Editor’s Note — DCC.
The Supreme People’s Procuratorate (SPP) is China’s national prosecution service. It decides how personal-information crimes are charged, and it is also the main plaintiff in public-interest litigation. This release marks five years of the Personal Information Protection Law, which took effect on November 1, 2021.
What this brief is. A full translation of the SPP’s release note, followed by DCC’s case-by-case map and reading. The issuing notice and all eight cases, translated in full, are on the law page. Typical cases are issued “for reference”: they guide procuratorates but do not bind courts. The criminal thresholds they apply come from the 2017 PI Criminal Interpretation.
Related reading. The police side of the same offense is in DCC’s brief on the MPS Cyber Security Bureau’s ten typical cases (August 2026).
The SPP’s release (translated)
The Supreme People’s Procuratorate Issues Typical Cases on Protecting Citizens’ Personal Information in Accordance with Law
Focusing on new features of unlawful and criminal infringement of citizens’ personal information. Integrating its functions to safeguard citizens’ rights and interests in their personal information with full force.
November 1 marked the fifth anniversary of the implementation of the Personal Information Protection Law of the People’s Republic of China. On this occasion, the Supreme People’s Procuratorate has issued a batch of typical cases on protecting citizens’ personal information in accordance with law. The cases focus on the new features and new trends of current unlawful and criminal infringement of citizens’ personal information, and reveal the serious harm it causes. They guide procuratorates in all localities to punish such conduct in accordance with law, to keep deepening the integrated performance of their functions, and to safeguard citizens’ rights and interests in their personal information in accordance with law.
The batch reportedly contains 8 cases. They are typical and exemplary in respects such as applying the law accurately, punishing crime strictly along the whole chain, protecting the public interest, and integrating procuratorial functions to promote social governance.
- Case 1 makes clear that the black and grey industry chains of personal-information crime are to be punished along the whole chain, and that procuratorates actively promote governance at the source in response to the gaps in information oversight that cases expose.
- Case 2 stresses punishing, in accordance with law, crimes that abuse GPS location technology under the name of “private detectives” to obtain citizens’ personal information illegally, and that infringe citizens’ personal and property rights.
- Case 3 makes clear that crimes exploiting some elderly people’s weak understanding of the internet and low guard are to be punished severely in accordance with law. Procuratorates work with the units concerned to remove the effects of the crime, and run legal publicity to help elderly people become more aware of risks and better able to guard against them.
- Case 4 focuses on doxxing (“box-opening”) and online-abuse crimes. It exposes in full the harm done at each stage and the offenses each stage may involve. Procuratorates punish the whole chain and build firm defenses for information protection by issuing procuratorial recommendations.
- Case 5 makes clear that illegally obtaining the housing rental and sale information posted by a specific group in China, and selling it abroad, giving rise to telecom fraud and other crimes, is to be punished severely in accordance with law.
- Case 6 focuses on “fan circle” (饭圈) disorder. For crimes in which offenders illegally obtain and sell celebrities’ whereabouts and tracks information, procuratorates pursue criminal liability in accordance with law and also file incidental civil public-interest litigation to pursue the corresponding civil liability.
- Case 7 makes clear that unlawful and criminal infringement of citizens’ personal information through online recruitment platforms, under the pretext of hiring, is to be punished severely in accordance with law. Procuratorates file incidental civil public-interest litigation in accordance with law to safeguard the public interest in full.
- Case 8 focuses on illegally obtaining medical and health information. The personal information stolen was large in volume and wide in reach, the harm was serious, and the cross-border transfer disrupted public order. The procuratorate fixed the amount of public-interest damages by combining factors such as the sensitivity of the information, the value of the data in use, and cross-border risk, and filed civil public-interest litigation in accordance with law.
The heads of the SPP’s Ordinary Crimes Procuratorial Department and Public Interest Litigation Procuratorial Department said that in recent years procuratorates nationwide have grasped accurately the new features and trends of unlawful and criminal infringement of citizens’ personal information. They have punished prominent offenses in this field in accordance with law, safeguarded citizens’ rights and interests in their personal information with full force, and pushed comprehensive online governance deeper and further. Next, procuratorates will continue to implement Xi Jinping Thought on the Rule of Law in depth and adhere to the holistic approach to national security. While punishing unlawful and criminal infringement of citizens’ personal information in accordance with law, they will deepen coordination and comprehensive governance, work to root out the conditions in which such crime breeds, and provide solid judicial safeguards for the protection of citizens’ personal information through high-quality, high-efficiency procuratorial work.
