In September 2024, the Guangzhou Internet Court released its ruling on a civil dispute that was originally issued in September 2023, involving the transfer of personal data outside mainland China. This judgment is reportedly the first judicial judgment on cross-border data transfers.

In this case, an international hotel group based in France, as the defendant, was found liable for illegally transferring the personal data of the plaintiff, an individual Chinese customer, to third parties outside of China for the purpose of marketing, without obtaining the customer’s separate consent prior to providing the data.

It is worth noting that Chinese court judgments (other than those by the Supreme Court) generally do not serve as precedent for future court cases. Having noted that, this case sheds some light, from a judicial perspective, on the interpretation of the Personal Information Protection Law of China (PIPL). Specifically:

• The court confirmed that the scope of personal data collected through the hotel’s booking app for the purpose of hotel reservation and maintaining a loyalty membership program is reasonable; this data includes the name, phone number, email, postal code, address, nationality and bank card number of the individual. 
• The court decided that it is legitimate and necessary to transfer the above personal data to (i) the hotel that the plaintiff requested to book and (ii) the hotel’s central booking system in France, for “performance of contract” with the plaintiff, and thus qualifies as a legal ground under Article 13 of the PIPL, to collect without requiring the consent of the individual.
• The court further affirmed that if a cross-border transfer is based on a legal ground other than consent, then the requirement of “separate consent” as provided under Article 39 of the PIPL does not apply. In other words, only a transfer based on consent is subject to the “separate consent” requirement. It is important to note that there is no “legitimate interest” legal basis under the PIPL.
• The court, however, denied the legitimacy of transferring the plaintiff’s personal data to third parties for purpose of “marketing” as it is not justified as “necessary for performing the contract,” and thus, proper separate consent must be obtained for transferring the plaintiff’s personal data. The fact that the plaintiff agreed to the defendant’s comprehensive “Customer Personal Data Protection Charter” does not constitute a proper separate consent. The judgment does not disclose to whom the plaintiff’s personal data was transferred for marketing and how it was used.

Another interesting takeaway from this judgment is that despite the finding of unlawful data transfer by the defendant, the court only ordered the defendant to (i) delete the plaintiff’s personal data (acknowledging that the plaintiff would also lose his membership with the defendant, which the plaintiff agreed), (ii) apologize to the plaintiff in private, and (iii) compensate the plaintiff’s reasonable expenses incurred in pursuing this case (i.e., the plaintiff’s loss of wages and reasonable lawyer- and translation-fees) of CN¥20,000 (around US$3,000). The court did not seem to support the plaintiff’s claim for “economic loss” of CN¥50,000 (around US$7,000) without elaborating as to the reason. Such judgment seems lenient given that the monetary compensation is probably not enough to cover the plaintiff’s actual cost. This is especially true when the plaintiff simply could have, under the PIPL, simply made a request to the defendant to delete his information.

Having said that, it is an interesting judgment affecting any entity wanting to market to its customers in China.