SpecialDisclaimer: This article is an original work by Attorney Shao Shiwei. It represents only the personal views of the author and does not constitute legal consultation or legal advice on specific matters. For article reprints, legal consultations, or business exchanges, please add: sswls66
Introduction:
Loan facilitation institutions refer to intermediary service providers that conduct preliminary screening of users through traffic redirection and facilitate cooperation between users and lending institutions. During the user screening process, loan facilitation companies need to collect user information. Not only small companies, but even industry leaders and well-known listed companies in the loan facilitation sector, have, to varying degrees, engaged in the illegal or non-compliant collection of citizens' personal information.
Therefore, many small and medium-sized enterprise owners engaged in loan facilitation business believe that “the tallest poppy gets cut down, and to catch thieves, one must first catch the kingpin.
If large companies are non-compliant, they will be the ones penalized, not us small companies.” Especially when we often see the following news, it tends to reinforce this viewpoint.
However, in reality,is this truly the case?？
Let us state the conclusion first. Based on the cases and consultations the author has currently encountered, a judgment can be made (Disclaimer: This conclusion is drawn solely from the author's thoughts and observations; its reliability requires confirmation by relevant authoritative data):
Administrative Penalties → Primarily Target Industry Leaders and Well-Known Enterprises
Criminal Sanctions → Primarily Target Small and Medium-Sized Enterprises
Author of this article: Attorney Shao Shiwei
01
First, let us examine a case
According to a report by “Ping’an Beijing Chaoyang”[1], defendants Ge Mou 1 and Zhu Mou 1 purchased a loan-related APP software to operate a loan facilitation business. Subsequently, the two jointly invested to establish a company to operate this APP. While knowingly collecting registered users' names, phone numbers, and other personal information, the APP also collected other personal information such as registered users' contact lists, SMS messages, and call records. However, the APP's “User Registration Agreement” did not explicitly disclose to registered users the collection of the aforementioned content. The company illegally collected over one million items of personal information, including user contact lists, call records, and SMS messages.
Court Judgment: Defendants Ge Mou 1 and Zhu Mou 1 were both found guilty of the crime of infringing upon citizens' personal information and sentenced tothree years of fixed-term imprisonment, along with a fine of RMB 100,000.
Analysis:
The court determined that the company, in operating its loan facilitation business, obtainedcontact lists, SMS messages, call recordsand other information beyond its scope of business, with the quantity exceeding one million items. According to Article 253-1 of the Criminal Law regarding the crime of infringing upon citizens' personal information, and the Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases of Infringing Upon Citizens' Personal Information,illegally obtaining 500 or more items of communication content, or 5,000 or more items of communication records,meets thethreshold for filing a case punishable by three to ten yearsof imprisonment.
From publicly disclosed information, the company was involved only in “illegal collection of user information” and not in selling such information for profit. However, under legal provisions, committing this crime does not require profit as a motive.Selling, providing, stealing, or illegally obtainingcitizens' personal information by other meansall constitute this crime.。
02
1. The App’s registration and login function forces consumers to agree to the privacy policy of a third-party App, where such third-party privacy policy is unrelated to the purpose of processing personal information by the current product. This constitutes processing information without adopting the method that has the least impact on individual rights and interests.
Relevant Legal Provisions: Articles 5 and 6 of the Personal Information Protection Law of the People's Republic of China
2. Directly requesting permission to access precise location information without the consumer's consent to the privacy policy constitutes the collection and use of personal information without consumer consent.
Relevant Legal Provisions: Article 13 of the Personal Information Protection Law of the People's Republic of China
3. When using a loan-related App for the first time, the App reads the application list but fails to simultaneously inform the consumer of the purpose of reading the application list.
Relevant Legal Provisions: Article 17 of the Personal Information Protection Law of the People's Republic of China
03
Risk Warning from Criminal Defense Attorneys:
Currently, China places increasing emphasis on the protection of personal information, and relevant laws, regulations, and policies are continuously being improved.
In 2009, the Amendment to the Criminal Law added the crime of infringing upon citizens' personal information. In 2017, the Supreme People's Court and the Supreme People's Procuratorate issued the Interpretation on Several Issues Concerning the Application of Law in Handling Criminal Cases of Infringing Upon Citizens' Personal Information. In 2021, the Personal Information Protection Law was enacted.
Meanwhile,policies regarding financial consumption and the lending sector are continuously tightening.。
In March 2022, the China Banking and Insurance Regulatory Commission issued the Risk Warning on Guarding Against Inducements of Excessive Borrowing Marketing, stating that “some financial institutions and internet platforms... obtain authorization through methods such as default consent and generalized authorization; use personal information for purposes other than credit card business and consumer credit business without consumer consent or against consumer will; improperly obtain consumers' external information, etc.”
The Research Report on the Development of Internet Loan Facilitation Business in China points out that, against the policy background that “commercial banks must independently and effectively carry out core risk control processes,”compliant data usage by loan facilitation institutions will become a focal point. Third-party data companies with high data homogeneity, low uniqueness, and difficulty in meeting current legal compliance requirements may be eliminated by the market.[3]。
Therefore, loan facilitation platforms must attach great importance to compliance work in personal information protection when collecting user information. Administrative violations are not terrifying, as enterprises still have opportunities for rectification. However,once entangled in the vortex of criminal litigation, the entire enterprise's survival situation will be in imminent danger.。
[1] “Case Analysis”: Illegally Obtaining Citizens' Personal Information via Mobile Software Constitutes the Crime of Infringing Upon Citizens' Personal Information https://baijiahao.baidu.com/s?id=1741569919288577153&wfr=spider&for=pc
[2] Image cited from the release by the Shanghai Cyberspace Administration
[3] ChinaResearch Report on the Development of Internet Loan Facilitation Business
