Clamping down on online personal data privacy

Internet and mobile businesses, including e-commerce and social media operations, are developing at a remarkably high speed in China and play an increasingly important role in the Chinese economy. However, this challenges the protection of personal rights (including personal information and reputation of individuals and companies).

A judicial interpretation preliminarily addressed a series of important questions, including: How should companies and individuals protect their reputations against online libel How should internet service providers (ISPs) react to libellous information and personal information widely spread through their networks How should businesses regulate their online marketing behaviour

On August 21 2014, the Supreme People's Court (SPC) issued a judicial interpretation called the Provisions on Several Issues Concerning the Application of the Law in the Trial of Civil Dispute Cases Involving the Utilisation of Information Networks to Infringe Personal Rights and Interests (最高人民法院关于审理利用信息网络侵害人身权益民事纠纷案件适用法律若干问题的规定) (Provisions), which became effective on October 10 2014. The SPC also published eight typical cases involving infringement of personal rights online, which set out the background for, and add detail to, the Provisions.

How the new rules protect personal rights

Generally speaking, the Provisions provide for procedural rules to encourage individual and company victims to lodge private suits to protect their reputational right and rights in personal information. They also apply the general principles for determining ISP liability under the PRC Tort Liability Law (Tort Law) to cases involving infringement of personal information and reputational rights, clarify the scope of personal information, a concept which was first introduced at the national level in the Decision on Strengthening the Protection of Online Information (Decision), and for the first time, address issues relating to libel on social media platforms.

Personal right suits

A victim whose personal rights (e.g. reputational rights and rights of personal information) are infringed often finds it difficult to bring a civil case against an online infringer. The three main reasons for this are: an infringer seldom releases his genuine identity or residential address on the internet, which results in difficulties in naming the exact defendant; an infringer may publish infringing information anywhere with the information being widely spread, which results in the victim's inability to determine the appropriate venue for the suit; and victims often suffer psychological damage as a result of the infringement of their personal rights but may not be able to establish actual monetary damages.

In response, the Provisions entitle the victim to sue ISPs which display the infringing information to release of the genuine identity of the infringer. Among the typical cases published by the SPC, there are two cases where the plaintiff has sued ISPs to release the genuine identity of the infringers, which demonstrated the significance of this provision to victims. It is still unclear, however, whether ISPs have the right or duty to disclose the identities of asserted infringers upon the establishment of preliminary evidence but before the issuance of a court decision.

Secondly, the Provisions clarify venue in that the residential location of the victim is considered a place where an online infringement is committed and the victim may sue the infringer in a competent court where the victim resides. In other words, victims will have a convenient venue where they are able to lodge a suit in a familiar place regardless of where the infringer resides or where the infringing information is uploaded.

Thirdly, to account for the difficulties in proving the amount of actual damages, the Provisions entitle victims to claim for reasonable expenses incurred to proceed with their lawsuits, including the costs of collecting evidence and reasonable legal fees, as well as for statutory damages up to Rmb500,000 (approximately US$82,000). However, in practice, the standard for “reasonable legal fees” is quite low – usually 10% of the amount of the damages awarded.

As a result of these regulations, ISPs may face more suits from victims. However, this does not necessary present a higher risk for ISPs. For one thing, the claims brought by victims against ISPs are limited to the disclosure of the genuine identities of actual infringers and are not extended to claims for damages (unless the ISPs violate the notice and take down obligations as discussed below). Also, the Provisions relieve ISPs' concerns that the disclosure of suspected infringers' personal information would constitute an infringement of the suspected infringers' personal data. In light of this, ISPs should review and improve their personal data storage system and be prepared to disclose users' personal data in private law suits.

ISP liability in personal rights infringement

The Tort Law introduced the safe harbour defence and the notice and take-down approach in terms of ISP liabilities. These are cited and heavily discussed in quite a number of cases concerning online IP infringement. The Provisions expand their application to cases involving infringement of personal rights.

The Provisions grant to ISPs safe harbour defences in cases involving infringement of personal rights. In other words, an ISP will not be held liable for information infringing personal rights displayed on its platform or transmitted via its networks unless it has actual or constructive knowledge of the infringement. A notice from the victim demonstrating the infringing nature of the relevant information with supporting evidence will usually be considered actual knowledge. In line with the judicial interpretations of the Tort Law, the Provisions provide a suite of factors to be considered for determining an ISP's constructive knowledge of infringement. These factors include:

• the ISP's involvement in selecting, recommending, ranking and editing information displayed on its platforms or transmitted via its networks;
• the nature of the ISP's services and its capability to manage its services;
• the overtness of the infringement;
• the public exposure of the infringing information; and
• whether the ISP has adopted appropriate measures to prevent the uploading, display and transmission of infringing information, in particular to prevent repeat infringers misusing their services to commit infringements.

The Provisions also apply the notice and take-down approach to cases involving online infringement of personal rights. ISPs are required to take down content infringing personal rights and take other proper measures to prevent the spread of such infringing information when they receive a notice from victims of the infringement of the content posted via their networks. The Cai Jiming v Baidu case published by the SPC further clarified that ISPs must adopt proper measures after becoming aware of the infringement in a timely manner or otherwise be held liable for the spread of infringing information during the delay.

In light of the Provisions, in terms of ISP liability in personal rights cases, ISPs should expand the application of their take-down policies to assert infringement of personal rights. Further, it is worth noting that a number of recent ISP liability cases involving IP infringement cases have established guidelines on a number of important issues, such as how to determine an ISP's constructive knowledge and the sufficiency of a take-down notice as well what measures ISPs must take to prevent further transmission of infringing information. These guidelines should also be taken as reference for the implementation of notice and take-down policies where personal rights infringement is concerned.

