Courier company infiltrated, user information sold; thinking "I didn't know" can escape liability? Dream on!
[4] Compiled from: Red Star News
Case review
The annual “Double Eleven” shopping festival is approaching, and for many online shoppers, it’s time to brace for a flood of deliveries. However, with the surge in parcel volume, personal information security may also face the risk of leakage. Every express package bears a “waybill,” which is mainly used to record information such as the sender, the recipient, and the type of goods, and also contains the recipient’s name, phone number, home address, and other private details. Recently, these waybills have been openly priced and sold in bulk online, and the situation has become rampant.
How is the personal information on these waybills stolen? It turns out that these criminal groups, in order to illegally profit from the personal information contained in express packages, have resorted to temporarily applying for jobs at courier companies. Then, while sorting parcels, they secretly photograph the waybills, compile the information, and resell it online.
According to news reports, after entering keywords such as “express delivery” and “waybill” on Baidu Tieba, many related categorized groups appear. To evade crackdowns, lawbreakers use code words as substitutes.
In Baidu Tieba’s “Express Delivery Bar,” this trafficked courier information is commonly referred to by abbreviations such as “liao” and “cai.” It is understood that courier waybills are categorized by buyers into “real-time” and “historical” types, with real-time waybills being the most sought-after so-called source of goods. A seller named “Orange” stated that for more than 1,000 real-time waybills, the price is 3.5 yuan each, while premium waybills are 4 yuan each; historical waybills are only accepted for vehicle-mounted, children’s clothing and shoes, and cosmetics categories, at 1.5 yuan each.
Personal Information Protection Law of the People's Republic of China
Article 51: Personal information processors shall, based on the purpose and method of processing, the type of personal information, the impact on individuals' rights and interests, and potential security risks, take the following measures to ensure that personal information processing activities comply with laws and administrative regulations, and prevent unauthorized access as well as leakage, tampering, or loss of personal information:
(1) Formulate internal management systems and operational procedures;
(2) Implement classified management of personal information;
(3) Adopting corresponding security technical measures such as encryption and de-identification;
(4) Reasonably determining the operational authority for personal information processing, and regularly conducting security education and training for employees;
(5) Formulating and implementing emergency response plans for personal information security incidents;
(6) Other measures stipulated by laws and administrative regulations.
Article 58: Personal information processors that provide important internet platform services, have a huge number of users, and involve complex business types shall fulfill the following obligations:
(1) Establishing a compliance system for personal information protection in accordance with national regulations, and setting up an independent institution mainly composed of external members to supervise the protection of personal information;
(2) Follow the principles of openness, fairness, and impartiality, establish platform rules, and clarify the norms for handling personal information and the obligations to protect personal information for product or service providers on the platform;
(3) Cease providing services to product or service providers on the platform that seriously violate laws and administrative regulations in handling personal information;
(4) Regularly publish social responsibility reports on personal information protection and accept public supervision.
[1] The author's perspective
Starting from November 1, the Personal Information Protection Law of the People's Republic of China officially took effect. It explicitly specifies the obligations that personal information processors must fulfill, such as establishing and improving a compliance system for personal information protection, regularly publishing social responsibility reports on personal information protection, and accepting public oversight.
Since express delivery has become an indispensable part of daily life, and because it involves people's most private aspects, it is very necessary to strictly regulate it. There are two reasons for this:
First, to respect the right to personal privacy. A single express delivery slip not only reveals a person's name and phone number, but those with malicious intent can also use the phone number to find accounts such as WeChat and Alipay, as well as information like home or work addresses, consumption habits, and financial capacity.
Second, preventing fraud and other illegal activities. In recent years, it has become commonplace for scammers to obtain personal express delivery information and impersonate "e-commerce customer service representatives" or "couriers" to commit fraud. Fraud tactics such as "sending return links to steal bank account information" and "claiming compensation for lost packages" are endlessly varied, and a moment of carelessness can easily lead one into a trap, resulting in financial loss.
In summary, since relevant laws have been enacted, the obligated parties must strictly comply and enforce them, especially courier companies. Although the courier company in this case was initially unaware that someone had infiltrated solely to steal user information, hiring employees and ensuring confidentiality is within their scope of responsibility. It is precisely because courier companies hold vast amounts of user data that they should establish a comprehensive management system to ensure user safety.
