Privacy International defends the right to privacy across the world, and fights surveillance and other intrusions into private life by governments and corporations. Read more »


I. Legal framework

Constitutional Privacy Framework

There are limited rights to privacy in the Chinese Constitution. Article 38 states that the personal dignity of citizens of the People's Republic of China (PRC) is inviolable and that insult, libel, false accusation, or false incrimination directed against citizens by any means is prohibited.1 Articles 37 and 39 define, respectively, the protection of freedom of the person and the residence. Article 40 provides for the freedom and privacy of correspondence of the citizen.2

Despite these provisions and those set out in more detailed laws, the Chinese government itself admits that it has room for improvement in terms of applying the law fairly and systematically. According to one government statement from 2000, "Chinese society is now in the process of transition from too much emphasis on the rule of person and insufficient emphasis on the rule of law to establishing concept of the rule of law, from supremacy of the power to supremacy of the law."3 The government statement goes on to say that in recent years "[t]he party and state exercised strict political control of courts and judges. A lack of due process and new restrictions on lawyers further limited progress toward the rule of law."4

China has promised to ensure human rights in the amendment of its Constitution.5 The amendment reflects a growing awareness of human rights concerns. However, the legal system, with its vague protections and the questionable independence of its judiciary, remains a source of human rights violations.6  Reports continue to emerge that government restrictions continue to be deployed, however.  The US Congressional-Executive Commission on China in 2004 found that China had made limited progress in human rights-related issues.7 During 2006, China exerted stricter controls on the press, Internet, academics, lawyers, and NGOs. These constraints remained in place through the 2008 summer Olympics hosted in Beijing.8

Privacy Awareness and Expectations

Privacy concerns are growing in China. In 2007, China's Central South University released a study that indicates an increase in expectations of privacy. Earlier attitudes toward privacy were shaped by traditional living arrangements whereby families of several generations often lived together in small homes.9 The study notes that the average living space for urban Chinese had risen from 3.6 square meters in 1978 to 11.4 square meters by 2003. This increase has played an important role in fostering expectations of privacy within the family.

Even as expectations are mounting, these are not reflected in the state of the laws. In 2008, the Law Institute of the Chinese Academy of Social Sciences investigated the awareness and attitude of personal information protection among citizens in four major cities in China.10 One worrying development is the significant gap between privacy awareness among citizens in China and their sense of helplessness. In particular, the study found that 42% of respondents felt that their personal data had been mishandled or abused, but only 4% of the victims had complained or attempted to file a lawsuit. Equally alarming was the revelation that only 9.7% believed they had a right to know how their personal information was being collected. However, more than 95% of respondents felt that the government should set an example of proper data treatment and they hoped that the government would implement a data protection policy.

Statutory Rules on Privacy

Article 101 of the General Principles of Civil Law (1986) provides a "right of reputation" to citizens and corporations, stating, "[t]he personality of citizens shall be protected by law, and the use of insults, defamation or other means to damage the reputation of citizens or legal persons shall be prohibited."11 Article 246 of the Criminal Law provides a further basis for the protection of this right, stating, "[t]hose openly insulting others using force or other methods or those fabricating stories to defame others, if the case is serious, are to be sentenced to three years or fewer in prison, put under criminal detention or surveillance, or deprived of their political rights."12

In 2009, the Tort Liability Law was reformed, enabling citizens to sue for damages for privacy violation (Article 2). In the same year, Xuzhou City in Jiangsu Province enacted a regulation prohibiting the disclosure and dissemination of personal information on the Internet without authority from the concerned individuals.13 The Law on the Protection of Minors (1991) provides that "no organisation or individual may disclose the personal privacy of minors" and "with regard to cases involving crimes committed by minors, the names, home addresses, and photos of such minors as well as other information which can be used to deduce who they are, may not be disclosed, before the judgment, in news reports, films, television programs, and in any other openly circulated publications."14 In a 2003 case, a high-school principal in Shanghai showed a videotape of two students who had been covertly filmed while kissing in a classroom. The teenage couple, humiliated by the incident, launched a lawsuit for invasion of privacy. They lost their court action, but won considerable public sympathy.15

The Law on the Protection of Rights and Interests of Women (1992) provides that "women's right of reputation and personal dignity shall be protected by law. Damage to women's right of reputation and personal dignity by such means as insult, libel or giving publicity to privacy shall be prohibited."16

In 2006, the police in Shenzhen organised a parade of 100 prostitutes, pimps, madams, and their customers.17 Government authorities intended for the event to kick off a anti-prostitution campaign. The shackled defendants, in government-issue yellow shirts and black pants, were marched through Shazui, a neighbourhood often regarded as a central place of prostitution in Shenzhen. The women tried to cover their faces, but police called out the name and address of each alleged offender to a crowd of 1,000 or so, announcing a 15-day sentence and ushering them to waiting prison vans.18 Several regional state-run papers condemned the move on their websites as an unacceptable violation of privacy.19 By citing a regulatory change in the 1980s that banned public humiliation of suspects, an attorney criticized the police's action as illegal albeit bearing "good intentions".20

There are a number of other laws with restrictions on disclosure. The Law on Lawyers (1996) requires lawyers to protect the privacy of their clients;21 the Law on Statistics (1983) provides that data collected from investigations shall not be disclosed without the consent of data subjects;22 and the Provisional Regulations Relating to Bank Management (1986) provide that all information concerning clients' savings shall not be disclosed.23

The Law on Resident Identity Cards of 2003 requires public security departments and their police officers to keep confidential the personal information they acquire when making, issuing, examining or impounding citizens' personal identity cards.24 Similarly, the Law on Passports of 200625 states that the passport issuance departments and their functionaries shall keep confidential the citizens' personal information they have access to in the course of making or issuing passports.

