2 Sep 2015
PRC Criminal Law Amendment Enhances Personal Information Protection
After three rounds of deliberation and numerous modifications, the Ninth Amendment to the PRC Criminal Law (“Amendment IX”) was approved and adopted by the Standing Committee of the Twelfth National People’s Congress on 29 August 2015. Amendment IX will go into effect on 1 November 2015. One major highlight of Amendment IX is the increased protection of personal information.
1. Enhanced protection of personal information
- Applicability of criminal liability expanded – The Seventh Amendment to the PRC Criminal Law (2009) made “staff of state organs or financial, telecommunications, transportation, education, medical or other work units” subject to criminal liability for “selling or illegally offering personal information”. Amendment IX expanded this crime to apply to any institution or individual selling or illegally offering personal information, regardless of industry (for institutions) or occupation or (for individuals). Moreover, Amendment IX enumerates aggravating circumstances – giving rise to more stringent liability – for the sale or offer of personal information “obtained while performing duties or providing services to a third party”.
2. Criminal Liability for Network Service Providers
Amendment IX expands the potential criminal liability of network service providers and certain individuals, particularly with respect to the use of user information, security measures and other business functions.
- Criminal Circumstances Specified – Under Amendment IX, network service providers may be held accountable under four circumstances:
- mass dissemination of illegal information;
- disclosure of users’ information resulting in serious consequences;
- loss of criminal evidence, resulting in serious consequences; or
- other serious circumstances.
- Criminal Liability – Amendment IX provides a more detailed definition of the criminal penalties a network service provider may encounter, including a maximum of three years imprisonment, criminal detention or public surveillance, as well as concurrent fines. If concurrent crimes have been committed, a heavier penalty will apply. This criminal liability is in addition to the various types of civil liability (e.g., joint liability for infringement) and administrative liability to which network service providers may be subject (for more information, please see the publications listed above).
Amendment IX is a key step in the ongoing fight to strengthen personal information protection in the PRC. Amendment IX has been drafted to work alongside of the Cyber Security Law (Draft) (soliciting opinion draft) and the National Security Law, adopted in July 2015. Amendment IX will undoubtedly significantly influence the future of network information management and protection of personal information in China.