When personal information meets pandemic prevention and control, how can we protect our right to privacy?

With the outbreak of the COVID-19 pandemic in 2022, epidemic prevention measures such as epidemiological investigations and big data collection, which involve the collection of personal information, have been widely implemented. These measures can help us promptly block the spread of the epidemic and protect public safety. However, at the same time, the large-scale disclosure of citizens' personal information also brings the risk of privacy leakage: People on the list of returnees from epidemic-affected areas frequently receive harassing and threatening calls, and some are even subjected to "human flesh" searches and online violence. Pandemic prevention and control does not mean ignoring citizens' privacy. China's laws prohibit any unit or individual from abusing their rights to disclose citizens' personal information.

Currently, China's Personal Information Protection Law clearly stipulates the "minimization principle", that is, relevant state organs shall only disclose information that is "directly relevant", "at the lowest frequency", and "in the smallest quantity" within the scope of pandemic prevention and control and ensure that such information is not leaked. Meanwhile, even during the pandemic, citizens' right to privacy is still protected by law. Those who privately infringe upon others' right to privacy shall bear corresponding legal liabilities.

[Case for Legal Interpretation]

Dispute over the right to privacy: In July 2020, Wanshang Company (a pseudonym) published an article titled "List of Customers Who Purchased Goods from Epidemic-Affected Areas" on its official WeChat account platform. In this article, Wanshang Company uploaded a table that detailed information such as the purchase date, buyer's address, buyer's phone number, purchase quantity, buyer's name, and buyer's ID number. The article stated that "due to the existence of people with the same name, the purpose of publishing the ID numbers is to make each piece of information more specific. We hope you understand that this is an extraordinary period, and nothing is more important than safety and life." Ms. Zhao's (a pseudonym) information was all recorded in this table. Subsequently, Ms. Zhao received a large number of harassing calls and text messages every day, seriously affecting her life.

After Ms. Zhao requested Wanshang Company to withdraw the article and apologize but was unsuccessful, she sued Wanshang Company in court. After the trial, the court ruled that Wanshang Company should withdraw the article, publicly apologize, and pay Ms. Zhao compensation for mental damage.

[Lawyer's Legal Interpretation]

From this case, we can see that the position of the Civil Code regarding acts of infringing upon citizens' right to privacy is relatively clear:

I. Citizens' right to privacy is protected by law.

Article 110 of the Civil Code of the People's Republic of China, which came into effect on January 1, 2021, stipulates that "natural persons shall enjoy the rights of life, physical integrity, health, name, portrait, reputation, honor, privacy, and the right to autonomy in marriage." The personal information of natural persons is protected by law. Any organization or individual that needs to obtain the personal information of others shall obtain it in accordance with the law and ensure the security of the information. They shall not illegally collect, use, process, or transmit the personal information of others, nor shall they illegally trade, provide, or disclose the personal information of others. In this case, Wanshang Company published Ms. Zhao's private information on its official WeChat account without her consent. Moreover, the involved article was not only widely viewed and reposted by the public but also made available for download, resulting in extensive secondary dissemination and causing serious leakage of Ms. Zhao's privacy, which constitutes an infringement of Ms. Zhao's right to privacy.

II. Pandemic prevention and control is not a legitimate reason for infringing upon others' privacy.

Information on the prevention and control of the COVID-19 pandemic that involves important social and public interests shall be released by relevant authorities with the corresponding powers in accordance with the law. According to Article 12 of the Law on the Prevention and Control of Infectious Diseases, Articles 36 and 40 of the Regulations on Emergency Response to Public Health Emergencies, the main entities include disease prevention and control institutions, medical institutions, professional technical institutions, as well as grass-roots organizations such as sub-districts and other relevant departments such as the health administrative department. In addition, other entities do not have the right to collect citizens' personal information without authorization. Although this case occurred during the extraordinary period of the COVID-19 pandemic, Wanshang Company itself does not have the function of joint prevention and control work. Without the authorization of relevant authoritative institutions and the consent of Ms. Zhao and others, and knowing that it would infringe upon the privacy of relevant persons, Wanshang Company used the excuse of "this is an extraordinary period, and nothing is more important than safety and life" to publish the involved article containing Ms. Zhao's personal information such as her name, home address, ID number, and mobile phone number on the public platform, which infringed upon Ms. Zhao's legitimate rights and interests.