Taken together, these provisions provide a minimum level of protection for the privacy of the citizen. However, in practice there has been a degree of confusion in applying these provisions in cases concerning privacy. Consequently, the Supreme People's Court has issued two general judicial interpretations regarding the application of The General Principles of Civil Law to privacy. According to the Opinions on Several Questions concerning the Implementation of the "General Principles of the Civil Law of the PRC" (1998) issued by the Supreme People's Court:

"In case anyone publicises other persons' privacy in writing or orally, or fabricates facts to publicly vilify the personality of other persons, or damages other persons' reputation by ways of insulting or defamation, which has caused a certain negative impact, such an act shall be determined as infringing the citizen's right of reputation."26

Although there is currently no general data protection law in China and very few laws that limit government interference with the collection, use, and disclosure of personal information, other regulations are emerging. The State Council has long been considering a Personal Information Protection Law, mainly focusing on the abuse of personal information by both public and private entities, which could increase the degree of privacy protection.27 In 2011 guidelines were circulated for public consultation in 2011.28 The Seventh Amendment to the Criminal Law prohibited any staff member or State body, or an organisation of finance, telecommunication, transportation, education, or health care, etc., from selling or illegally disclosing citizens' personal information during the course of performing duties or providing services.29 Furthermore, the ability of Internet Service Providers (ISPs) to use and distribute personal data gathered through the Internet is also being limited in the Tort Liability Law. This law allows a private person to sue for damages or other remedies in tort in cases where medical records are mishandled and in cases where the Internet is used to harm the interests of the private citizen or, more generally, in cases where the private citizen's right of privacy, health, name, reputation, honour or portrait has been infringed upon and damage has resulted.30 Several newly drafted regulations also reflect the trend toward enhancing China's capacity to protect personal information belonging to its citizens.31

There are relatively few cases concerning privacy protection in China since the General Principles of Civil Law. However, as the Internet facilitates collection and dissemination of personal information of netizens (citizens of the internet), the number of judicial cases concerning online privacy is growing.

In particular, there is a phenomenon known as 'renrou sousuo', literally meaning "the search for human flesh". What happens is that there will be "a call to identify a particular individual through mobilising individuals on the Internet with the single aim to dig out facts and expose the target to the baleful glare of publicity."32 Netizens are asked to provide information on a particular individual or individuals until a full picture emerges in this cyber relay. Very often, personal contact information including names, phone numbers, and addresses, is circulated widely on the Internet beyond the control of the targeted individuals. Although this may be more often used to expose corrupted officials or to punish those who have violated social norms, children and minors can be victims.

In 2008, the Beijing Court condemned such behaviour in the first case on human flesh search engine in the Wang Fei case. The case began as a family tragedy in Beijing. In 2007, an aggrieved wife jumped to her death after discovering that her husband, Wang Fei, had been unfaithful. Before her suicide, the wife disclosed her frustration and the reason for her suicide on her blog, placing the blame on Wang. After her death, many netizens were so angry at Wang that they searched for, collected, and eventually disclosed his personal contact information and that of his family and the third party who allegedly broke up the marriage. Death threats were left outside Wang's and his parents' homes, and Wang resigned from his job in the face of social pressure. Since the death of his estranged wife at the end of 2007, Wang had not been able to find work as a designer. Eventually, he brought a claim successfully against a blog writer and an ISP before a Beijing District Court to protect his privacy. Another ISP involved was found not liable because it had removed the objectionable materials and information within a reasonable time. For the first time, a Chinese court addressed the issue of cyber violence, referring specifically to the alarming trend of using the human flesh search engine to hunt down individuals.33 In addition, the court addressed the issue of privacy directly.34 It called for privacy protection reform from the Ministry of Information Industry shortly after delivering the judgment.35 In its decision, the court explained that privacy referred generally to a person's private interest and personal relations, including one's personal life, personal information, personal space, secrets, and any aspect of life that an individual would not like to share with the world.36 Hence, any unauthorised disclosure or dissemination constitutes a violation of a person's privacy interests.37

Despite this important development, legislative intervention remains the best solution to the present legal ambiguity. While the Tort Liability Law was enacted in 2009 and includes a right to privacy in its list of protected civil rights and interests,38 the exact scope of this right and its impact on halting acts of cyber-bullying or human flesh search is not known. In particular, Article 36 of that legislation states that an ISP may incur liability for failing to remove the objectionable content once notice of a tortuous infringing act has been received.

Another case concerning privacy on the Internet involved Tencent and Qihu 360, the two competing Internet giants in China. In late 2010, Qihu 360 criticised QQ, provided by Tencent and one of the most popular instant messaging software programs in China, for collecting users' personal data and monitoring their computers and private information.39 To help people protect themselves, Qihu 360 developed free safeguard software to restrict some of QQ's features, greatly reducing the advertisement revenue Tencent derived from those features. Tencent quickly announced that QQ was incompatible with all Quihu 360's products, forcing users to choose between the two. Under government pressure, the two companies finally ended their battle. However, the privacy problem was never resolved. Users have no power to bargain with the giants and protect the privacy of their computers.