On August 8, 2014, a foreign couple was found guilty of the illegal collection of personal information by a court in Shanghai. British national Peter Humphrey was sentenced to two and a half years of imprisonment and a fine of RMB 200,000, and his wife was sentenced to two years of imprisonment and a fine of RMB 150,000. In addition, Humphrey will be deported after serving his term.

According to Chinese press reports, the defendants established a company in Hong Kong called ChinaWhys Co., Ltd. in 2003 and a company in Shanghai called Shelian Consultancy (Shanghai) Co., Ltd. in 2004. Using the names of these companies, the defendants conducted investigations on many companies and individuals for their clients, which mainly consisted of Chinese subsidiaries of multinational companies. For their investigations, the defendants purchased various types of personal information of Chinese citizens and used the information to prepare investigative reports, which they then sold to their clients.

This verdict, while newsworthy because of the involvement of foreign defendants, does not really break new legal ground in China. We have previously reported on amendments to the P.R.C. Criminal Law that established criminal penalties for improper sales, provision and collection of personal data. We also have reported on criminal sentences in actual cases involving sales of personal data. The legal theories and arguments advanced in this case are also well-established and do not stand in a grey area in China. For instance, the conduct of foreign-related social and market investigations is subject to strict regulations and the collection of personal information must be conducted carefully in order to comply with the law. In this case, the court rejected the legal argument that, although the defendants’ conducted their investigation legally for anti-bribery purposes, that legal purpose did not render their illegal investigation legal.

There are other ways, however, in which the verdict may break new ground or lead to new practices. This case is reportedly the first in China involving a foreign (or at least Western) defendant found guilty of illegal collection of personal information. It is also worth noting that the defendants were arrested in August 2013, not long after one of their prominent clients came under investigation by the Chinese government for alleged bribery. Reportedly, this case is merely a small part of that larger bribery investigation.

The verdict’s impact will be felt in business practices involving due diligence investigations, especially those performed for international firms. It also may cause apprehension among senior business officers who may think twice before considering this kind of service to obtain information about their business partners or employees. While the lasting impact of this verdict will most probably unfold over the coming months or years, old business models used by investigatory firms when hired to conduct due diligence have become far riskier than before, and now can only be employed, if at all, with great caution.