One of the more dramatic privacy law developments in China in 2014 was the August criminal conviction of foreign nationals Peter Humphrey and Yu Yingzeng for their violation of Article 253 of the Criminal Law (刑法) associated with their unlawful purchase of Chinese citizens’ personal information. One of the more notable developments in 2015 is the amendment of Article 253 by China’s legislature, the National People’s Congress (NPC), in order to permit criminal prosecutions relating to a broader range of acts involving the unlawful disclosure or the unlawful procurement of personal information. The amended provision comes into effect November 1, 2015. This brief alert provides an overview of the changes to Article 253.

Article 253 of the Criminal Law as currently in effect imposes criminal liability on employees of government institutions and companies in the financial, telecoms, transportation, educational and medical sectors who sell or otherwise unlawfully provide to third parties any citizen’s personal information that has been obtained in the  course of employment or provision of services where the associated circumstances are “serious”. It also imposes criminal liability on any person who obtains that information by means of theft or other unlawful means—again, if the associated circumstances are “serious”. Punishment for breach of Article 253 as currently in effect includes prison terms or criminal detention of up to three years and/or a fine.

The amendment to Article 253 involves the following changes:

  • It introduces the broader offense of “selling or otherwise providing personal information of citizens to another in violation of State regulations”. Regarding that offense, it provides for a longer prison sentence of three to seven years, as well as a fine if the circumstances are “extremely serious”.
  • The scope of the current data privacy offense involving selling or otherwise unlawfully providing citizens’ personal information under Article 253 has been broadened. Criminal liability will attach to an employee of any organization, not just government employees and employees of companies in specified sectors, and will attach to enterprise offenders as well.  No longer are of serious consequences a constituent element of the offense, and punishment includes the heavier of the two levels of punishment relevant to the broader offense described above (prison term of between three and seven years, and a fine).
  • It creates a broader offense of “stealing or otherwise illegally obtaining personal data of others” that, unlike the analogous offense under Article 253 as currently in effect, is independent of the offense of selling or otherwise providing personal information obtained in the course of employment or provision of services. Serious consequences are not a constituent element of the offense, and punishment is the same as that applicable to the broader offense of selling or otherwise providing personal information as described above.

The absence of “serious” circumstances as a constituent element from two of the three offenses under the new Article 243 is potentially very material. It tends to suggest a legislative intent to broaden the circumstances in which criminal liability can be imposed under the two offenses to include situations where the effects of the act and other circumstances are less than serious. This increases compliance risk for companies and their employees regarding the handling of personal information collected in the course of business operations.

We note at the same time that the Criminal Law includes a general provision in Article 13 stating that “if the circumstances are obviously minor and the harm done is not serious, a particular activity shall not be considered   a crime.” There is some debate as to whether this Article 13 should apply to offenses under the Criminal Law that do not include “serious circumstances” as an element of the offense. We tend to believe that it should, and that if the defendant in a prosecution under Article 253 can show that no serious harm has been done and that the other circumstances are minor, there should be no liability. However, the issue finally lies with the discretion of the courts.