III. Those who infringe upon others' privacy shall bear corresponding legal liabilities.

Article 1183 of the Civil Code of the People's Republic of China stipulates that "if an act of infringing upon the personal rights and interests of a natural person causes serious mental damage, the infringed person shall have the right to claim compensation for mental damage." In this case, Wanshang Company's act of publishing the article on the public platform not only simply leaked Ms. Zhao's personal information and infringed upon her privacy but also widely spread the fact that Ms. Zhao had purchased goods from an epidemic-affected area against the backdrop of the COVID-19 pandemic, bringing huge potential safety risks to Ms. Zhao's personal and property safety. It also caused public panic during the special period when everyone was terrified of "COVID-19", having a negative impact on Ms. Zhao's daily life and seriously affecting her daily interpersonal communication and normal life. Based on this, the court's ruling that Wanshang Company should apologize to Ms. Zhao and pay compensation for mental damage is legal and reasonable.

It should also be noted that the legal consequences of infringing upon others' right to privacy are not limited to civil liabilities.

(1) Administrative liability: According to laws and regulations such as the Law on the Prevention and Control of Infectious Diseases, the Law on Public Security Administration Punishments, the Cybersecurity Law, and the Resident Identity Card Law, acts of illegally obtaining, selling, or spreading others' privacy shall, depending on the severity of the consequences, be subject to administrative penalties such as fines or detention.

(2) Criminal liability: Article 253-1 of China's Criminal Law clearly stipulates the crime of infringing upon citizens' personal information: Those who, in violation of relevant state regulations, sell or provide citizens' personal information to others, steal or illegally obtain citizens' personal information by other means shall be subject to criminal liability of criminal detention or fixed-term imprisonment and a fine; and those who sell or provide citizens' personal information obtained in the process of performing their duties or providing services to others shall be subject to heavier punishment.

In conclusion, during the fight against the pandemic, it is indeed necessary to promptly announce epidemic information to ensure citizens' right to know and public safety, but this does not mean equating the fight against the pandemic with infringing upon privacy. As long as relevant departments earnestly perform their duties and properly handle information, and citizens actively cooperate and comply with epidemic prevention policies, we will surely be able to overcome the pandemic.

Finally, if citizens find that their personal information has been illegally disclosed, they can report it by logging in to the following website: The Reporting Center for Illegal and Harmful Information of the Cyberspace Administration of China https://www.12377.cn/

[Key Points of Laws and Regulations]

Finally, let's summarize the main laws and regulations related to the protection of the right to privacy:

1. The Civil Code of the People's Republic of China

Article 111 The personal information of natural persons is protected by law. Any organization or individual that needs to obtain the personal information of others shall obtain it in accordance with the law and ensure the security of the information. They shall not illegally collect, use, process, or transmit the personal information of others, nor shall they illegally trade, provide, or disclose the personal information of others.

Article 1032 Natural persons shall enjoy the right to privacy. No organization or individual shall infringe upon the privacy of others by means of prying, disturbing, leaking, or disclosing.

Article 1039 State organs, statutory institutions undertaking administrative functions, and their staff shall keep confidential the privacy and personal information of natural persons learned in the process of performing their duties and shall not leak or illegally provide such information to others.

2. The Law on the Prevention and Control of Infectious Diseases of the People's Republic of China

Paragraph 1 of Article 12 All units and individuals within the territory of the People's Republic of China must accept the prevention and control measures such as investigations, tests, sample collection, and isolation treatment for infectious diseases carried out by disease prevention and control institutions and medical institutions and truthfully provide relevant information. Disease prevention and control institutions and medical institutions shall not disclose relevant information and materials involving personal privacy.

3. The Personal Information Protection Law of the People's Republic of China

Article 6 The processing of personal information shall have a clear and reasonable purpose and shall be directly related to the processing purpose. The method that has the least impact on personal rights and interests shall be adopted. The collection of personal information shall be limited to the minimum scope necessary to achieve the processing purpose, and personal information shall not be over-collected.

4. The Notice on Doing a Good Job in Personal Information Protection and Using Big Data to Support Joint Prevention and Control Work

Article 3 Personal information collected for pandemic prevention and control and disease prevention and treatment shall not be used for other purposes. Without the consent of the information subject, no unit or individual shall disclose personal information such as name, age, ID number, phone number, and home address, except for information that has been desensitized due to the need for joint prevention and control work.