Discussed and adopted by the Judicial Committee of the Supreme People’s Court; issued on December 26, 2022.
Keywords
Criminal / infringement of citizens’ personal information / criminal case with incidental civil public interest litigation / facial recognition / facial information
Holding
Facial information processed using facial recognition technology, as well as facial information generated based on facial recognition technology, is highly identifiable and can identify a specific natural person’s identity or reflect a specific natural person’s activities either alone or in combination with other information, and belongs to citizens’ personal information prescribed by the Criminal Law. Where an actor, without the consent of the citizen concerned and without the lawful grounds for processing personal information prescribed by the Personal Information Protection Law such as authorization by law or relevant departments, uses software programs or other means to steal or otherwise illegally obtain the aforesaid information, and the circumstances are serious, the actor shall be convicted and punished pursuant to item 4 of paragraph 1 of Article 5 of the Interpretation of the Supreme People’s Court and the Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Infringement of Citizens’ Personal Information and other provisions.
Basic Facts
From June to September 2020, the defendant Li Kaixiang produced a mobile phone “hacker software” with the function of illegally stealing the photos in the installer’s photo album, packaged it into an Android “APK installation package,” published it for sale on the dark-web forum “Chama Gudao,” and disguised it as a “beauty detection” software and published it on the “Jiezi Forum” (later renamed “Kuaimao Community”) for free download by visitors. When users downloaded and installed the “beauty detection” software and used it, the “beauty detection” software would automatically obtain the photos in the mobile phone album in the background and automatically upload them to the Tencent Cloud server backend set up by the defendant, thereby stealing a total of 1,751 photos from installers’ albums, some of which contained more than 100 pieces of citizens’ personal information such as facial information, natural persons’ names, identity numbers, contact information, and home addresses.
In September 2020, the defendant Li Kaixiang saw a “hacker materials” post on the dark-web forum “Chama Gudao,” and then used part of the proceeds from his earlier sale of the “APK installation package” on the dark web to purchase and download data titled “social engineering database materials” and transfer them to the “MEGA” cloud drive. After viewing them himself, he confirmed that they contained real personal information. In February 2021, the defendant Li Kaixiang, knowing that the “social engineering database materials” contained household registration information, QQ account registration information, JD.com account registration information, vehicle owner information, loan information, and the like, still shared the drive link to the QQ group “Cuihu Manor Homeowners Exchange,” of which he was an administrator, and provided it to group members for free download. Upon appraisal, the “social engineering database materials,” after removal of invalid data and merger and deduplication, contained a total of more than 81 million pieces of various citizens’ personal information.
The Fengxian District People’s Procuratorate of Shanghai, on the ground that social public interest had been harmed, filed a criminal case with incidental civil public interest litigation before the Fengxian District People’s Court of Shanghai.
The defendant Li Kaixiang had no objection to the basic criminal facts and characterization charged in the prosecution, and voluntarily pleaded guilty and accepted punishment.
The defender argued that the defendant Li Kaixiang was a first-time offender, truthfully confessed his crime after being brought to the case, and voluntarily pleaded guilty and accepted punishment, and recommended a lighter punishment for the defendant Li Kaixiang and requested the court to apply probation to him. The defender further argued that the procuratorial organ had not verified the authenticity of the more than 81 million pieces of data involved.
Judgment
On August 23, 2021, the Fengxian District People’s Court of Shanghai, by Criminal Judgment (2021) Hu 0120 Xing Chu No. 828, determined that the defendant Li Kaixiang committed the crime of infringing citizens’ personal information and sentenced him to fixed-term imprisonment of three years, with a three-year suspended sentence, and a fine of RMB 10,000; the criminal instruments seized in the case were confiscated. Li Kaixiang was ordered to publicly apologize in state-level news media for his act of infringing citizens’ personal information, delete the “beauty detection” software and related code, delete the photos involved stored on the Tencent Cloud drive, delete the relevant citizens’ personal information stored on the “MEGA” drive, and cancel the QQ number used for the infringement. After the first-instance judgment, there was no protest or appeal, and the judgment has taken effect.
