Peter William Humphrey, a British citizen, and his American wife, Yu Yingzeng, were prosecuted on August 8, 2014 in Shanghai No.1 Intermediate People’s Court for illegally obtaining the personal information of Chinese citizens. The court sentenced Mr. Humphrey to a fixed-term imprisonment of two and one-half years, a fine of RMB 200,000, and deportation from China after serving the imprisonment term; and sentenced Yu Yingzeng to a fixed-term imprisonment of two years plus a fine of RMB 150,000.

Before they were arrested in August 2013, the couple operated a business risk advisory firm in Shanghai known as ChinaWhys. This was only weeks after the firm delivered an investigation report to the British pharmaceutical company GlaxoSmithKline (“GSK”) China. Inevitably, their detention became linked with the GSK China bribery scandal, but the case has implications for China’s emerging data protection and privacy regime.

The PRC criminalized the sale of personal information in the seventh amendment to the PRC Criminal Law on February 28, 2009. According to the amended Article 253 of PRC Criminal Law, where any staff member of a government agency or an entity in such fields as finance, telecommunications, transportation, education, or medical treatment, in violation of state provisions, sells or illegally provides to another personal information about Chinese citizens, which information was obtained during the government agency’s performance of duties or the entity’s provision of services, must, if the circumstances are serious, be sentenced to prison for a fixed-term of not more than 3 years or to criminal detention and/or be fined.

Further, whoever illegally obtains such information by stealing or any other means must, if the circumstances are serious, be subject to the same punishment. If an entity commits either of the crime of selling, illegally providing, stealing or illegally obtaining personal information, that entity must, by PRC law, be fined, and the person with direct responsibility for the act, as well as and any others direct liability must also be subjected to fixed-term imprisonment for not more than three years or criminal detention, and/or fine.

In the case against Mr. Humphrey and Ms. Yu, both the prosecution and the defense focused principally on two issues:

(a) Whether the means used by ChinaWhys to obtain personal information were illegal. The defense argued that the company did not purchase personal information, but purchased investigation services that happened to include the household registration and travel records of PRC citizens. The Prosecutor asserted that such information is private and protected by PRC law and could not legally be purchased or sold as a commodity.

(b) Whether the circumstances of this case are serious enough to constitute a criminal violation: The defense argued that the purpose of obtaining the personal information was to enable the client of ChinaWhys to conduct its own internal investigation into possible bribery. ChinaWhys did not re-sell such personal information to its clients, but sold only the analysis and research arising from such information, and this did not cause any personal injury or damage to property. In response, the prosecutor asserted that the couple was using due diligence as a cover for illegally acquiring the personal information of PRC citizens and profiting from the use of that information, which infringed the human rights of such citizens. The prosecutor noted that the couple has for nine years purchased information on the identity and residency of PRC citizens, family members, vehicle registrations, phone records, and overseas travel records. Further, the staff of ChinaWhys had pretended to be employees, investors, clients, and delivery personnel in order to obtain information. They hired agents to tail and monitor citizens to learn about their living habits and movements. According to the prosecution, the couple’s crimes were particularly egregious because they committed them over a period of nine years and because they reaped enormous benefits.

The court found the couple guilty because they intentionally purchased the personal information and conducted investigations for profit, seriously violating the rights of citizens.

The case clarifies that acquiring personal information in China from a third party is illegal, not merely the selling of such information and serves as a warning to all companies, firms, and individuals engaging in due diligence and internal investigations to be cautious in collecting personal information.