On May 8, 2017, the Supreme People’s Court (SPC) and the Supreme People’s Procuratorate (SPP) of China jointly promulgated the Interpretation on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Involving Infringement of Citizens’ Personal Information (”Interpretation“), which will become effective as of June 1, 2017.

The Interpretation, from its title, was introduced for the purpose of curbing the increasing number of cases where citizen’s personal information was infringed upon. It features detailed explanations for the once vague terms under the PRC Criminal Law, such as “personal information of citizens” and “providing citizen’s personal information”, as well as more clarified standards for the courts to measure penalties for infringing personal information crimes under the PRC Criminal Law.

In addition the Interpretation might indirectly impact the handling of internal investigations in the future. For example, the usage of individuals’ ID numbers may no longer be allowed if no prior consent has been obtained from the relevant employee.

Currently usage of ID numbers in an internal investigation is a grey area under Chinese law. Under Article 253.1 of the PRC Criminal Law, illegally selling or providing citizens’ personal information is subject to criminal penalties. From the wording, Article 253 does not seem to forbid a company from providing third parties with the ID numbers of its employees if they were collected via legitimate channels. Thus, in internal investigation cases the ID numbers of the target employees are often provided to lawyers or other third party agencies in order to assist with the identification of conflicts of interest, connecting the dots and drawing the relationship maps between certain employees and enterprises they are involved in.

However, pursuant to Article 3 of the Interpretation, even if the personal information such as ID numbers were legally collected, in the absence of the consent from the relevant individuals, one cannot provide such personal information to any third party anymore; otherwise Article 253.1 of the PRC Criminal Law would apply. Thus it is foreseeable that following the introduction of the Implementation, internal investigations will face a tremendous change, and the relevant service providers need to come up with alternative solutions/products to assist with investigations rather than sharing third party personal information.

On the other hand businesses should seek advice on how to best approach their employees as regards their consent for the usage of their personal information for “a to-be-defined” purpose (e.g. in Employment Handbooks, which are well accepted in China). Only when such consent has been obtained will the company potentially be able to make use of the personal information.