Reasoning
The court in its effective judgment held: The focal issue of the dispute in this case was whether the “facial information” stolen using the “beauty detection” software involved belonged to “citizens’ personal information” within the scope regulated by the Criminal Law. Upon trial, the court held that “facial information” belongs to citizens’ personal information prescribed in Article 253-1 of the Criminal Law, and that the act of using the “beauty detection” hacker software to steal “facial information” and other citizens’ personal information of software users belongs to the act of “stealing or otherwise illegally obtaining citizens’ personal information” in the Criminal Law, and should be punished in accordance with the law. The main reasons are as follows: First, “facial information” and other expressly enumerated types of personal information all have the obvious characteristic of “identifiability.” The Interpretation of the Supreme People’s Court and the Supreme People’s Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases of Infringement of Citizens’ Personal Information (hereinafter the “Interpretation”) enumerates the types of citizens’ personal information; although it does not separately enumerate “facial information,” it permits the determination of other forms of personal information beyond the enumeration in accordance with the law. The definition and express enumeration of citizens’ personal information in the Interpretation are consistent with the determination standards for citizens’ personal information in the Civil Code and other legal provisions, namely taking “identifiability” as the determination standard for personal information and emphasizing the possibility of direct or indirect identification between the information and the information subject. “Facial information” belongs to biometric information, which is unalterable and unique, and the face corresponds one-to-one with an individual natural person, so that a specific natural person’s identity can be directly identified without combining it with other information, and it has extremely high “identifiability.” Second, determining “facial information” as citizens’ personal information follows the principle of the unity of legal order. Antecedent laws such as the civil law protect “facial information” as citizens’ personal information. Article 1034 of the Civil Code prescribes the definition and specific types of personal information, and the Personal Information Protection Law further incorporates “facial information” into the scope of protection of personal information. Where infringement of “facial information” constitutes infringement of a natural person’s personality rights and interests or other infringements, the actor must bear corresponding civil liability or administrative or criminal liability. Third, stealing “facial information” using the “beauty detection” hacker software has great social harm and criminal punishability. Because “facial information” is sensitive information identifying a specific individual, and is also personal information with strong social attributes and convenient collection, it is easily directly used by others or produced or synthesized, thereby cracking facial recognition verification programs and triggering illegal acts such as infringement of privacy rights and reputation rights, and even criminal acts such as theft and fraud, with great social harm. The defendant Li Kaixiang manipulated the “beauty detection” software disguised as hacker software to steal users’ selfie photos and photos stored in mobile phone albums, exploiting the openness of internet platforms, targeting the unspecified public, with concealed, deceptive means and a wide scope of theft, having obvious social harm, and requiring regulation by the Criminal Law.
As to the defender’s opinion that the determination of the quantity of citizens’ personal information in this case was insufficiently based, the court held upon trial that the public security organ adopted the method of sampling verification during the investigation, randomly selecting part of the personal information for verification, which could confirm the authenticity of the personal information involved, and the defendant and defender likewise did not provide any clue or evidence that the information involved was untrue. The judicial appraisal institution removed invalid information and adopted the method of merger and deduplication for appraisal, detecting more than 81 million pieces of valid personal information. The quantity of citizens’ personal information charged by the public prosecution organ was objective and truthful, and conformed to the rules for determining the specific quantity of batch citizens’ personal information established in the Interpretation. Therefore, the defender’s opinion was not adopted.
In summary, the defendant Li Kaixiang, in violation of relevant state provisions, illegally obtained and provided citizens’ personal information to others, with especially serious circumstances, and his conduct had constituted the crime of infringing citizens’ personal information. After being brought to the case, the defendant Li Kaixiang truthfully confessed his crime and could be given a lighter punishment in accordance with the law, and he voluntarily pleaded guilty and accepted punishment and could be given lenient treatment in accordance with the law. Li Kaixiang’s infringing act of illegally obtaining and providing citizens’ personal information to others infringed the personal information security of numerous citizens and harmed social public interest, and he should bear corresponding civil liability. Accordingly, the court made the aforesaid judgment in accordance with the law.
Relevant Legal Provisions
Paragraph 1 of Article 253 of the Criminal Law of the People’s Republic of China.
Disclaimer: This translation is provided for reference and informational purposes only. In the event of any discrepancy, the official Chinese text issued by the Supreme People’s Court shall prevail. This translation does not constitute legal advice.
Free PDF download of the complete article.
