Special Disclaimer: This article is an original work by Attorney Shao Shiwei. It reflects only the author’s personal views and does not constitute legal advice or a legal opinion on any specific matter. For article reprints, legal consultations, or business exchanges, please add: sswls66
Successful criminal defense is invariably the reward for steadfastly adhering to sound judgment, selecting the optimal strategy and methods, and persevering through prolonged periods of helplessness or even despair.
In 2023, a loan-assistance company was accused of the crime of infringing citizens’ personal information. The company came under investigation in February 2023, and the police promptly issued extensive press releases online.
“(Screenshot of publicly reported content from the Shanghai Police press release)”
Attorney Shao has handled numerous criminal cases in which corporate involvement led to the arrest of employees. For example, many young job seekers today join a financial company that publicly assures clients that its projects are lawful and compliant and that all required qualifications and licenses are in place. After onboarding, employees also observe that the company indeed possesses the relevant documents and licenses. In such circumstances,how can ordinary employees identify whether their employer is suspected of engaging in illegal or criminal conduct?
Moreover, there is a significant information asymmetry between employees and the company. Employers do not disclose everything; they merely assign employees to carry out specific execution tasks. Information asymmetry also exists across departments; for instance, the administrative department may not have a thorough understanding of the specific operations of the sales or business departments.
Absent sufficient legal knowledge and a high degree of vigilance, and given that peers in the same industry have been conducting similar business practices for years, would employees perceive their own conduct as criminal? Thisis exceedingly difficult.。
The circumstances of the present case are similar.
After Attorney Shao intervened during the public security investigation stage and conducted a comprehensive review of the facts on record, he found that the current case posture was highly unfavorable to our side:
1. The company had substantialThe buying and selling of personal information is a factual matter, and the company's profits from this activity over just a few short years have been astonishing.
2. This was the client’s first encounter with such circumstances. When police officers unexpectedly arrived at the client’s home to make an arrest, the client, in a state of confusion and panic, made numerous statements to the public security authorities that were adverse to the client’s interests and not factually accurate.
3. Drawing on Attorney Shao’s experience in handling cases,the Shanghai jurisdiction has consistently applied stringent standards in determining liability for the crime of infringing upon citizens’ personal information(see “A Comprehensive Analysis: Big Data Insights and Typical Cases on the Crime of Infringing Upon Citizens’ Personal Information”). Therefore,for identical case circumstances, while a suspended sentence might be imposed in other regions, there is a significantly higher likelihood of an actual custodial sentence in Shanghai.。
If the company is found to have committed the offense, a conservative estimate is that the client would receivean actual custodial sentence of less than two years.Accordingly, after accepting the engagement, I felt considerable pressure.
Although the employee acted in an agency capacity, if the company is found to have committed a crime, the employee will inevitably bear liability. Therefore, the defense strategy must be approached holistically, conducting a compliance review of all of the company’s business and operational activities to identify all defense arguments favorable to the company.
Only by saving the company can my client be saved.
After establishing the basic defense strategy, I began to systematically carry out defense work, thoroughly investigating and verifying all evidence favorable to both my client and the company,engaging in multiple rounds of communication and argumentation with the handling prosecutor to demonstrate that the company’s conduct did not constitute a crime, and submitting a legal opinion exceeding ten thousand words.。
Ultimately, we successfully persuaded the procuratorate to return the case to the public security organs,whereupon the public security organs dismissed the case, resulting in findings of no criminal liability for both the company and its employees.。
Below is the legal opinion drafted by Attorney Shao in relation to this case, provided for the purpose of professional exchange among peers. (To protect the privacy of the parties involved, substantial portions of the original document have been redacted. Reproduction without permission is strictly prohibited.)
Legal Opinion on the Case of XX for Alleged Infringement of Citizens’ Personal Information
Author: Attorney Shiwei Shao
01
Relevant Facts of the Case
Shanghai XX Co., Ltd. (hereinafter referred to as the “Company”) was established on [Month] [Day], 20XX. The shareholders and legal representative of the Company were [...]. On [Month] [Day], 201X, the legal representative of the Company was changed to [...].
