Compiled from: The Beijing News, Sina News
 
Case review
On April 6, 2017, the client Zhao (Party A) and the trustee Beijing Lianjia Real Estate Brokerage Co., Ltd. (hereinafter referred to as Lianjia Company) (Party B) signed a "House Sale Entrustment Agreement," which mainly stipulated that Party A entrusted Party B to sell Party A's only family residence with a construction area of 89.53 square meters at a total sale price of no less than 11.5 million yuan. Party A shall provide valid documents and materials of the transaction property as the basis for Party B to provide entrustment services, and Party B shall properly keep the house keys, various documents, and materials provided by Party A.

 
 

On the day of signing, Zhao submitted copies of his ID card and copies of the property ownership certificate of the involved house to Yang Moumou and Song Mouyou, who were then agents of Lianjia Company.
 
Subsequently, Song Mouhua, then an employee of Lianjia Company, approached Yang Moumou, also then an employee of Lianjia Company, and asked if he could provide personal information of property owners in the Beiyuan area for Song Mouhua to use in applying for a residence permit. Yang Moumou then provided Song Mouhua with copies of Zhao's ID card and the property ownership certificate of the involved house. Song Mouhua then used Zhao's personal information to forge a lease contract for the involved house, with the lessor Zhao and the lessee Song Mouhua, with a lease term from March 5, 2016, to March 4, 2018. Based on this, Song Mouhua obtained a Beijing residence registration card for himself and his spouse Wu Moumou at the police station, with a start date of December 16, 2016.

 
 

Later, after being discovered by Zhao, on September 4, 2017, Song Mouhua canceled the Beijing residence registration cards for himself and his spouse Wu Moumou, which had the address of the involved house registered.
 
Zhao believed that Lianjia Company, as a real estate intermediary service institution with certain influence in China, should have properly kept clients' personal information. However, Lianjia Company's lax management allowed its employees Song Mouhua and Yang Moumou to take advantage of their positions to obtain Zhao's identity and property information, seriously infringing on Zhao's civil rights and interests. Therefore, Zhao filed a lawsuit with the court.

 

 
Relevant legal provisions
Civil Code of the People's Republic of China
Article 111
The personal information of natural persons is protected by law. Any organization or individual that needs to obtain others' personal information must acquire it lawfully and ensure information security, and must not illegally collect, use, process, or transmit others' personal information, nor illegally buy, sell, provide, or disclose others' personal information.
 
Article 1034
The personal information of natural persons is protected by law.
 
Personal information refers to various information recorded electronically or by other means that can identify a specific natural person alone or in combination with other information, including the natural person's name, date of birth, ID number, biometric information, address, phone number, email address, health information, and location information.
 
Private information in personal information is subject to the provisions on the right to privacy; where there are no such provisions, it is subject to the provisions on the protection of personal information.
 
Article 1035
The processing of personal information shall follow the principles of legality, legitimacy, and necessity, and shall not be excessive, and shall meet the following conditions:
(1) Obtain the consent of the natural person or their guardian, unless otherwise provided by laws or administrative regulations;
(2) Publicly disclose the rules for processing information;
(3) Clearly indicate the purpose, method, and scope of processing information;
(4) Not violate the provisions of laws or administrative regulations or the agreement between the parties.
The processing of personal information includes the collection, storage, use, processing, transmission, provision, and disclosure of personal information.
 
Article 1038
Information processors shall not disclose or tamper with the personal information they collect or store; without the consent of the natural person, they shall not illegally provide their personal information to others, except where the information has been processed to the extent that it cannot identify a specific individual and cannot be restored.
 
Information processors shall adopt technical measures and other necessary measures to ensure the security of the personal information they collect and store, and prevent information leakage, tampering, or loss; in the event of or potential occurrence of personal information leakage, tampering, or loss, they shall promptly take remedial measures, notify the natural person in accordance with regulations, and report to the relevant competent authorities.
 
 
[1] Court Opinion
Regarding the liability issue of Song Mouhua
In this case, Song Mouhua, as an employee of Lianjia Company at the time, was aware that employees of intermediary companies would obtain clients' real estate and ID card personal information in the course of performing their duties. Based on this, Song Mouhua, for the purpose of applying for a Beijing residence permit for himself and his family members, asked his relatively close colleague Yang Moudong if he had any owner information in the Beiyuan area, and successfully obtained Zhao Mou's real estate and ID card personal information illegally through Yang Moudong. Subsequently, Song Mouhua used the illegally obtained personal information of Zhao Mou and forged a lease contract with Zhao Mou as the lessor and Song Mouhua as the lessee to apply for a Beijing residence permit, which was only canceled after being discovered by Zhao Mou. Song Mouhua's illegal use of Zhao Mou's personal information constitutes civil infringement and shall bear full liability for compensation for all damages caused by the infringement of Zhao Mou's personal information.
 