The eight cases at a glance
DCC’s map. Amounts and sentences are as published; full facts and reasoning are on the law page.
| Case | Where | Scheme | Charges and outcome | What the SPP draws from it |
|---|---|---|---|---|
| 1. Wang X and 10 others | Jinhua, Zhejiang | A “studio” bought household-registration, property and whereabouts data from overseas “social-engineering databases”, paid in virtual currency, and resold it in China; over RMB 1.98 million involved. | Art. 253a; 3 years 6 months to 8 months, with fines (November 2025). | Punish the whole chain, upstream to secondary resale; trace funds through every layer; push the source units of the data to inspect themselves and deal with insiders who leaked. |
| 2. Zhou X-xu and 8 others | Longnan, Jiangxi | ”Private detective” consulting company sold “marriage investigations”: whereabouts, property and hotel records bought online, plus GPS trackers and covert photography; 18,000+ items, RMB 160,000+; extortion on top. | Art. 253a and extortion; lead defendant 4 years and RMB 200,000 fine (August 2024). | No business model is a license; dig out the upstream suppliers and related crimes; a recommendation led to a clean-up of “private detective” ads online. |
| 3. Pan X and 24 others | Mengzhou, Henan | A “village promotion” gang in 500+ villages “helped” 20,000+ elderly people activate electronic medical insurance credentials, took their IDs and face images, and sold real-name-verified Alipay accounts; RMB 1.8 million+. | Art. 253a; 3 years 9 months to 9 months, with fines; 11 omitted offenders added during review. | Prosecute omitted offenders; sort principals from accessories; those below the criminal threshold get administrative penalties; the platform was asked to flag and restrict the accounts. |
| 4. Chen X-cheng and 5 others | Chengdu, Sichuan | Doxxing. Script intrusion into a provincial affairs platform (16 million+ records), scraping of forums and cloud storage (1 billion+), then doxxing and harassment of 47 people, 5 of them minors. | Illegal intrusion, Art. 253a and picking quarrels; 4 years 5 months to 9 months; upheld on appeal (April 2026). | How to charge doxxing: intrusion plus PI infringement is a notional concurrence (punish the heavier); online abuse is a separate crime. Recommendation to the forum operator on weak privacy and moderation. |
| 5. Liu X | Wuxi, Jiangsu | Set up a real-estate agency to collect rental and sale listings posted directly by women landlords, picked the better-off, and sold 24,000+ records abroad; RMB 190,000+; one victim lost RMB 290,000+ to fraud. | Art. 253a, particularly serious; 3 years 6 months and RMB 200,000 fine (July 2025). | Public information is “not a public resource”. Providing lawfully collected PI without consent violates “state provisions”; going beyond the purpose and reasonable use of publication, then selling, is the crime. |
| 6. Shu X-ping | Beijing (Chaoyang) | An airline’s outsourced call-center agent looked up celebrities’ upcoming flights and sold them in fan groups: 30+ people, 100+ flights, RMB 10,000+. | Art. 253a; 10 months suspended for 1 year, RMB 30,000 fine; public-interest damages and apology; gains recovered on protest (April 2025). | An upcoming flight that pins a person to a future place and time is whereabouts and tracks information. Procuratorates protest judgments that fail to recover illegal gains, and attach civil public-interest claims. |
| 7. Lin X-feng and 20 others | Fuzhou, Fujian | Fake job ads, then a front-end team that bribed other companies’ HR staff to pull applicants’ data; 870,000+ records sold abroad, settled in virtual currency (RMB 7.46 million+). | Art. 253a and aiding information network criminal activities; 5 years 3 months to 6 months; RMB 4 million and RMB 10,000 public-interest damages, deletion and national apology. | HR staff who misuse recruiting access are “accomplices” and were prosecuted too. Recruitment data harms an unspecified public, so public-interest damages follow. |
| 8. Yuexiu Procuratorate v. Wang XX and Lin XX | Guangzhou, Guangdong | A crawler intruded into a cancer hospital’s servers and took 3,858,671 records, moved them to overseas servers for half a year, and sold some; proven profit RMB 10,800. | Civil public-interest suit in the Guangzhou Internet Court; RMB 1.5 million public-interest damages and public apology (August 2026), after a criminal conviction (November 2024). | Forensic examination showed that prescription data linked by an ID-card field is sensitive medical-health PI. Damages were set by sensitivity, volume, public value, fault and cross-border risk, not by profit. |
What it means for companies
DCC’s reading. Typical cases do not change the law. They show where China’s prosecution service is pointing procuratorates, and five points carry beyond the individual offenders.