Around [Month] 201X, [...] held the position of XX, with a monthly income of more than RMB XX. The main job responsibilities included:
1. Business development (accounting for x% of job responsibilities): Contact offline intermediary loan-assistance agencies and enter into cooperation agreements with such companies, referring user information of individuals with loan needs to them;
2. Operations (accounting for x% of job responsibilities): After contract execution, handle communications with partner institutions and screen user information;
3. Provide personal bank cards to the company for the purpose of receiving company funds.
In [Month] 201x, B joined the company. B held the position of Head of the Operations Department, with a monthly income of more than RMB xx. The main job responsibilities were as follows:
1. Online promotion services (accounting for x% of job responsibilities; see Evidence List for details: cooperated with companies such as [Company Name] to place advertisements for such companies and earn advertising revenue; cooperated with [Company Name] to earn promotion revenue of [Amount]);
2. Responsible for processing refunds of the RMB xx membership fee to users (accounting for x% of job responsibilities);
3. Occasionally contact relevant offline intermediary loan-assistance agencies and enter into cooperation agreements with such companies (accounting for x% of job responsibilities), referring user information of individuals with loan needs to them.
The company's business activities are categorized into three types:
1. Online promotion services, duration: from 201x to [Month] [Day], 202x (the date when the case was filed for criminal investigation);
2. Offline loan-assistance services, duration: from [Month] 2022 to [Month] 202x (based on the creation time of personal information in the SaaS system);
3. Collection of RMB xx membership fees, duration: from [Month] 202x to [Month] [Day], 202x;
Among these, the online promotion servicesSince the Company’s establishment to the present, this has consistently constituted its principal business. All other business activities have been of relatively short duration.
Within the case file, Employee XX provided the Company’s business statistics table, which indicates that the loan-assistance institutions handled by B numbered only X (namely: …), while all remaining clients were introduced by XX.
02
I. The Company and Its Employees Do Not Commit Any Crime
1. The Company’s Principal Business: Online Promotion
Since the Company’s establishmentto the present, its principal business has consistently been online promotion, a line of business primarily managed by XX.
The specific activities comprising the online promotion business are as follows:
a. Liaising with partner companies to list their applications on the Company’s application, charging advertising fees to such partner companies based on the number of user clicks; or, where users successfully obtain loans after downloading a partner company’s application via the Company’s application, receiving service fees from the partner company;
b. Liaising with partner companies to list the Company’s application on the partner companies’ applications, paying advertising fees to such partner companies based on the number of user clicks;
c. Cooperating with XX Company to obtain promotional revenue from XX.
None of the foregoing business types involve the collection of users’ personal information. The Company’s online promotion business transmits information to potential users through lawful channels and methods, and attracts users to visit the relevant apps or webpages. Such business activities do not violate applicable laws and regulations, nor do they infringe upon the legitimate rights and interests of others.
As apps developed by the Company only in [Month] 202x, “Product A” and “Product B” have primarily functioned for online promotion purposes. These two apps are not specifically designed to collect users’ personal information.
It is understood that, apart from the revenue obtained by pushing user information with loan needs to offline institutions, the aforementioned online promotion business accounted for 100% of the Company’s revenue in its early stages, and later decreased to approximately xx% starting from [Month] 202x.
2. The offline loan facilitation business is merely one of the Company’s many business types and has existed for a very short period.
(1) The loan facilitation business itself does not violate legal provisions.
The Company’s business model is as follows: the Company connects users with loan needs on one end and partner companies capable of providing loan support on the other, offering loan facilitation services to match the two parties. “Loan facilitation” refers to providing support and assistance to the lending business of loan-reviewing institutions; this business activity itself is not illegal. The Company charges an intermediation and matching service fee.
The specific manifestation is as follows: Users download the “Product A” and “Product B” apps and provide their name, ID number, contact information, and other details. The Company then contacts the partner companies, which determine whether the users qualify for loans.
(2) The Company has implemented strict risk control measures.
2.1 The sources from which the Company collects information are lawful.
Through online promotion channels, the Company enables users with loan needs to download its two apps. Before users register as members, they are presented with the relevant user agreements on the apps (including the User Registration Agreement, Privacy Policy, User Authorization Agreement, and User Security Sharing Agreement).
