When personal information meets pandemic prevention and control, how do we protect our privacy rights?

With the outbreak of COVID-19 in 2022, epidemic prevention measures such as epidemiological investigations and big data collection that collect personal information are being widely implemented. These measures can help us timely block the epidemic and protect public safety. However, the large-scale disclosure of citizens' personal information also brings the risk of privacy leakage: people appearing on lists of returning travelers from pandemic-affected areas frequently receive harassment and threatening calls, and some people are subject to "doxxing" and experience cyberbullying. Pandemic prevention and control does not mean ignoring citizens' privacy,China's laws prohibit any organization or individual from abusing rights to leak citizens' personal information.

At present, China's Personal Information Protection Law clearly stipulates the "minimization principle," meaning that relevant state organsshall only disclose information that is "directly related," at the "lowest frequency," and in the "minimum quantity" within the scope of pandemic prevention and controland ensure such information is not leaked. At the same time, even during the pandemic,citizens' privacy rights are still protected by law. Those who privately infringe upon others' privacy rights shall bear corresponding legal responsibilities.

【Legal Interpretation Case】

Privacy Rights Dispute:In July 2020, Wanshang Company (pseudonym) published an article titled "Customer List of Products Purchased from Pandemic-Affected Areas" on its official WeChat account platform. In this article, Wanshang Company uploaded a detailed form containing purchase dates, buyer addresses, buyer phone numbers, purchase quantities, buyer names, buyer ID numbers, and other detailed information, and stated in the article, "Due to the existence of multiple people with the same name, the purpose of publishing ID numbers is to make each clue more specific. I hope you understand that this is a very special period, and nothing is more important than safety and life." Ms. Zhao's (pseudonym) information was all recorded in this form. Subsequently, Ms. Zhao received a large number of harassment calls and text messages every day, and her life was seriously affected.

After Ms. Zhao's request for Wanshang Company to withdraw the article and issue an apology was rejected, Ms. Zhao sued Wanshang Company in court. After hearing, the court ruled that Wanshang Company withdraw the article, issue a public apology, and pay Ms. Zhao compensation for mental distress.

【Lawyer's Legal Interpretation】

From this case, we can see that the stance of the Civil Code on acts infringing upon citizens' privacy rights is relatively clear:

1. Citizens' privacy rights are protected by law.

Article 110 of the Civil Code of the People's Republic of China, effective from January 1, 2021, stipulates: "Natural persons enjoy rights such as the right to life, right to bodily integrity, right to health, right to name, right to image, right to reputation, right to honor, right to privacy, right to marriage self-determination, etc." Natural persons' personal information is protected by law. Any organization or individual that needs to obtain others' personal information shall obtain it in accordance with the law and ensure information security, and shall not illegally collect, use, process, or transmit others' personal information, nor illegally buy, sell, provide, or disclose others' personal information. In this case, Wanshang Company published Ms. Zhao's private information on the official account without Ms. Zhao's consent. Moreover, the article in question was widely browsed, reposted, and even provided for download by the public, causing extensive secondary dissemination and serious privacy leakage for Ms. Zhao, constituting an infringement upon Ms. Zhao's privacy rights.

2. Pandemic prevention and control is not a legitimate reason for infringing upon others' privacy.

Information related to COVID-19 pandemic prevention and control involves important social public interests and shall be lawfully released by relevant authorities with powers. According to Article 12 of the Law on the Prevention and Control of Infectious Diseases and Articles 36 and 40 of the Regulations on Emergency Response to Public Health Emergencies, these mainly includedisease prevention and control institutions and medical institutions, professional and technical institutions, as well as street-level grassroots organizations, health administrative departments, and other relevant departments. Beyond these, no other entities have the right to collect citizens' personal information without authorization. Although this case occurred during the special public health emergency of the COVID-19 pandemic, Wanshang Company itself does not have the functions of joint prevention and control work. Without authorization from relevant authoritative institutions and without the consent of Ms. Zhao and others, and knowing that it would infringe upon the privacy of relevant persons, Wanshang Company used the excuse of "this is a very special period, and nothing is more important than safety and life" to arbitrarily publish the article in question containing Ms. Zhao's personal information such as her name, home address, ID number, and phone number on a public platform, infringing upon Ms. Zhao's legitimate rights and interests.

