China intensifies crackdown on misuse of personal data

China's prosecuting authorities have stepped up efforts to protect personal data, prosecuting more than 5,400 people and filing 4,086 public interest litigation cases involving personal information infringement in the first 11 months of 2025, according to data recently released by the country's top procuratorate.

The crackdown is part of broader efforts to strengthen personal information protection since the Personal Information Protection Law took effect on Nov 1, 2021. The Supreme People's Procuratorate said it has guided procuratorial organs nationwide to take proactive action, deepen comprehensive cybersecurity governance and expand the role of public interest litigation in internet regulation.

To address key risk scenarios and refine regulatory oversight, the SPP on Thursday released a batch of relevant cases involving high-priority focus areas such as smart parking systems, facial recognition in residential communities, fraudulent online recruitment, doxing, leaks of personal data belonging to the deceased and their relatives, and misuse of such information by scalpers and travel agencies.

One of the cases involved medical and emergency personnel in Shanghai's Minhang district, who exploited their positions to sell sensitive personal data for profit between July 2021 and March 2025. Doctors from local hospitals and emergency workers from the district's emergency center accessed more than 800 sets of personal information related to the deceased and their families through the municipal disease control information system or in-vehicle ambulance displays.

The leaked data included addresses, times and causes of death, as well as relatives' names and contact details. The information was sold to funeral service practitioners, who used it for targeted commercial marketing, severely violating the privacy and emotional well-being of bereaved families and harming the public interest.

After discovering clues to the misconduct, the Minhang district people's procuratorate launched a preliminary investigation and formally filed the case on July 11, 2025. Through interrogations of medical personnel, prosecutors identified the methods, scale and profits of the illegal data trade, as well as how the buyers misused the information.

On-site inspections exposed major loopholes in information security protocols. Hospital doctors were able to use shared keys to log into the disease control system and access death reports from across the city, while emergency workers could directly retrieve relatives' contact information from ambulance work displays. The district emergency center also failed to implement effective follow-up measures to prevent data leaks.

In response, the procuratorate issued a procuratorial recommendation to the district health commission on July 31, urging legal penalties for those involved, tighter day-to-day supervision and improvements to management systems.

The health commission moved quickly and established a special task force to investigate and rectify the problems. Administrative penalties were imposed on the hospital involved. Doctors received warnings, fines and suspensions of their practice rights, while emergency workers involved had their outsourced labor contracts terminated.

Additional safeguards were introduced with higher-level approval, including tighter access controls for the disease control information system and the removal of nonessential personal data from ambulance displays. The commission also instructed relevant units to upgrade information security and death certificate management systems, carry out mandatory staff training and establish a traceable follow-up inspection mechanism.

An official from the SPP's public interest litigation department said "justiciability" remains the core principle in handling personal information protection cases, ensuring targeted and standardized law enforcement.

By resolving "small yet pivotal" cases in high-risk scenarios, procuratorial authorities aim to carry out an intensive campaign against prominent personal information protection problems, the official said.

The official added that the SPP will further strengthen coordination with relevant authorities, improve cross-regional cooperation mechanisms and advance comprehensive governance and supervision. Building specialized, interdisciplinary case-handling teams, encouraging public participation, applying technological tools and improving the legal framework for personal information protection were also listed as key priorities.