined in accordance with law.
(2) Performing its review functions in accordance with law to punish the related crimes severely. The defendants illegally obtained job seekers’ personal information through online platforms and sold it abroad. Their subjective malice was great, the nature of their conduct egregious and the consequences of the crime serious. In handling the case, the procuratorate reviewed in full each defendant’s role, degree of participation and amount of profit. It approved, in accordance with law, the arrest of those who played a main role in the crime, and initiated public prosecutions against all 21 members of the gang to hold them criminally liable. As for the companies’ HR staff who supplied personal information to the gang, the procuratorate took the view that they had illegally obtained and sold personal information in breach of laws and regulations, platform rules and their companies’ rules. They were suspected of the crime of infringing upon citizens’ personal information, and the procuratorate recommended that the public security organ investigate them in accordance with law. All of them have now been prosecuted by the procuratorate.
(3) Continuing to strengthen comprehensive performance of duties, and filing incidental civil public-interest litigation in the criminal case. By illegally obtaining applicants’ personal information, defendant Lin X-feng and the others infringed the security of citizens’ personal information and the tranquility of their private lives, gave rise to telecom and online fraud and other crimes, and harmed the interests of the state and the public. Making full use of its procuratorial functions, the procuratorate filed incidental civil public-interest litigation, in accordance with the law, against Lin X-feng and one other, asking that the wrongdoers bear liability for public-interest damages. The Taijiang District Court ordered the defendants in the incidental civil public-interest litigation to delete, after the judgment takes effect, all documents and materials in the case that involve infringing other people’s personal information. It ordered them to apologize publicly to the public in national news media within ten days of the judgment taking effect, and to pay public-interest damages of RMB 4 million and RMB 10,000 respectively.
Typical Significance
Competition in the job market is growing fiercer, and job seekers are under considerable pressure. Recruitment is meant to be a link that serves employment and people’s livelihoods and connects supply and demand, and it carries the important function of stabilizing employment and protecting livelihoods. Offenders who use online recruitment channels under the pretext of hiring, illegally obtain and sell applicants’ information without their consent, and change the use of the information without authorization, commit the crime of infringing upon citizens’ personal information. This not only infringes job seekers’ lawful rights and interests but also undermines the basis of trust in the employment field. The conduct is egregious, and procuratorates should punish it severely in accordance with law. Some companies’ HR staff use the permissions of their recruiting positions and abuse the convenience of their duties to collect and dispose of job seekers’ personal information illegally, and provide or sell it outside without authorization for profit. They become accomplices of the black and grey information industry chain, infringing job seekers’ lawful rights and interests and damaging the employment market. They should be held legally liable in accordance with law. Offenders’ illegal handling of job seekers’ personal information infringes the information of a large number of unspecified people and harms the public interest. Procuratorates integrate criminal prosecution with public-interest litigation. While punishing the crime severely, they require the infringers to bear civil liability, such as compensating losses and making an apology, so as to repair the harm to the public interest in full. Crimes of infringing upon citizens’ personal information are thus regulated on two fronts, building a firm safety net for citizens’ personal information.
Case 8
Civil Public-Interest Litigation by the People’s Procuratorate of Yuexiu District, Guangzhou City, Guangdong Province, against Wang XX and Lin XX for Stealing the Medical and Health Information of Cancer Hospital Patients
Keywords: civil public-interest litigation / personal-information protection / technical forensic examination / public-interest damages
Basic Facts
From April 2022 to February 2024, Wang XX and Lin XX used a “crawler” program on the internet to intrude illegally into the servers of a tertiary (Grade 3A) specialist cancer hospital. They stole 3,858,671 records in total, including “patient personal information”, “outpatient medical order data” and “inpatient medical order data”. They moved the records to servers outside China, where they were run and stored for as long as half a year, and sold part of the medical data for profit. Their illegal obtaining and handling of personal information infringed the lawful rights and interests of a large number of unspecified patients, and endangered national data security and public-health security.
How the Procuratorate Performed Its Duties
In April 2024, the People’s Procuratorate of Yuexiu District, Guangzhou City, Guangdong Province, found leads on this case in the course of performing its duties, opened a civil public-interest litigation case, and started an investigation in accordance with law. It established the following. Of the 3,858,671 records stolen, 255,443 “patient personal information” records contained names, sex, addresses, telephone numbers, ID card numbers and the like. These are identifiable and associated with individuals (具有可识别性 和关联性), and are personal information expressly protected by the Personal Information Protection Law. The 2,455,838 “outpatient prescription data” records and 1,147,390 “inpatient prescription data” records covered, apart from the patient ID-card field, drug names, dosages, frequency, method of administration, patient status and the like. Whether the outpatient and inpatient prescription data were identifiable and associated with individuals, and so were sensitive medical-health personal information, was a difficult question. To resolve it, the Yuexiu District Procuratorate commissioned the Judicial Forensic Center of the People’s Procuratorate of Guangzhou City to examine and analyze the data. The technical forensic examination found that the “outpatient medical order data” and “inpatient medical order data” could be linked to the “patient personal information data” through the ID-card field and traced precisely to specific patients, and so are sensitive medical-health personal information expressly protected by law. It was also established that on November 13, 2024, the People’s Court of Yuexiu District, Guangzhou City, convicted Wang XX and Lin XX of the crime of infringing upon citizens’ personal information.
On review, the Yuexiu District Procuratorate took the view that the verifiable profit in this case was only RMB 10,800. Fixing public-interest damages on that basis would neither reflect the real harm to the public interest nor serve the punitive function of justice. On the facts established, it took the sensitivity of the information as its core benchmark and the quantity handled and the reach of the harm as an escalating scale. It weighed together the following factors:
- the medical and health data involved was large in volume, highly sensitive and wide in reach, and costly to remedy;
- the data had significant public-use value and carried major public interests;
- the wrongdoers’ subjective malice was evident and their fault serious; and
- the outbound transfer of the data disrupted public order, complicated the regulatory response and raised the costs of social governance.
On that basis it fixed the public-interest damages at RMB 1.5 million.
After a public notice, no organ or organization prescribed by law brought a suit. On April 9, 2025, the Yuexiu District Procuratorate filed a civil public-interest suit with the Guangzhou Internet Court against Wang XX and Lin XX for infringing citizens’ personal information and harming the public interest. It asked the court to order the two defendants to bear RMB 1.5 million in public-interest damages and to apologize publicly in media at the provincial level or above, or in internet media of equivalent influence. On August 24, 2026, the Guangzhou Internet Court rendered a first-instance judgment upholding all of the procuratorate’s claims. The judgment has taken effect.
Typical Significance
Through technical forensic examination, the procuratorate resolved the difficulty of establishing whether medical-health sensitive personal information is “identifiable” and “associated” with an individual, and so determined precisely what was personal information. At the same time, it addressed a practical problem: illegally stealing personal information can do great harm to the public interest while yielding little actual profit, which leaves public-interest damages impossible to quantify. The procuratorate determined the amount of public-interest damages by combining factors such as the sensitivity of the information, the value of the data in use, and cross-border risk, and filed civil public-interest litigation in accordance with law. The wrongdoers were made to bear the corresponding civil liability and potential wrongdoers were warned, which shows the institutional value of civil public-interest litigation.
Source: Supreme People’s Procuratorate official WeChat account, November 2, 2026 (reported by the Procuratorial Daily). Translated by DCC. Original (Chinese).
Translator’s note on Case 8: the original names the stolen data categories in two ways, as “medical order data” (医嘱数据) and as “prescription data” (处方数据), for the same two outpatient and inpatient datasets. DCC keeps each wording where it appears.
— Not legal advice.