From “Rational Indifference” to Filing a Lawsuit:

One Year After the New Law was put in Effect, Is it Easier for Ordinary People in China to Protect Their Privacy?

Edited by Lin Jiang and published at Southern Metropolis Daily, Nov. 2, 2022

"Is there such a thing as privacy in modern times?" Upon receiving unwanted phone calls and text messages, people frequently pose this helpless inquiry.

Everyone runs the risk of having their private information exploited or exposed. Since it went into effect on November 1, 2021, the Law of the People's Republic of China regarding the Protection of Personal Information (short for "PIPL") has drawn a lot of attention.

Is it now simpler for ordinary people to protect their rights after a year? Plaintiffs and attorneys provide affirmative responses. The case numbers are increasing in which "big firms" have lost to "small users".

However, both enterprises and law enforcement agencies are bewildered by a lack of specificity, some experts noted. It is said that no business can achieve 100% compliance with the PIPL, and "gray compliance" becomes a common practice. Additionally, law enforcement is often inclined to employ pertinent old rules rather than the new law.

Protection widened by abandoning the concept of “privacy”

A year ago, when the PIPL came into force, Luo Yi was anxiously waiting for the last hearing for his judicial case.

Early in 2021, he was startled by two short ringtones. Advertisement messages from 51talk, an English learning app, were sent to both of his cell phone numbers at almost the exact same time. Luo Yi had never heard of the name, nor had he ever visited or clicked on any English learning websites.

This unusual episode troubled him. Had his cell phone number been sold on the black market? The text further upset him since, unlike the other marketing texts, it claimed to have created a new account for him and issued a password. "My personal information is being used without my consent."

As a former law student, Luo Yi consulted his old classmate Ma Ce, who is now the founding partner of Zhejiang Kenting Law Firm. They decided to sue the company for infringement of privacy and personal information rights, following the Civil Code provisions—legislation that existed before the introduction of the PIPL.

The case had been filed in January 2021. After six court appearances, the first instance ruling was rendered over a month after the new law went into effect.

"We observe a particularly interesting phenomenon: whether the PIPL is in force or not, the court frequently refers to it. Or it might want to delay the decision until the new law is in effect. All courts have the incentive to handle the first case." said Ma Ce.

Although the PIPL is not directly applicable to this case, its definition of legal concepts and the spirit of pertinent standards can be utilized as a guide, according to the judgment of the first instance (which has not yet come into action).

For instance, whereas the PIPL defines the extent of "personal information" from the standpoint of "association", the Civil Code defines it from the perspective of "identity". In the debate over whether user profiles are personal information, the court cited both definitions. The new law was also used by the court to explain what constitutes "informed consent" and "lawful consent".

The defendant corporation was ordered by the court to stop processing and delete Luo's personal information, including his cell phone number, user portrait, account password, and others, as well as to apologize and cover Luo Yi's expenses. 51 talks appealed, and the second trial has not yet started.

In another case Ma Ce represented, the court went beyond merely "referring" to the PIPL and really "applied" it, given that legal circumstances persisted after the new law took effect. The court denied the defendant company's claim of "non-retroactivity", holding that the application might more fairly balance the rights and obligations of both sides.

For instance, one of the plaintiff's claims was to know who the defendant's platform shared her personal information with. According to Article 23 of the PIPL, "the processor shall inform the individual of the recipient’s name, contact information, the purpose and way of processing, and obtain individual consent". Therefore, the court agreed with the plaintiff's allegation.

It is worth noting that the aforementioned provisions have never been similarly expressed in other laws or regulations. "(The PIPL) is an evolved version of the previous law." Zhou Hanhua, deputy director of the Institute of Law at the Chinese Academy of Social Sciences, told CCTV. The new law abandons the concept of "privacy" to extend protection to all personal information, reflecting the pressing need in the contemporary digital era.

It can be simpler for people to defend their rights under the PIPL than under the Civil Code, claims Ma Ce, taking the case of Luo Yi as proof. When applying laws, he felt “split” for only the new law covered situations like “separate consent”. For those who are interested in establishing their rights to personal information, he believes, it "must give some new insights".

Luo Yi also noted that the new Law is "more precise" in comparison to other laws and regulations, which makes it simpler for ordinary people to understand. He believed that the protection of personal information has improved since the inception of new Law.

Evidence is essential, but it can slip away

"Don’t log in. Wait until I get here!" This was the first thing Ma Ce told Luo Yi on the phone.

Otherwise, it can be difficult to replicate the evidence. Ordinary users often face a certain level of challenge when gathering proof. Many crucial product scenes, such as tab selection pages and agreement pop-up windows, may vanish after the initial login.

"The judge must ask: what if you registered it yourself?" An ordinary individual may not fully understand what proof he needs to keep, according to Luo, if he acts without the help of lawyers. Ma added that one of the main factors in the first trial's success was the thorough and sufficient collection of evidence.

"The right to personal information is often violated in a flash, or beyond people’s awareness," said Guo Bing, Distinguished Associate Professor of Zhejiang Sci-Tech University. Finding where the leakage happened and efficiently fixing the infringement are both challenging tasks.

In August 2021, Guo Bing instructed students to sue Hangzhou Lakeside Intime Department Store for unlawfully recording and using customer faces for business purposes. The court of the first instance, however, rejected the pupils' claims due to a lack of supporting evidence.

Typical consumers would not have had access to the evidence if the technology provider had not willingly given it, sighed Guo. In this regard, both the legislation and the Supreme Court's legal interpretation have demanded proof from the defendant. In his view, as compared to the pertinent civil code, this is the new law’s progressive part.

