By Eric Carlson & Scott Livingston
On August 27, 2013, state-run China Central Television broadcast a taped confession of detained British fraud investigator Peter Humphrey confessing to having used “illegal means” to obtain the personal information of Chinese citizens. This highly unusual broadcast of a confession made by a foreigner in China, along with other recent actions against data privacy violations, suggests an increasing focus by Chinese authorities on enforcement of laws and regulations relating to the protection of an individual’s personal information, and underscores the growing need for companies with operations in China to ensure their personal data collection, handling, and transfer policies comply with national laws and regulations.
Mr. Humphrey and his wife, Yu Yingzeng (a naturalized US citizen, also arrested), were co-founders of a Shanghai-based risk advisory firm, ChinaWhys Co., which specialized in providing “discreet risk mitigation solutions, consultation and investigation services” to corporate clients. They were detained in mid-July 2013 and later formally arrested in August 2013. Police allege that the couple illegally obtained personal information as part of their work for ChinaWhys, which information was then sold to company clients. Although not specifically mentioned, it is likely the police relied on Article 253(a) of the PRC Criminal Law, which criminalizes the illegal obtainment, sale, or provision of a citizen’s personal information by an entity or individual. Nationally broadcast confessions of suspected foreign businessmen are not the usual practice in China. Mr. Humphrey may have agreed to tape the confession in order to receive a more favorable sentencing, but it is unclear what motivated the authorities to request a taped confession in the first place.
Private investigators operate in a gray area under Chinese law, and other investigators have been arrested for their work, although much less publicly. Reports have noted that Mr. Humphrey was reportedly doing work for GlaxoSmithKline, a company that is currently subject to an extensive corruption investigation in China, and that this may have contributed to the attention paid Mr. Humphrey and Ms. Yu. China’s often broadly drafted laws may at times be used as a pretext for government actions against individuals or companies disliked by certain government authorities, and while it appears that the law may have been violated in this case based on Mr. Humphrey’s confession, some commentators have speculated that this enforcement action may have been spurred by other motives.
But regardless of the true reasons for his and his wife’s arrests, Mr. Humphrey’s case is but one in an increasing trend of privacy enforcement actions in China. On August 8, 2013, the state-run newspaper China Daily reported on the detention of 300 employees of a Beijing sales company for suspicion of illegally obtaining personal information. The same article asserted that in 2012, more than 1,700 suspects had been detained for illegally buying or selling personal information. Foreign companies are not exempt from such investigations. In December 2012, a local subsidiary of Dun & Bradstreet, Shanghai Roadway D&B Marketing Services Co., Ltd., was fined RMB 1 million (about US $160,000) for illegally purchasing the personal information of 150 million Chinese citizens (see our blog post here).
With a number of recent regulations targeting the protection of personal information, these enforcement actions will likely continue. Companies with operations in China, particularly those that collect and use personal information on the internet, should continue to monitor these developments to ensure their own internal privacy policies comply with this quickly evolving area of law.