Although the detailed contents of such agreements are not listed in the case file materials, generally speaking, such user agreements state that, to increase the chances of users’ loan applications being approved, the platform will share relevant user information with partners, who will provide loan services. Furthermore, according to A, the user agreements of the APPs referenced and drew lessons from the Rong360 APP (a well-known fintech company); therefore, it can be inferred that the Company’s user agreements are relatively standardized.
Users check to agree and register, and voluntarily fill in their personal information, which constitutes a disposition of their own rights. The Company’s provision of such information to partner companies serves the users’ loan needs and does not constitute unlawful use.
2.2 The Company’s methods of collecting information are lawful.
According to Volume X, the personal information stored by the Company was voluntarily provided by users. Information regarding users’ real estate and vehicle ownership is recorded only as “yes/no,” and the accuracy of such information requires further verification by partner companies.
As evident from Volume X, the Company’s app merely requires users to select options within the app; it does not require users to upload any personal documentation (such as ID card photos, bank statements showing salary transactions, or proof of assets).
2.3 The Company has fulfilled relatively stringent formal review obligations regarding the qualifications of its partner companies.
Prior to executing agreements with partner companies, the Company requires them to provide business licenses, legal representative ID cards, store videos, qualification information, and other documents. The Company also requires partner institutions to issue letters of commitment, pledging to “protect customer privacy, refrain from collecting data unrelated to the services provided, and ensure that the qualifications for listing their products are lawful,” among other things. By fulfilling its formal review obligations, the Company ensures that user information is not used for illegal purposes other than loan facilitation.
2.4 The Company employs technical measures to protect the information it provides externally and has not committed the crime of infringing upon citizens’ personal information as defined under the Criminal Law.
The Company and its partner companies use a SaaS system to transmit user information. In the personal information pushed by the Company, ID numbers and names are desensitized, and all user information is automatically deleted from the entire SaaS system after 48 hours. Furthermore, partner companies can only view, but not download, user information on the SaaS system.
The Company established its own technical team to develop its app and SaaS system, rather than opting for lower-cost outsourcing, specifically to protect user data and ensure cybersecurity.
User information is stored on XX Cloud based on the Company’s operational considerations, facilitating the identification of registered and unregistered users. Generally, a user’s financial status does not change significantly in the short term. If the same user registers repeatedly within a short period (with a significant portion providing false information), even if the Company pushes such user’s data to partner lending institutions multiple times, it will not substantially alter the user’s loan limit. If the Company fails to identify such users as already registered and repeatedly pushes their data to partner companies, it provides invalid information to partners, which is detrimental to the development of their cooperative relationship.
“Citizens’ personal information” refers to various types of information that can identify a specific natural person or reflect the activities of a specific natural person, including names, ID card numbers, addresses, account passwords, etc. The “citizens’ personal information” referenced in the crime of infringing upon citizens’ personal information should be limited to information involving personal privacy, the infringement of which would pose significant risks to the personal and property safety of citizens. Judicial review of its scope, categories, and quantity should be strictly construed. Clearly, based on the evidence in the case file, it cannot be determined that the information provided externally in this case constitutes personal information.
2.5 Finally, the Company operates in compliance with laws and regulations, engages solely in loan facilitation without issuing loans, and has never engaged in false advertising to deceive users.
According to the victim’s statement in this case, the company never promised customers that they could obtain loans, nor did it inform users that it was a lending company; therefore, users were not actually deceived when providing their personal information.
The company also explicitly informs users in its user rules that they may “obtain third-party products and services through Product A,” rather than Product A itself extending loans to users. Product A User Rules: “Users may obtain (including free claims and paid purchases, among other methods) insurance products and services provided by third parties such as insurance companies and insurance brokers through Product A. When a user submits an application via Product A to obtain such products or services, the user is deemed to have authorized Product A to transmit …… personal information to the relevant third parties.”
