Meaning
Statutory criminal provisions govern the illegal collection or sale of citizens’ personal information by corporate employees or organizations. Under prc criminal law article 253, individuals and enterprises face severe criminal penalties for violating personal data rights. This article establishes corporate liability and establishes the legal baseline for data compliance audits.
Criminal Liability
Penalties under this provision scale with the severity of the offense, ranging from fines to seven years of imprisonment for extreme violations. Both the directly responsible personnel and the enterprise itself can be prosecuted under these rules.
Compliance Impact
Supply chain managers and data processors must maintain strict access controls to avoid triggering criminal liability under these rules. If a company’s database of customer contacts is leaked or sold by an employee, the corporate officers can be held criminally responsible for failing to implement sufficient security measures. The Supreme People’s Court has clarified that obtaining personal information from public sources or third parties without verification of consent is also a criminal act.
This risk makes it essential for foreign-invested enterprises to conduct comprehensive background checks on their local IT vendors and data partners. Any database acquisition or user profiling must have explicit, documented consent that aligns with the requirements of this statute.
Judicial Enforcement
Enforcement actions are carried out by the public security bureau, which investigates data leaks and prosecutes offenders. The presence of a verified compliance program can act as a mitigating factor to protect corporate executives from personal prosecution.