In July of 2022, Guo directed his students to file an appeal in the aforementioned case. They claimed in the appeal that only staff could know how personal information was processed because of the obvious information asymmetry with facial recognition technology. As a result, the information processor should be responsible for carrying the burden of evidence.

Guo sees the Law's establishment of a public interest litigation system as another advancement. Customers can file complaints with the appropriate department, and "you genuinely do not need to have sophisticated legal knowledge".

On the day the new law took effect, the Hangzhou Internet Court held two hearings concerning personal information, one of which was a public interest lawsuit to protect the rights of an undetermined majority of people. After the introduction of the new law, public interest litigation may be applied mainly to related disputes in the future.

More than 2,000 public interest litigations of personal information were handled by the procuratorial organs in 2021, a nearly threefold increase from the previous year, according to the Supreme Procuratorate. The number is up to 700 in the first quarter alone in 2022. However, the practice of public interest litigation was only a "bonsai" but not a "landscape", said Guo Bing.

Following the new Law, numerous public interest lawsuits have been filed one after another, but more precise provisions in the judicial interpretation that supports them are required.

Civil litigations “arduous but fruitless"

One of the distinctive features of the personal information protection field is that you seem to see or hear a lot of complaints about the ignorance of personal information rights, but only a small percentage of these persons choose to bring a case.

Civil litigation in the field of personal information protection is significantly less than criminal litigation. In 2022, for example, the keyword "personal information" on the Judicial Instrument website yields 229 criminal judgments and yet only 79 civil judgments, less than half of the former.

"This is a unique phenomenon: a criminal crackdown surges to the fore, and there are few private interest litigations filed by persons whose own rights and interests are seriously jeopardized." said Guo Bing, "an ideal rule of law environment should prioritize civil litigation (including public interest litigation), with criminal means coming last as the most severe consequence."

What caused this to occur? He observes that protecting personal information rights is frequently "arduous and fruitless".

"Many of my friends and even netizens may consult me and complain when their personal information rights are abused, but not many individuals will formally go through legal measures to obtain a statement." Guo Bing shares most people's concerns, stating that when he goes to "start a fight", he also worries about major tech corporations taking revenge. "'Rational indifference' may also be an understandable option."

Personal information violation, on the other hand, is frequently "micro" -- without direct loss or impossible to calculate. To yield good economic returns from a lawsuit, the scope of the loss must be clarified; otherwise, ordinary people may lack adequate incentive.

Nonetheless, Guo Bing is pushing the public to defend their rights by personally participating. "We must not be silent. We have every right to protest and provide criticism." "If that's the case, I feel our personal information protection should get stronger and better," he remarked.

To date, only a dozen cases under the new law have been concluded and are available on the Judicial Instrument website.

Guo Bing was also aware of the phenomenon. He further emphasized that there are few administrative penalties directly applied to the new law, and even fewer have resulted in severe consequences, such as fines or even commercial operations stoppage.

Since there is no specific regulating agency for the PIPL, "applicable concurrence" commonly occurs. The administrative organs may select one from the new law and the statute protecting consumer rights, for instance. For their protection, they typically adhere to the older, more well-established laws, even though the new law permits harsher penalties.

This observation can be verified by some regulatory department employees. "They fear that they may face legal challenges or that their actions will sway the public, considering that this law does not explicitly state that they have such an obligation."

The new law is still maintaining a multi-departmental law enforcement system, according to Zhou Hanhua. It's still "nine dragons ruling the waters" (which are likely to fight against each other). Hopefully, a department dedicated to personal information protection can be developed through ongoing system improvement.

“Grayscale compliance” becomes a common practice in business

It is noteworthy that sizable Internet platforms have stirred more worries over the past two years, among the disputes involving personal information. Since it was founded in 2018, the Guangzhou Internet Court has handled 89 cases of personal information protection conflicts, 66% of which were brought by Internet platforms.

Plaintiffs brought lawsuits because their personal information was unlawfully obtained, disclosed, or exploited, or because the platforms did not adequately address their reasonable requests. Numerous everyday usage scenarios are covered, such as tailored advertising, copying of personal information, friend recommendations, and others.

Ma Ce, a former platform attorney, is aware that businesses are reluctant to be named as the defendant in such cases. In the great majority of personal information cases, businesses often lose. However, head enterprises do have an unavoidable social obligation to serve as role models for society.

"Being a defendant can be advantageous. It doesn't have to be uncomfortable, oppressive, or bad. " He remarks. Due to the "advantage of the first mover", the first company being a defendant can take the initiative in encouraging the internal compliance adjustment. Other businesses can only ask them for first-hand details.

According to Ma Ce, all significant businesses have gray compliance. It is challenging to raise standards when there are ambiguities in the legislation and when a compliance method is widespread in the marketplace.

In truth, it is not the case that businesses do not wish to comply with regulations, but rather that there is a buffer zone or even a gap between the regulations and practice that necessitates collaborative efforts to bridge.

Companies aren't the only ones concerned about stirring up public sentiment; the more media coverage a lawsuit receives, the more pressure there will be on the court.

"Sometimes judges worry over pretty basic situations to me," Guo Bing stated that judges are more cautious given the societal impact and the lack of established instances for guidance.

Personal insurance legislation only offers principles for many contentious issues, which is a challenging issue that courts and law enforcement authorities must deal with. When is a person's consent not need to be obtained? What should be done with delicate personal information? All need to be further clarified.

Ma and Guo agree that the Personal Protection Law has improved court practice in the year after it was put into effect. But certain regrets remain.

"The teeth of it have already developed. But it hasn't moved on to carry out its crucial task." Said Guo Bing.

In terms of administrative oversight, for instance, the personal protection law stipulates severe penalties, including fines of up to 5% of the previous year's revenue, yet there are only a few instances of truly severe administrative sanctions, such as Didi Taxi.