The randomly generated borrowable limits displayed on the platform are a common form of advertising in the lending business; scrolling tickers are a longstanding marketing practice across industries, and users are not misled thereby. Judging by general common sense, ordinary users would not assume that they too can obtain loans merely because the ticker displays that others have secured loans or shows randomly generated limits. The process by which users provide their personal information also demonstrates that users are aware that loan approval depends on a manual review of their individual qualifications. Moreover, the victim statements in this case indicate that most users of the company’s app had prior experience with online lending; from this it can be inferred that the company’s users were accustomed to such common marketing practices on loan-assistance platforms and subjectively knew their nature.
In summary, the company’s conduct of building a SaaS system, screening user information, and pushing it to partner institutions at varying prices does not constitute the illegal buying, selling, providing, or disclosing of others’ information. On one hand, the company seeks lending institutions for users with loan needs; on the other, it seeks borrower cohorts for lending institutions, thereby matching the two sides. The fees charged by the company to partner institutions are, in substance, brokerage and matchmaking service fees. To provide such intermediary services, the company also incurred substantial promotional costs.
(3) The membership fee of RMB xx does not constitute fraud or other criminal offenses.
The public security organs initiated investigation in this case following user complaints about the company’s app charging a membership fee of RMB xx. Based on the statements of suspect A and others, as well as those of the relevant victims, it can be confirmed that the company app’s collection of the RMB xx membership fee did not involve any criminal or unlawful conduct, for the following reasons:
3.1 The charge was not mandatory; it was voluntarily paid by users, and the company provided genuine services.
Reviewing the statements of suspects and victims, the user payment process for the membership fee was as follows: Through the company’s promotions on various platforms, users saw advertisements for the company’s app while browsing web pages; after downloading the app, users registered by entering their mobile phone numbers, provided personal information, and then followed prompts to apply for a loan. The system subsequently indicated that purchasing a membership could improve the approval rate and shorten the review time for loan applications, and that membership would provide access to lending platforms featuring larger approved amounts and faster disbursements. Users could directly download other lending-platform apps recommended on the company’s platform.
Such guidance involved no malicious concealment or fraudulent conduct; the company did not represent to users that it was a licensed lending institution, nor did it promise that every user would successfully obtain a loan.
Furthermore, after joining the membership, users could access more localized, niche, yet compliant lending applications and enjoy enhanced customer-service benefits, thereby obtaining more borrowing-related information and greater choice among loan options. The company provided users with additional compliant lending channels, rigorously vetted partner institutions to prevent users from being defrauded, and objectively increased the probability of loan approval. The company’s display on its app of recommendations for other platform apps, as well as its provision of obtained user information to partner companies, were both aimed at facilitating users’ successful acquisition of loans.
In addition, the company provided users with tangible benefits (such as Ele.me and Meituan coupon vouchers, iQIYI memberships, mobile phone top-ups, Ximalaya subscriptions, Tencent services, and other lifestyle benefits).
Therefore, users voluntarily paid the membership fee for the purpose of obtaining loans, and the company provided loan-related as well as additional ancillary services.
In essence, the loan-assistance business earns profits from information asymmetry, which is reasonable and lawful.After users pay the membership fee, they are able to view loan platforms with higher credit limits and faster disbursement compared to non-member users. The membership threshold is designed to improve the success rate of loan applications, and this business model does not violate legal provisions.
3.2 The Company abolished the RMB xx membership fee in [Month] 202x.
Due to various factors, including the users’ own qualifications, not all users successfully obtain loans. This has led some users to file complaints requesting refunds of the membership fee.
B was responsible for handling user refunds and repeatedly proactively proposed abolishing the membership fee system. The Company abolished this system in September 2022. Following its abolition, any user who registers automatically becomes a member. If a user requests a refund of the membership fee, the Company will process the refund within ten minutes.
Furthermore, A stated that “even if a user successfully obtains a loan through our Company but still requests a refund, our Company will issue the refund.” This demonstrates that the Company has made every effort to ensure a satisfactory customer service experience.
3. As the Company’s legal representative, sole shareholder, and actual controller, A holds independent and exclusive decision-making authority over corporate affairs.
(1) The Company primarily consists of two departments: the Technology Department and the Operations Department, both of which are under the actual control of A.