1. Public is not free. Case 5 is the clearest statement yet from the SPP on reselling publicly available personal information. Its typical significance says that information already made public is “not a ‘public resource’ that may be resold at will”. It also says that providing lawfully collected personal information to others without the consent of the person it was collected from is “providing citizens’ personal information in violation of state provisions”, an element of the Article 253a offense. And changing the scope, purpose and use for which the information was made public, beyond reasonable use, then selling it, is the crime where the circumstances are serious. This tracks the civil rule in PIPL Article 27, which allows handling of public information only “within a reasonable scope”. It matters to anyone whose product or data supply compiles listings, profiles or contact details scraped from public pages. The facts were bad: Liu targeted women landlords by wealth and sold abroad to fraudsters. But the stated rule is general.
2. Insiders and vendors are the leak. In three of the eight cases the data left through people with legitimate access. In Case 1 the SPP pushed the “source units” of the information to inspect themselves and deal with staff who had leaked. In Case 6 the seller was a call-center agent at an airline’s outsourcing company, using the airline’s system. In Case 7, other companies’ HR staff were bribed to pull applicants’ data through their employers’ recruitment-platform accounts, and were prosecuted themselves. The 2017 Interpretation already halves the thresholds for information “obtained in the course of performing duties or providing services” (Article 5, item (VIII)). The MPS’s August batch showed the same pattern from the police side. Access controls, logging and vendor oversight are where a company’s exposure sits.
3. Some data is in the highest tier. Case 6 holds that a passenger’s flight information for a trip not yet taken is “whereabouts and tracks” information when it can pinpoint where a specific person will be at a specific future time. That category carries the lowest criminal threshold: 50 items for “serious circumstances”, 25 for insiders. Case 8 holds that prescription records carrying a patient ID-card field are sensitive medical-health personal information, because they can be linked to the patient register and traced to individuals. Travel, booking, health and other datasets that look operational may sit in the most protected category.
4. Public-interest damages are now part of the bill. Three cases attach civil public-interest claims: Cases 6 and 7 inside the criminal case, Case 8 as a separate civil suit. In Case 8 the procuratorate refused to set damages by the RMB 10,800 the defendants were proved to have earned. It started from the sensitivity of the information and scaled up by volume and reach. It added the data’s public value, the defendants’ fault, and the cost to governance of the data going abroad, and reached RMB 1.5 million. In Case 7 the court ordered RMB 4 million against one defendant, plus deletion of the data and an apology in national media. The method in Case 8, sensitivity first, then volume, then cross-border risk, is the SPP’s model for quantifying harm when profit is small. Selling abroad features in Cases 5 and 7, and in Case 8 the outbound transfer was an express factor in the damages.
5. Platforms get recommendations even when they are not defendants. Procuratorial recommendations (检察建议) went to a forum operator over weak privacy protection and content moderation (Case 4). Others went to the departments overseeing “private detective” ads (Case 2) and the promotion of medical insurance credentials (Case 3), and to real-estate agencies on reviewing listings (Case 5). Alipay was asked to flag and restrict the accounts in Case 3. A recommendation is not a penalty, but Case 4’s operator responded by upgrading its models, content review and security protections. Platforms that host the means or the market for these crimes should expect to be drawn in.
Case 4 also settles, for procuratorates, how doxxing is charged. Intruding into a system to harvest data and the PI offense are a notional concurrence, punished as the heavier of the two. The online abuse is a separate count of picking quarrels and provoking trouble.
— 最高人民检察院 (Supreme People’s Procuratorate), 最高检发布依法保护公民个人信息典型案例 (The Supreme People’s Procuratorate Issues Typical Cases on Protecting Citizens’ Personal Information in Accordance with Law), November 2, 2026, reported by the Procuratorial Daily. Release note translated in full by DCC; case map and commentary are DCC’s. Original (Chinese).
— Not legal advice.