Personal data breach made criminal offense

China's top court on Thursday emphasized the need for stronger protection of personal information, urging judges to maintain a high-pressure crackdown on individuals who use technology and the internet to seriously violate the privacy and data security of others.

The Supreme People's Court said criminal penalties will apply in cases involving the illegal sale of facial recognition data or unauthorized access to home surveillance systems, as it released a set of illustrative cases.

In one case, a man surnamed Xu began purchasing facial images of around 130 individuals online in June 2021. He also acquired software used to bypass facial recognition systems and used the tools to unblock multiple online gaming accounts. In addition, Xu rented out the software and resold the personal data, earning 6,000 yuan ($835) in the process.

From August 2021, another man, surnamed Li, used the software provided by Xu to help others regain access to their blocked social media accounts by exploiting loopholes in facial recognition software. He made 30,000 yuan from reselling facial images and videos.

Xu and Li were sentenced to nine months and six months in prison, respectively, for infringing on personal information. Both were also fined, and their illicit profits, mobile phones and computers were confiscated.

"The verdict from the lower court demonstrates the judiciary's firm stance on protecting personal rights and serves as a warning to anyone seeking to illegally sell or provide facial recognition data," the top court said.

Wei Jingfeng, a lawyer with Zhongdun Law Offices, praised the ruling, saying it highlights the fact that facial recognition data is sensitive and requires strict protection. "Anyone who damages such information should be held criminally liable," he said.

He also urged stronger enforcement through criminal penalties, adding that harsher crackdowns could help prevent related crimes, including telecom fraud.

In cases where large volumes of personal information are leaked, illegally collected or sold, Wei suggested that prosecutors consider filing public interest lawsuits.

The call by the Supreme People's Court comes as China recently introduced a new set of security management measures to regulate the use of facial recognition technology and strengthen the protection of personal data.

Jointly released by the Cyberspace Administration of China and the Ministry of Public Security, the new measures took effect on June 1. They outline requirements for handling facial data, security standards for using the technology, and the supervisory responsibilities of relevant authorities.

Also on Thursday, the court referenced another case where a defendant was sentenced to three years and one month in prison after using software to illegally access passwords for 193 home surveillance cameras and take screenshots for personal use.

"With the increasing popularity of smart home devices, illegal attempts to gain control of them are rising, posing a serious challenge to citizens' privacy and information security," the court said.

The case, it added, reflects the courts' "zero-tolerance" approach to the illegal control of smart devices. Judges nationwide were urged to remain vigilant and hand down strong penalties in such cases.