Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues concerning the Application of Law in the Handling of Criminal Cases of Infringing on Citizens' Personal Information

· Document Number：Interpretation No. 10 [2017] of the Supreme People's Court

· Area of Law： Constitution Criminal Law

· Level of Authority： Judicial Interpretation

· Date issued：05-08-2017

· Effective Date：06-01-2017

· Status： Effective

· Issuing Authority： Supreme People's Court Supreme People's Procuratorate

Announcement of the Supreme People's Court and the Supreme People's Procuratorate
The Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues concerning the Application of Law in the Handling of Criminal Cases of Infringing on Citizens' Personal Information, asadopted at the 1712th meeting of the Judicial Committee of the Supreme People's Court on March 20, 2017 and at the 63rd meeting of the Twelfth Procuratorial Committee of the Supreme People's Procuratorate on April 26, 2017, is hereby issued and shall come into force on June 1, 2017.
Supreme People's Court
Supreme People's Procuratorate
May 8, 2017
Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues concerning the Application of Law in the Handling of Criminal Cases of Infringing on Citizens' Personal Information
(Interpretation No. 10 [2017] of the Supreme People's Court, adopted the 1712th meeting of the Judicial Committee of the Supreme People's Court on March 20, 2017 and at the 63rd meeting of the Twelfth Procuratorial Committee of the Supreme People's Procuratorate on April 26, 2017, and coming into force on June 1, 2017)
For the purpose of lawfully punishing the criminal activities of infringing upon citizens' personal information, and protecting citizens' personal information security and legitimate rights and interests, in accordance with the relevant provisions of the Criminal Law of the People's Republic of China and the Criminal Procedure Law of the People's Republic of China, several issues concerning the application of law in the handling of such criminal cases are hereby interpreted as follows:
Article 1 “Citizens' personal information” as prescribed in Article 253A of the Criminal Law means all kinds of information recorded in electronic form or any other form, which can be used, independently or in combination with other information, to identify a specific natural person's personal identity or reflect a specific natural person's activities, including the natural person's name, identity certificate number, communication and contact information, address, account password, property status, and whereabouts, among others.
Article 2 Whoever violates the provisions of any law, administrative regulation or departmental rule on the protection of citizens' personal information shall be determined as “violating the relevant provisions of the state” as prescribed in Article 253A of the Criminal Law.
Article 3 Whoever provides any citizen's personal information to a specific person or issues any citizen's personal information through an information network or any other channel shall be determined as “providing citizens' personal information” as prescribed in Article 253A of the Criminal Law.
Whoever provides any citizen's personal information legally collected to any other person without the consent of the person whose information is collected shall fall within the scope of “providing citizens' personal information” as prescribed in Article 253A of the Criminal Law, except thatthe information has been processed in a manner that it is impossible to distinguish a specific person and it cannot be retraced.
Article 4 Whoever obtains any citizen's personal information by means of purchase, acceptance or exchange, among others, or collects any citizen's personal information during the performance of functions or provision of services in violation of the relevant provisions of the state shall fall within the scope of “illegally obtaining any citizen's personal information by other methods” as prescribed in paragraph 3 of Article 253A of the Criminal Law.
Article 5 Whoever illegally obtains, sells or provides any citizen's personal information and falls under any of the following circumstances shall be determined as a “serious circumstance” as prescribed in Article 253A of the Criminal Law:
(1) Selling or providing the information on the citizen's whereabouts which is used by any other person for committing a crime.
(2) Selling or providing the citizen's personal information to any other person when it or he knows or should have known thatthe other person uses such information to commit a crime.
(3) Illegally obtaining, selling or providing more than 50 pieces of information on the citizen's whereabouts, communication contents, credit investigation information and property information.
(4) Illegally obtaining, selling or providing more than 500 pieces of accommodation information, communication records, health and physiological information, transaction information and other personal information of the citizen that may affect his or her personal or property safety.
(5) Illegally obtaining, selling or providing more than 5,000 personal information of the citizen other than that as prescribed in items (3) and (4).
(6) Illegally obtaining, selling or providing the citizen's personal information in a total quantity calculated according to the corresponding proportion reaching the relevant quantity standards.
(7) Illegally obtaining an illegal income of 5,000 yuan or more.