[1] Regarding the liability issues of Yang Mou Dong and Lianjia Company
[2] Based on the facts ascertained in this case, Yang Mou Dong, an employee of Lianjia Company at the time, knowing that Song Mou Hua would use Zhao’s information for illegal purposes, still exploited his position to unlawfully disclose and provide Zhao’s personal information to Song Mou Hua. The infringing acts committed by Yang Mou Dong and Song Mou Hua based on a shared intent constitute joint infringement, and they shall bear joint and several liability for the infringement. Article 34 of the Tort Liability Law of the People's Republic of China stipulates that if an employee of an employer causes damage to others while performing work tasks, the employer shall bear the tort liability. In this case, Yang Mou Dong unlawfully disclosed and provided Zhao’s information, obtained during the performance of his work tasks, to Song Mou Hua. His infringing act is intrinsically linked to the performance of his duties. Therefore, his employer, Lianjia Company, shall bear Yang Mou Dong’s tort liability, meaning Lianjia Company and Song Mou Hua shall bear joint and several tort liability to Zhao.
 
[3] Additionally, it must be particularly noted that as a for-profit legal entity that extensively collects clients’ personal information in its business operations, Lianjia Company primarily leverages its market information advantage to provide intermediary services matching buyers and sellers in the real estate market. Thus, mastery of market information is a core element of Lianjia Company’s profitability. In the internal Code of Professional Ethics submitted by Lianjia Company, clients’ personal information is classified as confidential company information, underscoring the importance of client information to Lianjia Company’s business profitability. While utilizing client information for profit, Lianjia Company bears a duty of safekeeping for client information that is higher than that of ordinary business entities.
 
[4] In this case, Lianjia Company, as a real estate brokerage service provider, and its agent Yang Mou Dong, through his performance of duties under the House Sale Entrustment Agreement, became lawful users and processors of Zhao’s ID information and property ownership certificate information. Lianjia Company and its agent should ensure that their use of Zhao’s personal information is solely for fulfilling the contractual purpose of the House Sale Entrustment Agreement.
 
[5] However, as the manager of its employees, Lianjia Company failed to establish management systems and operational procedures for information security, did not provide risk warnings for client information security, and lacked rigorous and meticulous management measures such as encrypting sensitive client information to ensure client information security. Consequently, it could not ensure that agents cautiously and lawfully used citizens’ personal information in accordance with the agreement. Moreover, as revealed through court investigation, Lianjia Company required agents to photograph and upload clients’ ID cards, property certificates, and contract information to the company’s internal network. Lianjia Company could foresee that such handling methods would significantly increase the likelihood and risk of infringing on clients’ personal information, yet it took no practical and effective operational procedures or other preventive measures to control such risks, allowing employees to easily leak owners’ personal information for illegal purposes.
 
[6] Therefore, the occurrence of the infringement in this case is directly related to Lianjia Company’s internal regulatory loopholes in protecting clients’ personal information. Due to Lianjia Company’s managerial fault, it shall also bear tort liability for the damage resulting from the infringement of Zhao’s personal information.
 
The court's judgment is as follows:
1. Defendant Lianjia Company shall, within ten days after this judgment takes effect, post a public apology to the plaintiff Zhao on the homepage of its official website, with the apology notice lasting for three consecutive days.
 
2. Defendant Song Mouhua shall, within ten days after this judgment takes effect, issue a written apology statement to the plaintiff Zhao and apologize to him.
 
3. Defendants Lianjia Company and Song Mouhua shall, within ten days after this judgment takes effect, jointly compensate the plaintiff Zhao for economic losses of 100,000 yuan.
 
4. The other claims of the plaintiff Zhao are dismissed.
 
 
[1] The author's perspective
The author believes that to define the right to personal information, it is first necessary to clarify what type of civil right the right to personal information belongs to. China's Civil Code, in Part IV on Personality Rights, provides specific provisions for the protection of personal information. This shows that the right to personal information is a personality right. Therefore, the right to personal information refers to the personality right of a natural person to control their own personal identity information and exclude infringement by others, with the object of this right being personal information.
 
[1] In this case, as the carrier of personal information, the name, ID number, address, date of birth, and property information recorded on Zhao’s ID card copy and the property ownership certificate of the involved house clearly fall within the scope of personal information.
 
[2] Personal information is the object of personality rights, not property rights. Therefore, as the object of personality rights, specifically the right to personal information, personal information contains two layers of personality interests:
 
[3] First, personal information primarily includes spiritual personality interests, mainly encompassing the content of human dignity, personal independence, and personal freedom.[4] The integrity and authenticity of personality identifiers are basic conditions for a subject to be respected by others. As a purposive existence, an individual can only have self-respect and be respected by others in life and survival by eliminating doubts and fears about the manipulation of their informational image by others, and by maintaining consistency between their informational persona and their true self without distortion. Therefore, the value of personal information to the information subject’s human dignity, personal independence, and personal freedom is the primary consideration in personal information protection legislation. This constitutes the content of the spiritual personality interests contained in personal information.
 
[5] Second, personal information also contains property-related personality interests.[6] Due to its identity-related nature, personal information has the potential to be used in the market, thus having the possibility of being converted into commercial value, generating property benefits for the rights holder. At the same time, personal information has the identifiability of personal characteristics; once illegally used, it not only generates property benefits for the user but also causes unexpected property losses to the rights holder. Therefore, special protection should be given to the right to personal information.