The Company primarily consists of two departments: the Technology Department and the Operations Department. The Technology Department is responsible for the design, development, maintenance, and backend data processing of the two mobile applications. The Operations Department handles business liaison, online promotion, and related matters. The head of the Operations Department is [Name], and the head of the Technology Department is [Name]. All personnel act in accordance with A’s instructions.
Within the Operations Department, employee [Name] prepares daily online and offline revenue statements, which are reviewed by [Name] and finally confirmed by A.
The Technology Department develops and designs the mobile applications and maintains the SaaS system in accordance with A’s requirements. A liaises with third parties and determines which partner institutions are granted access privileges. The Technology Department then integrates these third-party partners into the backend servers, and the Operations Department creates accounts for them.
(2) B is an ordinary employee of the Company, responsible for specific administrative tasks.
B serves as the head of the Operations Department solely due to their earlier date of hire and familiarity with the Company’s business operations. Accordingly, starting from [Month] 202x, B was appointed as the head of the Operations Department pursuant to A’s arrangement.
4. In this case, the company’s business model and its loan facilitation services do not constitute a criminal offense.
(1) In addition to its loan facilitation services, the company conducts other businesses that account for a significant proportion of its overall operations.
Within the company’s overall business composition, businesses other than loan facilitation services occupy a substantial proportion and involve no illegal or criminal conduct. The specific reasons have been set forth above and will not be reiterated here.
(2) In this case, the company’s loan facilitation services are lawful and compliant. The specific reasons are as follows:
2.1 When collecting user information, the company obtained users’ informed consent.
In the course of conducting its loan facilitation services, the company also implemented strict risk control measures. It never represented to users that it was a licensed online lending platform. The user information obtained on the platform was voluntarily provided by users after they checked the box to accept the user agreement. Users voluntarily entered their personal information when registering for the app, rather than the company obtaining such information through unlawful means such as web crawling, purchasing, or without consent.
Moreover, the company’s so-called collection of personal information merely involved users checking boxes for options set within the app; it did not require users to upload any personal documents. The authenticity of the information provided by users was verified by cooperating companies through direct contact with the users, and the company did not participate in such verification.
2.2 The company’s loan facilitation services served an intermediary matchmaking function.
As an online intermediary platform facilitating communication between borrowers and lending institutions, the collection of citizens’ personal information was a prerequisite and necessary condition for the provision of services. By collecting borrowers’ needs and understanding their personal financial status and repayment capacity, the company matched them with suitable lending companies, thereby facilitating the conclusion of loan intentions. Therefore, the company’s collection of citizens’ personal information related to the purpose of obtaining loans was necessary.
The company targeted specific groups with loan needs. Borrowers strongly desired that their information be understood by lending institutions and voluntarily consented to the collection of their information so that their loan objectives could be achieved as quickly as possible.
Therefore, judicial authorities should fully consider the special nature of the company’s business, respect the free will of borrowers, and avoid a mechanical application of legal provisions that would deem the mere large-scale collection of citizens’ personal information to be a criminal offense.
2.3 The company implemented strict risk control measures to protect personal information.
Prior to providing information to partner companies, the Company strictly reviews the qualifications of such partner companies to ensure that user information is used solely for loan-related purposes.
With respect to transmission methods, the Company employs encrypted transmission via APIs and SaaS systems. Partner companies are prohibited from downloading data and may only view it; furthermore, such information is automatically deleted from the SaaS system after 48 hours. The Company also implements encryption measures when disclosing users’ names and national ID numbers to external parties.
Regarding the Company’s internal management, not all employees are authorized to access the Company’s backend systems.
The foregoing constitutes a range of safeguards implemented by the Company to protect user information and prevent information leaks.
5. With respect to irregularities involved in the Company’s operations, we request that the procuratorial organs initiate “compliance-based non-prosecution” proceedings.
(1) Loan facilitation services inherently possess economic value.
