Just days after their baby was born, the family received an unsolicited call promoting a "100-day baby photo session". What legal liabilities will those who profit from selling maternal and infant personal information face when such data is commodified?

[Case Review]

"Congratulations on your new baby! We are XX Studio for Children's Photography, and we've prepared a customized at-home 100-day photo package for you¡­" While Mr. Gu and his family were still immersed in the joy of welcoming a new life, they received a string of unsolicited calls. Mr. Gu grew increasingly puzzled: the baby had only just been born, yet the caller seemed to know his wife¡¯s name, phone number, and even the time of birth. Mr. Gu promptly reported the incident to the police. Upon investigation of the children's photography company involved, law enforcement uncovered a shocking black-market operation trafficking in maternal and infant personal information.

Wang [full name withheld], an administrative clerk assigned by a maternity maid service company to a hospital, colluded with Liu [full name withheld], another clerk at the same company's head office, to seek illegal profits. Wang sold the maternal and infant personal data she had collected to a photography studio. According to statistics, over a span of three years, Wang and Liu illegally sold nearly 40,000 records of maternal and infant personal information at a price of CNY 5 to CNY 8 per record, generating unlawful profits exceeding CNY 310,000. Liu received over CNY 160,000 in illicit gains. After being apprehended, both Wang and Liu fully confessed to the above criminal acts. The People's Procuratorate filed a public prosecution with the People's Court, accusing the two defendants of the crime of infringing upon citizens¡¯ personal information. As this case concerns not only the privacy and security of personal information, but also the public interest of society, the Procuratorate also filed a civil public interest lawsuit with criminal charges.

Upon trial, the court found that the defendants, Wang and Liu, had violated relevant state regulations by selling citizens' personal information to others. The circumstances of the offense were particularly serious, and their conduct constituted the crime of infringing upon citizens' personal information. They should be punished according to law. During the trial, both defendants voluntarily surrendered all illicit gains and paid fines in advance. They demonstrated remorse, and therefore may be given a mitigated punishment and granted suspended sentences at the court's discretion. Taking into full consideration the facts of the case, the degree of social harm, the defendants' subjective malice, the number of records sold, and the amount of illegal profits, the court sentenced Wang to three years of fixed-term imprisonment, suspended for three years, and imposed a fine of CNY 160,000. Liu was sentenced to three years of fixed-term imprisonment, also suspended for three years, and fined CNY 170,000. In the criminal case with an attached civil public interest litigation, the two defendants were held jointly liable for public interest damages totaling CNY 310,000. They were ordered to permanently delete all illegally collected and stored personal information of citizens and to issue a public apology in national-level news media.

[Judge's Remarks]

I. Lawfully cracking down on the crime of infringing upon citizens' personal information

Citizens¡¯ personal information refers to all kinds of information recorded electronically or by other means that can individually or in combination with other information identify a specific natural person or reflect the activities of a specific natural person, including name, identity card number, means of communication and correspondence, address, account password and other kinds of information.

The maternal and infant personal information disclosed in this case included key identifying elements such as the parents' names, contact details, and the newborn's date of birth. This information was sufficient to identify a specific newborn and their parents, and therefore falls within the scope of citizens' personal information protected by law. The defendants, Wang and Liu, violated relevant national regulations by illegally selling or providing to others the citizens' personal information they had collected in the course of performing their duties. The volume of information sold and the amount of unlawful gains both met the threshold for the crime of infringing upon citizens' personal information and should be subject to criminal penalties.

II. Civil liability for infringement of citizens' personal information

The illegal disclosure of citizens' personal information causes anxiety and distress to the general public. It not only infringes upon individuals' right to privacy and disrupts their peaceful daily lives, but also undermines the public's sense of security and trust, thereby falling within the scope of social public interest.

Through the criminal case with an attached civil public interest litigation, this case not only pursued the defendants' criminal liability but also required them to bear civil liability by issuing a public apology and compensating for the damage to the public interest. This dual deterrent against the illegal acquisition, sale, or use of citizens' personal information strengthens the judicial protection of the maternal and infant population, safeguards the personal rights and interests of women and children, and upholds the public interest.

III. Jointly strengthening the protection network for personal information

The processing of personal information must adhere to the principles of lawfulness, legitimacy, and necessity. Relevant enterprises shall assume the responsibility of safeguarding citizens' personal information. When performing contracts or providing services, they must ensure that the personal information processed is directly related to their business operations. At the same time, enterprises should enhance management measures concerning access to clients' personal information and data encryption, establish mechanisms for risk warning and emergency response, and strengthen internal systems for educating employees on personal information protection, so as to prevent the unlawful leakage of citizens' personal information caused by poor management or internal loopholes. On the other hand, relevant authorities should reinforce regulatory mechanisms within the industry, promote the implementation of special rectification initiatives, and urge non-compliant enterprises to undertake corrective measures, thereby continuously forming a joint force for protection.

 [Representative Comments]

Cao Huifang, Deputy to the Shanghai Municipal People's Congress, Director of the Department of Internal Medicine and Director of the Department of Respiratory and Critical Care Medicine, Shanghai Jing'an District Central Hospital

In the digital age, as internet technologies continue to develop and become widely applied, the risks of personal information being leaked, stolen, or misused are growing, and this has become a pressing social issue. The security of maternal and infant personal information is of core importance to countless families and is a "top priority" in the protection of medical and health data. Once such information is leaked, the consequences can range from intrusive commercial marketing to serious illegal activities such as telecom fraud, and may even pose direct threats to the safety of women and children.

This case directly targets the rampant trade in maternal and infant personal data. By imposing both criminal and civil public interest liabilities through judgment, it addresses risks to public information security. The court not only imposed criminal penalties on the offenders but also ordered civil remedies such as public apologies and compensation for economic losses. This integrated approach to punishing crime, restoring public interests, and educating the public is of exemplary significance and serves as a powerful warning. Recommendations: Relevant enterprises should shoulder their primary responsibilities, strengthen education, supervision, and access control over personnel handling sensitive data, promote cross-departmental cooperation, carry out industry-specific rectification initiatives to eliminate risks of data leakage, and continuously raise public awareness of information leakage and the importance of safeguarding their rights. Only by building a comprehensive protection network that combines "strict legal penalties, corporate self-discipline, joint regulatory efforts, and public participation" can we effectively safeguard citizens' security at their fingertips and foster a safe and trustworthy digital living environment.

[Legal Provision Reference]

I. Article 253(1) of the Criminal Law of the People's Republic of China Whoever, in violation of relevant state regulations, sells or provides citizens' personal information to others and the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also or solely be fined; where the circumstances are particularly serious, a sentence of not less than three years but not more than seven years shall be imposed, along with a fine. Whoever, in violation of relevant state regulations, sells or provides to others the personal information of citizens obtained in the course of performing duties or providing services shall be given a heavier punishment in accordance with the provisions of the preceding paragraph. Anyone who steals or illegally obtains citizens¡¯ personal information by other means shall be penalized in accordance with the Article 253(1). Where a legal person or organization commits any of the crimes mentioned in the preceding three paragraphs, a fine shall be imposed on the entity, and the person directly in charge and other directly responsible personnel shall be punished in accordance with the provisions of the respective paragraphs.

II. Article 111 of the Civil Code of the People's Republic of China A natural person's personal information is protected by law. Any organization or individual that needs to access other's personal information may only do so in accordance with law and guarantee the safety of such information, and may not illegally collect, use, process, or transmit other's personal information, or illegally trade, provide, or publicize such information.