Attorney Shao Shiwei | Insights for the Loan Facilitation Industry from Two Cases of Buying and Selling Personal Information with Virtual Currencies Cracked by Police

02

1. Insiders

Without source leaks and sales, how could the black and gray market chain for personal information form?

In August 2023, the Beijing Higher People's Court introduced at a press briefing3that, looking at the entire crime chain,leaks by internal personnel are the primary source of crimes infringing upon citizens' personal information.

Banks, credit card centers, auto finance companies, real estate agencies, and courier services are all underlying sources of information leaks. For instance, personal information leaked by financial institutions such as banks is relatively high-quality for the loan facilitation industry, as these customers have potential loan needs.

2. Industries with Demand for Purchasing Personal Information

Which industries have substantial demands for personal information?Industries heavily reliant on cold calling for marketing and promotion.

For example, in finance, education and training, intermediary services, and recruitment, the buying and selling of personal information has long evolved into an industry norm.

For instance, the loan facilitation industry, in which Attorney Shao handles many cases, is an industry rampant with the buying and selling of personal information. Terms like “dark web” and “virtual currencies” are no longer unfamiliar concepts in the loan facilitation sector.

For most loan facilitation companies, considering corporate revenue, relying solely on publishing feed advertisements on various media platforms to attract users with loan needs yields limited data, and such users may not meet the loan conditions for products sold on their platforms. Therefore, they actively seek channels to purchase personal information.

Some non-compliant loan facilitation companies, after obtaining user information from banks and other institutions, falsely claim in telephone communications during customer acquisition to be managers of XX Bank’s credit department or XX Bank’s loan center to gain potential customers' trust; in providing intermediary services, they charge high intermediary fees based on the customer's loan amount and repayment capacity; and in contract performance, they provide illegal debt collection services for cooperating online lending platforms or financial institutions... The negative impacts brought by such irregular practices within the industrydirectly result in: deepening the negative impression of judicial authorities towards the loan facilitation industry, thereby squeezing the survival space of some legitimate operators.。

3. Groups Reselling Personal Information

Previously, while chatting with the legal representative of a loan facilitation company, he mentioned that data obtainable through legal channels is too scarce, so a large amount of personal information is acquired through other means:

(1) Mutual data sharing among peers (between loan facilitation companies, and between loan facilitation companies and upstream/downstream enterprises);

(2) Cross-industry procurement (for example, among the vast amounts of personal information held by real estate companies and second-hand housing companies, there may be many customers with loan needs);

(3) Purchases from overseas networks (i.e., the buyers in the two cases introduced at the beginning of this article).

Moreover, to extract the maximum value from the personal information in their possession, it is common for buyers to engage in repeated reselling and multiple sales.

03

1. Crime of Infringing Citizens' Personal Information

“Citizens' personal information” includes information and data materials that can individually or in combination with other information identify a citizen's identity, reflect the activities of a specific natural person, or involve a citizen's privacy, such as: name, ID number, communication contact details, address, account passwords, financial status, location tracks, marital status, work unit, education background, resume, etc.

The modes of conduct for this crime can be summarized in the diagram below.

It should be noted that, according to legal provisions, even illegally purchasing or receiving citizens' personal information for legitimate business operations constitutes this crime if certain standards are met.

For more detailed legal analysis related to this crime, please refer to Attorney Shao’s previous article →“Comprehensive Explanation | Big Data Analysis and Typical Cases of the Crime of Infringing Citizens' Personal Information.”

2. Crime of Aiding Information Network Criminal Activities

According to the Criminal Law, if an actor knowingly provides technical support such as internet access, server hosting, network storage, or communication transmission, or provides assistance such as advertising promotion or payment settlement, to others who are using information networks to commit crimes, they constitute the crime of aiding information network criminal activities.

For example, a software company, knowing that another party is suspected of buying and selling citizens' personal information, still develops relevant technical software for them (such as SMS bulk sending systems, AI bulk voice call systems, SaaS systems, etc.), providing technical support and maintenance for data transmission.

For example, an operations company, knowing that a certain company is suspected of reselling personal information, still provides proxy operation and promotion services for them.

Another example is providing collection and payment services while knowing that others may be involved in illegal activities such as buying and selling personal information.

3. Crime of Illegal Business Operations

Due to the state’s previous severe crackdowns on “predatory lending” and “professional lenders,” few loan facilitation companies engage in lending businesses while knowingly lacking relevant qualifications or licenses. However, within the industry, to help customers increase loan approval rates and thereby earn more commissions, many business personnel still use their informational advantages to fabricate false credit materials, salary statements, and loan purposes for customers, defrauding financial institutions and online lending platforms of loans. Even some practitioners, knowing that customers lack repayment capacity, fabricate false materials to cash out large sums for customers, followed by illegal debt collection.

Such acts are suspected of constituting criminal offenses such as loan fraud and illegal business operations.

04

In recent years, judicial authorities have significantly intensified crackdowns on money laundering crimes. On January 22, 2024, the State Council Executive Meeting, presided over by Premier Li Qiang, deliberated the “Draft Amendment to the Anti-Money Laundering Law of the People's Republic of China,” marking the first major revision of the Anti-Money Laundering Law, under which virtual asset money laundering will be included in the regulatory scope. Prohibiting the illegal buying and selling of information cuts off the crime chain at its source.

For the loan facilitation industry, to achieve long-term, stable, and healthy development, at the level ofinformation acquisition, it must ensure legality and compliance, guaranteeing that obtained information has received effective user authorization; at the level ofinformation usage, it must properly safeguard information and strictly adhere to the “minimum necessary” principle stipulated in the Personal Information Protection Law; at the level ofexternal provision of information, it is necessary not only to obtain user authorization but also to verify the business qualifications of the recipient, the purpose and use of collected information, etc., and to conduct regular user follow-ups. Once any violations by the recipient are discovered, cooperation should be terminated promptly, and complaints or reports to relevant authorities are warranted.