Internet-based loan facilitation emerged in response to the needs of lending institutions. It is a product of industrial segmentation and represents a commercial division of labor based on comparative advantages among various parties. Rooted in the integration of finance and technology, it leverages complementary advantages in scenarios, customer segments, and technology to enhance credit accessibility and strengthen service capabilities aligned with the convenience requirements of internet-based economic development. Such services help amplify the operational capacity of institutions, particularly small and medium-sized lenders, improve business efficiency, reduce service costs, and mitigate business risks. At the same time, they further broaden the coverage of financial services and play a positive role in promoting financial inclusion.In China, there are multiple well-known listed companies engaged in loan facilitation businesses, including 360 Shuke, Xinye Technology, Weixin Jinke, Jiayin Jinke, and Xiaoying Technology, among others.
(2) The issues identified in relation to the Company are prevalent throughout the loan facilitation industry.
As stated above, while the loan facilitation industry has positive significance, we do not deny that the Company objectively exhibits numerous issues. For example, in its advertising promotions, the Company failed to use prominently noticeable fonts to clearly indicate that its app provides only loan facilitation services and is not a lending platform. In collecting user information, the Company failed to clearly inform users which specific partner institutions might contact them using their information. Additionally, the Company’s internal rules and regulations were inadequate, as it had not established internal management systems and operating procedures for the protection of personal information.
However, such issues are not unique to the Company in this case but are widespread across the entire credit industry, including among well-known companies.
Compared with other loan facilitation institutions in the same industry, the Company’s loan facilitation business is relatively more compliant.
Some loan facilitation institutions, in pursuit of profit, induce borrowers to engage in premature consumption without conducting a comprehensive and objective assessment of the borrowers’ loan purposes, repayment capacity, and willingness to repay, thereby leading to excessive borrowing. In some cases, their marketing materials promote harmful values such as “money worship” and “excessive consumption.” These institutions may also excessively participate in the deduction, settlement, and allocation of repayments; loan funds may be intercepted, pooled, or misappropriated by the loan facilitation institutions; they may provide “counter-guarantees” or participate in the collection of overdue debts.
The Company is not involved in any of the aforementioned circumstances. The Company merely acts as an intermediary matchmaker between the two parties. It collects information from users only to the minimum extent necessary to achieve the users’ loan objectives, does not require users to upload any documents, and leaves the verification of the authenticity and completeness of the information provided by users to the cooperating institutions, which directly contact and verify such information.
(3) If the judicial authorities ultimately determine upon review that the conduct in this case constitutes a criminal offense, we respectfully request that they take into account the actual circumstances of the Company’s business operations and decide not to prosecute in this case.
Even if the judicial authorities were to deem the conduct in this case criminal, the Company’s circumstances are manifestly minor, its loan facilitation business has been operated for only a short period, and it is not the Company’s core business. Objectively, the Company provided information solely to meet the loan needs of platform users, and its operation of this business does not pose social harm. Meanwhile, given the principle of restraint inherent in criminal law, the issues identified with the Company can be regulated through administrative regulations and industry regulatory policies. Criminal sanctions should be reserved for loan facilitation companies whose conduct is more serious and egregious in nature than that in this case (such as assisting lending institutions in violent debt collection, deeply collaborating with lending institutions to participate in lending operations, and thereby disrupting financial markets, among other behaviors).
The essence of credit services is to meet the financing needs of individuals and enterprises through the reallocation and rational use of funds. The Company’s loan facilitation business can also effectively leverage the marketing and scenario-based advantages of loan facilitation institutions, making the channels for the flow of funds to the financing demand side smoother. To a certain extent, it helps a broader range of users with loan needs bridge information asymmetries and gain access to more credit services.
The existence of loan facilitation institutions aligns with the development patterns of internet finance and has, in practice, promoted its growth; they should not be wholly negated. Between users and lending institutions, there may be multiple layers of intermediaries. Enforcement should target those who commit wrongdoing and those who infringe upon citizens’ personal information, rather than indiscriminately shutting down all intermediary institutions.
We respectfully request that the procuratorial organs fully consider the particularities of the loan facilitation industry when characterizing this case, and, in light of the actual circumstances of the Company’s overall business, decide not to prosecute in this case.
Respectfully submitted to:
People’s Procuratorate of [x] District, Shanghai
Appendix: List of Evidence