(8) Selling or providing to the any other person the citizen's personal information obtained in the process of performance of functions or provision of services in a quantity or amount reaching more than half of the standards as prescribed in items (3) through (7).
(9) Illegally obtaining, selling or providing the citizen's personal information notwithstanding it or he had ever been given criminal punishment or been given any administrative punishment within two years for infringing upon any citizen's personal information.
(10) Any other serious circumstance.
Whoever commits any of the acts as prescribed in the preceding paragraph and falls under any of the following circumstances shall be determined as an “especially serious circumstance” as prescribed in paragraph 1 of Article 253A of the Criminal Law:
(1) Causing the death, serious injury, mental disorder or abduction of the victim or any other serious consequence.
(2) Causing heavy economic losses or adverse social impacts.
(3) The quantity or amount reaches more than ten times the standards as prescribed in items (3) through (9) of the preceding paragraph.
(4) Any other especially serious circumstance
Article 6 Whoever illegally purchases or accepts any citizen's personal information other than that as prescribed in item (3) or (4), paragraph 1 of Article 5 of this Interpretation for any lawful business activity, and falls under any of the following circumstances shall be determined as having “serious circumstance” as prescribed in Article 253A of the Criminal Law:
(1) Making profits of 50,000 yuan or more by utilizing the illegal purchase or acceptance of the citizen's personal information.
(2) Illegally purchase or accepting the citizen's personal information after it or he had ever been given any criminal punishment or been given any administrative punishment within two years for infringing upon any citizen's personal information.
(3) Any other serious circumstance.
Whoever commits any of the acts as prescribed in the preceding paragraph, and illegally sells or provides the citizen's personal information it or he purchases or accepts shall be convicted and sentenced according to the provisions of Article 5 of this Interpretation.
Article 7 Where an entity commits a crime as prescribed in Article 253A of the Criminal Law, the directly responsible person in charge and other directly liable persons shall be convicted and punished according to the corresponding conviction and sentencing standards for a crime committed by a natural person as prescribed in this Interpretation, and a fine shall be imposed on the entity.
Article 8 Whoever launches any website or communications group for committing the illegal or criminal activity of illegally obtaining, selling or providing any citizen's personal information, with serious circumstances, shall be convicted and punished for the crime of illegally using an information network in accordance with the provisions of Article 287A of the Criminal Law; and, where the crime of infringing upon citizens' personal information is constituted at the same time, it or he shall be convicted and punished for the crime of infringing on citizens' personal information.
Article 9 Any network service provider that refuses to perform the information network security management obligation as prescribed in any law or administrative regulation and refuses to take corrective actions after being ordered by the regulatory authority to take correction measures, causing the divulgement of any citizen's personal information and other serious circumstances shall be convicted and punished for the crime of refusing to perform the information network security management obligation in accordance with the provisions of Article 286A of the Criminal Law.
Article 10 Where any crime of infringe upon citizens' personal information committed by a person does not fall within the scope of “especially serious circumstance,” and it is the person's first offence, or the offender disgorges all illegal proceeds and truly shows repentance, it may be determined as a minor criminal circumstance, and no prosecution may be filed against the person, or the person may be exempted from a criminal punishment; where it is truly necessary to impose punishment thereon, the person shall be subject to lenient punishment.
Article 11 Where any citizen's personal information, after being illegally obtained, is sold or provided to any other person, the number of pieces of the citizen's personal information shall not be calculated repeatedly.
Where the personal information of the same citizen is sold or provided to different entities or individuals, the number of pieces of the citizen's personal information shall be calculated on an accumulative basis.
The number of pieces of citizens' personal information in batch shall be determined directly according to the number discovered and seized, except thatthere is evidence proving that the information is untrue or repetitive.
Article 12 In the event of any crime of infringing upon citizens' personal information, a fine shall be imposed thereon in accordance with the law by taking a comprehensive consideration of the hazards caused by the crime, the amount of illegal income involved in the crime, and criminal record and confession and repentance attitudes of the defendant, among others. The amount of a fine shall be generallynot less than the amount of nor more than five times the illegal income.
Article 13 This Interpretation shall come into force on June 1, 2017.