QR code ordering infringes on privacy, catering company compensates and apologizes

[2] Compiled from: People's Court Daily
 
Recently, the Beijing Third Intermediate People's Court concluded a personal information protection dispute case. After trial, the court held that a certain catering company, when providing QR code ordering services, set up a WeChat program to forcibly obtain personal information and it could not be deleted by the users themselves. The actions of the catering company constituted an infringement on consumers' personal information rights.

 
 

Case review
On July 27, 2021, Kong was dining at a certain restaurant company. The staff did not inform Kong that he could place an order manually, so Kong placed an order and made payment through the aforementioned mobile phone scanning method. During this process, Kong was registered as a member of the restaurant company. Kong discovered that after unfollowing the restaurant company's WeChat public account, he was still a member of the restaurant company, and his personal information was still stored by the company, which Kong could not delete on his own.
 
Kong believes that a certain catering company’s method of ordering via QR code forcibly obtains consumers' personal information, and consumers cannot delete the personal information stored by the merchant on their own. Therefore, he sued the catering company in court, requesting it to stop infringing on personal information rights, disclose the handling of personal information, apologize, and compensate for the related losses.   
 
The court of first instance held that a certain catering company did not constitute infringement, but should respect Kong's right to decide on his personal information, and ruled that the catering company should delete the personal information related to Kong. Kong was dissatisfied and filed an appeal with the Beijing Third Intermediate Court.
 
The court, after trial, found that while dining at a certain catering company, Kong was not informed by the staff that he could place orders manually. The catering company admitted that it stored the consumer information it obtained with a third-party service provider, but when Kong dined at the catering company, the store did not display the purpose, method, and scope of collecting consumer personal information through QR code ordering, nor did the company notify Kong in any other way. The catering company stated that deleting membership information requires consumers to submit a written request, but it did not inform Kong of this requirement in any way.   
 
After trial, the court held that the processing of personal information includes the collection, storage, use, processing, transmission, provision, and disclosure of personal information. When processing personal information, the principles of legality, fairness, and necessity shall be followed, excessive processing shall not be conducted, and the consent of the natural person or their guardian shall be obtained.
 
The Beijing Third Intermediate People's Court ruled that a certain catering company must stop infringing on Mr. Kong's personal information rights, delete the personal information collected from Mr. Kong; provide Mr. Kong with written notice of the scope and methods of processing his personal information; issue a written apology to Mr. Kong for infringing on his personal information rights; and compensate Mr. Kong 5,000 yuan for notarization fees.
 
 
《 [1] The People's Republic of China Personal Information Protection Law
Article 44
An individual has the right to know and decide about the processing of their personal information, and has the right to restrict or refuse others from processing their personal information, except as otherwise provided by laws or administrative regulations.
 
 
[1] The author's perspective
With the development of the information society, scanning a QR code to order has become an important ordering method in the current catering industry. For consumers, QR code ordering is convenient, accurate, and fast; for the catering industry, QR code ordering helps save labor costs and improve ordering efficiency. However, the popularization and development of QR code ordering services should not become a hidden danger to the security of consumers' personal information. When setting up a QR code ordering program, merchants should aim to facilitate ordering and improve service quality; if they forcibly obtain consumers' personal information beyond what is necessary for ordering, they should bear the corresponding legal responsibility.