Customers wary of data collected by QR codes

As ordering by scanning a QR code becomes increasingly widespread in the catering industry, experts are urging businesses to properly protect and use consumers' personal information.

Requiring customers to scan QR codes for subscription and personal information is a common way to infringe on consumers' rights, and many netizens have complained about the method with the approach of World Consumer Rights Day, which fell on Friday.

When consumers use a QR code to order, they often need to follow the official account of the business on WeChat and authorize a login to a mini-program. As a result, consumers' personal information can be obtained by the business.

In one case, a plaintiff surnamed Kong and his friends visited a restaurant, where the waiter informed them to use a QR code to order. After following the restaurant's WeChat account, a miniprogram for ordering appeared and required him to authorize it to use his login account information such as nickname, avatar, region, gender and phone number before entering the order page.

Believing the process forcibly obtained his personal information, Kong tried to unfollow the restaurant's official account but failed, and his information continued to be stored by the restaurant. He later sued the catering company.

Kong stated that he tried to cancel his membership in the catering company to delete his personal information, but failed.

The company argued that deleting member information required consumers to submit a written application at the restaurant.

The court ordered the company to delete all personal information collected from Kong, provide him with a written notice of the purpose, method and scope of collecting his information, issue a written apology and compensate him for corresponding economic losses, including a notarization fee of 5,000 yuan ($695).

Cai Rui, an assistant researcher from the Civil Law Research Office at the Chinese Academy of Social Sciences, said that when setting up a QR code, businesses should not overlook consumers' rights to make autonomous choices and be informed. The Personal Information Protection Law stipulates that businesses must obtain consent from individuals to process personal information, and they cannot refuse to provide services on the grounds of an individual's refusal.

Given that many businesses' QR code mini-programs are provided by third-party technology companies, which also obtain consumer personal data through QR code scanning, consumers also face risks of data leakage, spam messages and fraud.

Zhu Wei, deputy director of the Communications Law Research Center of China University of Political Science and Law, said that in some cases, scammers know where you had a meal, and they can call you and offer a refund with a link. Initially, consumers may not believe such scams, but because the scammers know your purchase information, consumers may believe the refund is genuine, and end up being cheated.