On December 26, 2009, the Standing Committee of China’s National People’s Congress passed a landmark new law that contains provisions affecting personal data. The new law will go into effect on July 1, 2010.

The P.R.C. Tort Liability Law is a wideranging law that imposes tort liability for matters ranging from environmental damage to product liability to animal bites. Certain of its provisions relate, expressly or in a general sense, to personal information. These provisions can cause data users to incur liability to data subjects for the mishandling of personal information. In particular:

  • The law (at Articles 2 and 6) states a general principle that any person who infringes on and damages “civil rights and interests” of other persons shall assume tort liability. A right to privacy (???) is included in the list of the protected “civil rights and interests.” (There is, however, no further elaboration on precisely what this right to privacy consists of.) Other “civil rights and interests” that are listed in the new law, and that may be related to privacy and data protection, include rights to health, name, reputation, honor and portrait.
  • The law establishes the right of an injured party to proceed against an employer if its employees cause damages to other persons in the course of carrying out work-related tasks (at Article 34).
  • The law establishes the right of an injured party to proceed against an Internet service provider (“ISP”) that uses the Internet to infringe upon the civil rights and interests of another person, or that is aware that users are utilizing the ISP network to commit a tort and yet fails to take necessary measures (such as deletion, screening or disconnection) or fails to take necessary measures after receiving notice from an injured party and by this failure enlarges the damages (at Article 36).
  • The law requires medical institutions and their medical personnel to establish and keep various medical records, and to keep them private and confidential (at Articles 61 and 62). The law also establishes the right of an injured party to proceed against a medical institution and its medical personnel that disclose patients’ private matters or without a patient’s consent make public a patient’s medical records, and by doing so causes damages (at Article 62).
  • The law establishes the right of an injured party to proceed against a tortfeasor for mental distress, in situations in which an infringement on a personal right resulted in serious mental injury (at Article 22).
  • The law establishes the right of an injured party to proceed against a joint tortfeasor (at Article 8) and against someone who aids and abets a tortfeasor (at Article 9).
  • While the law does not establish any other specific right of action for mishandling of personal information, it nonetheless allows (at Article 3), as a general matter, a person whose rights have been infringed upon to ask that the infringing party assume tort liability.

In relation to personal information protection, the primary significance of the P.R.C. Tort Liability Law is that it establishes private rights of action in data subjects for mishandling of personal data. Previously, this was not always the case. Mishandlings of personal data currently could be construed as a violation of a fairly vague right to privacy arising under the P.R.C. Constitution, but the constitution never granted a private right of action in data subjects whose privacy rights had been infringed upon. While a few laws did grant private rights of action, others did not, or at least were not very clear on the matter. This new law, by making expressly clear that private citizens have a right to sue tortfeasors for damages, makes private suits for data breaches possible across the country, and may require data users to take into account the possibility of such private suits when planning their strategies and activities.

Besides this, another significance of the P.R.C. Tort Liability Law is that it construes data protection violations as a tort. We have remarked before that China’s lack of any deeply rooted cultural basis for a right to privacy, coupled with a commercial need to find a basis for enacting laws that protect personal information, invites it to look at many different bases for enacting laws governing the handling of personal information. This could result in confusion. By not having a single conceptual underpinning to justify and shape a law that protects personal information, China today appears embarked on a path of establishing an uncoordinated patchwork of laws, each of which touches on personal information protection in its own distinct way, in its own context and with its own particular objectives. This could make management of personal information protection issues in China a complicated affair.

In a separate development, in what is said to be the first court decision of its kind, a court in South China has handed down a criminal sentence for a violation of last year’s amendment of the P.R.C. Criminal Law involving violations of the security of citizens’ personal information. Reportedly, a man in Zhuhai illegally purchased a detailed log of telephone calls made by high-ranking local government officials, then sold it to fraudsters who used it to impersonate the officials over the telephone. The fraudsters convinced friends or relatives of the officials that the officials needed money for an emergency situation, and then they induced them to transfer money to a bank account controlled by the fraudsters. While the fraudsters were prosecuted for swindling, the man from Zhuhai was convicted for the crime of illegally obtaining a citizen’s personal information, which violated a newly added provision in Article 253 of the recently amended P.R.C. Criminal Law. This provision prohibits working personnel of particular organizations from selling or illegally providing citizen’s individual information to other persons, in violation of state regulations, and the illegal obtaining of such information by way of theft or other means, where the circumstances of the case are serious. The man from Zhuhai was sentenced to 18 months in prison and a fine of 2,000 renminbi.