3. Infringing upon others' privacy requires bearing corresponding legal responsibilities.

Article 1183 of the Civil Code of the People's Republic of China stipulates: "If a natural person's personal rights are infringed upon causing serious mental distress, the infringed party has the right to request mental distress compensation." In this case, Wanshang Company's act of publishing the article on the public platform was not only simply leaking Ms. Zhao's personal information and infringing upon her privacy, but also broadly disseminating the fact that Ms. Zhao purchased products from pandemic-affected areas against the backdrop of the COVID-19 outbreak, posing huge security risks to Ms. Zhao's personal and property safety. It would also cause public panic during this special period when everyone is terrified of COVID-19, negatively affecting Ms. Zhao's daily life, seriously impacting her normal interpersonal interactions and daily life. Based on this, the court's ruling that Wanshang Company issue a public apology to Ms. Zhao and pay mental distress compensation is legal and reasonable.

It should also be noted that the legal consequences of infringing upon others' privacy rights are not limited to civil liability.

(1) Administrative Liability: According to laws and regulations such as the Law on the Prevention and Control of Infectious Diseases, the Law on Public Security Administration Punishment, the Cybersecurity Law, and the Resident Identity Card Law, acts of illegally obtaining, selling, or disseminating others' privacy, etc., depending on the severity of the consequences, will face administrative penalties such as fines or detention.

(2) Criminal Liability: Article 253bis of China's Criminal Law clearly stipulates the crime of infringing upon citizens' personal information: those who violate state regulations by selling or providing citizens' personal information, stealing or illegally obtaining citizens' personal information by other methods, will face criminal liability including detention or fixed-term imprisonment and fines; selling or providing citizens' personal information obtained in the course of performing duties or providing services to others is an aggravated circumstance for punishment.

In summary, during the pandemic, while it is necessary to promptly release epidemic information and protect citizens' right to know and public safety, this does not mean drawing an equal sign between pandemic fighting and privacy infringement. As long as relevant departments conscientiously perform their duties and properly handle information, and citizens actively cooperate and comply with pandemic prevention policies, we will certainly be able to overcome the pandemic.

Finally, if citizens encounter situations where their personal information is unlawfully disclosed, they can report it through the following website: Cybercrime Reporting Center of the Central Internet Information Office https://www.12377.cn/

【Key Points of Legal Provisions】

Finally, here is a summary of the main laws and regulations related to privacy rights protection:

1. Civil Code of the People's Republic of China

Article 111 Natural persons' personal information is protected by law. Any organization or individual that needs to obtain others' personal information shall obtain it in accordance with the law and ensure information security, and shall not illegally collect, use, process, or transmit others' personal information, nor illegally buy, sell, provide, or disclose others' personal information.

Article 1032 Natural persons enjoy privacy rights. No organization or individual may infringe upon others' privacy rights by means of intrusion, harassment, leakage, or disclosure.

Article 1039 State organs, statutory institutions performing administrative functions, and their staff shall keep confidential the privacy and personal information of natural persons known in the course of performing their duties, and shall not leak or illegally provide such information to others.

2. Law of the People's Republic of China on the Prevention and Control of Infectious Diseases

Paragraph 1 of Article 12 All units and individuals within the territory of the People's Republic of China must accept the disease prevention and control institutions and medical institutions' prevention and control measures related to infectious diseases such as investigation, inspection, sample collection, isolation treatment, etc., and truthfully provide relevant information. Disease prevention and control institutions and medical institutions shall not leak relevant information and materials involving personal privacy.

3. Personal Information Protection Law of the People's Republic of China

Article 6 The processing of personal information shall have clear and reasonable purposes, and shall be directly related to the processing purposes, and shall adopt the manner that has the least impact on personal rights and interests. The collection of personal information shall be limited to the minimum scope necessary to achieve the processing purposes, and excessive collection of personal information shall not be allowed.

4. Notice on Doing a Good Job in Personal Information Protection and Using Big Data to Support Joint Prevention and Control

Article 3 Personal information collected for pandemic prevention and control shall not be used for other purposes. No unit or individual shall, without the consent of the collected persons, publicly disclose personal information such as names, ages, ID numbers, phone numbers, and home addresses, except when necessary for joint prevention and control work and after desensitization processing.