Courier company infiltrated, user information sold; thinking "I didn't know" can escape liability? Dream on!
[4] Compiled from: Red Star News
Case review
The annual "Double Eleven" is approaching, and for many online shoppers, it's time to welcome the wave of deliveries. However, with the increase in parcel volume, personal information security may also face the risk of leakage. On each express package, there is a "waybill" that records details such as the sender, recipient, and type of goods, including the recipient's name, phone number, home address, and other private information. Recently, these waybills have been openly sold in bulk online at marked prices, a situation that has become rampant.
How is the personal information on these waybills stolen? It turns out that these criminal groups, in order to illegally profit from the personal information contained in express packages, have resorted to temporarily applying for jobs at courier companies. Then, while sorting parcels, they secretly photograph the waybills, compile the information, and resell it online.
According to news reports, after entering keywords such as "express delivery" and "waybill" on Baidu Tieba, many related groups appear. To evade crackdowns, criminals use coded language as substitutes.
On Baidu Tieba's "Express Delivery Bar," these trafficked express information items are often referred to as "material" or "vegetable." It is reported that express waybills are categorized by buyers as "real-time" and "historical," with real-time waybills being the most sought-after supply. A seller named "Orange" stated that real-time waybills cost 3.5 yuan each for over 1,000 sheets, premium waybills 4 yuan each, while historical waybills only accept categories like car products, children's clothing and shoes, and cosmetics, at 1.5 yuan each.
Personal Information Protection Law of the People's Republic of China
Article 51: Personal information processors shall, based on the purpose and method of processing, the type of personal information, the impact on individuals' rights and interests, and potential security risks, take the following measures to ensure that personal information processing activities comply with laws and administrative regulations, and prevent unauthorized access as well as leakage, tampering, or loss of personal information:
(1) Formulate internal management systems and operational procedures;
(2) Implement classified management of personal information;
(3) Adopting corresponding security technical measures such as encryption and de-identification;
(4) Reasonably determining the operational authority for personal information processing, and regularly conducting security education and training for employees;
(5) Formulating and implementing emergency response plans for personal information security incidents;
(6) Other measures stipulated by laws and administrative regulations.
Article 58: Personal information processors that provide important internet platform services, have a huge number of users, and involve complex business types shall fulfill the following obligations:
(1) Establishing a compliance system for personal information protection in accordance with national regulations, and setting up an independent institution mainly composed of external members to supervise the protection of personal information;
(2) Follow the principles of openness, fairness, and impartiality, establish platform rules, and clarify the norms for handling personal information and the obligations to protect personal information for product or service providers on the platform;
(3) Cease providing services to product or service providers on the platform that seriously violate laws and administrative regulations in handling personal information;
(4) Regularly publish social responsibility reports on personal information protection and accept public supervision.
[1] The author's perspective
From November 1, the "Personal Information Protection Law of the People's Republic of China" officially came into effect, which explicitly mentions the obligations that personal information processors need to fulfill, such as establishing a sound compliance system for personal information protection, regularly publishing social responsibility reports on personal information protection, and accepting public supervision.
Since express delivery has become an indispensable part of daily life, and because it involves people's most private aspects, it is very necessary to strictly regulate it. There are two reasons for this:
First, to respect the right to personal privacy. A single express delivery slip not only reveals a person's name and phone number, but those with malicious intent can also use the phone number to find accounts such as WeChat and Alipay, as well as information like home or work addresses, consumption habits, and financial capacity.
Second, to prevent illegal activities such as fraud. In recent years, it has become common to see news about fraudsters obtaining personal courier information and impersonating "e-commerce customer service" or "couriers" to commit fraud. Fraud methods such as "sending return links to steal bank account information" and "lost package, merchant compensation" are increasingly varied, and a moment of carelessness can easily lead to falling into a trap, resulting in property loss.
In summary, since relevant laws have been enacted, the obligated parties must strictly comply and enforce them, especially courier companies. Although the courier company in this case was initially unaware that someone had infiltrated solely to steal user information, hiring employees and ensuring confidentiality is within their scope of responsibility. It is precisely because courier companies hold vast amounts of user data that they should establish a comprehensive management system to ensure user safety.