Scope of personal information

The Decision is the first congress-made legislation which expressly provides for the protection of personal information. However, it provides only a vague description of personal information. The Provisions, to a certain degree, clarify the scope of personal information and help internet content providers (ICPs) to assess what content they are allowed to publish on their websites without infringing personal data.

The Provisions provide examples of protectable personal information, such as genetic information, medical history, health check records, criminal records, residential addresses and personal activities. It also sets out a list of carve-outs which will not be protected as personal information, which include: 1) information disclosed with the relevant individual's consent; 2) information disclosed on public interest grounds; 3) depersonalised information; 4) information in the public domain; and 5) information obtained from legitimate sources. Nevertheless, information (4) and (5) must not be disclosed in any way that contradicts public interest or is prejudicial to personal interests.

The SPC published several cases fleshing out the courts' view on the balance between freedom of speech and protection of personal information. In the Wang v Beijing Lingyun case, the defendant received from the deceased (before the latter committed suicide) narratives and pictures about her husband's extramarital affairs and republished them on some internet forums. The court determined that, although the extramarital affairs posted were true and immoral, information about personal activities is private and its disclosure violates personal privacy. In other words, the court held that freedom of speech does not constitute an excuse for disclosure of and inference with personal life.

The decision in the Cai Jiming v Baidu case is slightly different. The court determined that posting personal contact information and libellous information is infringing but, given that the plaintiff became a public figure because of his controversial proposal made in the People's Congress, the public discussions about his activities and behaviour fall within the scope of freedom of speech. In other words, ICPs enjoy more freedom to post reports on private lives of public figures.

Liabilities for republication

With the development of WeChat and Weibo in China, social media plays an increasingly important role in the dissemination of information. Companies also use social media for advertising and marketing. However, some distribute false, misleading and even libellous information to damage the reputations of their competitors. Some ICPs, individuals and internet marketers intentionally republish the information to attract attention (i.e. to receive more hits or followers). In response, the Provisions set out a couple of guidelines to deal with these liabilities.

Firstly, the Provisions set out, for the first time, factors to be considered in determining a republisher's liability for transmitting false, misleading and libellous information. These include: the level of care taken by the republisher; the overtness of the infringing nature of the information being republished; and whether the republisher made any changes to the original information, causing readers to be misled. This does not set an absolute obligation for republishers to ensure the truthfulness of the information being republished but requires them to adopt a due care standard. As interpreted by Justice Yao Hui of the SPC, the wider the range of influence the republication has, the more due care the republisher should have. In other words, if the republisher is a reputable ICP, it should use higher standard of care to assess the truthfulness of the content before republishing it, because the ICP ought to know that its republications will be quickly read and spread by a large number of followers.

Secondly, the Provisions require that those who publish a negative report about an individual or a company based on a government announcement (e.g. an announcement that a company or individual is to be penalised for breaking rules or laws) which is later rectified (e.g. the individual or company is ultimately found to be innocent) correct the original republications. The scope is quite narrow as it applies to publications based on government announcements. However, the Xu Jieao v Sina case appears to suggest that it may be read broadly to have a wider coverage. In this case, the court determined that Sina, the defendant, infringed the plaintiff's reputational rights because it republished on its website a news report regarding the plaintiff's misbehaviour from a newspaper but did not make corrections after the newspaper publicly apologised for its misreport about the plaintiff.

Thirdly, the Provisions take a firm position against internet marketers (or, by another name, paid publishers). In a number of recent cases, online public relations companies have been paid to dissemble libellous information or to delete victims' statements to defend themselves against such information. The Provisions expressly provide that paid publishers and internet marketers will be held liable for libellous information jointly with those who hired them.

Calling for specific guidance

The Provisions were not designed to resolve all personal right infringement issues relating to information networks. Rather, the Provisions were promulgated to address only mature issues and those that require immediate attention. This means more systematic and comprehensive rules may follow after the courts have tried more cases involving online infringement of personal rights and information and, consequently, have managed to develop more helpful rules from these cases.

Firstly, although the Provisions attempt to clarify the scope of personal information, it does not fully address the issue about what, and to what extent, personal information is protectable. For example, the Provisions allow the use of personal information for public interest but fail to further elaborate on the scope of public interest. Further detailed rules need to be established on the boundary between public interest and personal life. The Provisions also exclude information in the public domain from the scope of protectable personal information. However, they do not clarify whether information incidentally released to the public domain is allowed to be spread further.

Secondly, the Provisions entitle a victim to bring a suit against an ISP, requesting the ISP to disclose the genuine identity of the personal rights infringer. However, it is not clear whether ISPs have the obligation or right to release information of personal identities when they are notified of the asserted infringement with prima facie evidence.

Thirdly, the Provisions provide only general guidelines on republishers' liabilities in relation to social media, which may need further explanation. Republishers are required to use due care in republishing articles according to their range of influence and the nature of the libel. However, the Provisions do not address issues such as what are the factors to be considered in determining the republishers' level of care; how to judge the overtness and foreseeable damages of the libellous information being republished; and whether, and to what extent, the republishers should rectify their republications when they know or ought to know their original republications are false.

Clamping down on online activity

The Provisions reflect the SPC's attempt to regulate activities on information networks and to address issues pertinent to the development of social media. Although they do not address all issues relating to personal rights or social media, they provide practical guidelines to regulate online activities.


Xun Yang, Simmons & Simmons, Shanghai


More from CLP:
Testing data privacy in the courts
Provisions on Several Issues Concerning the Application of the Law in the Trial of Civil Dispute Cases Involving the Utilisation of Information Networks to Infringe Personal Rights and Interests
Courts get tough on ISPs
Decision on Strengthening the Protection of Online Information
PRC Tort Liability Law
The need for strict data protection