On Friday, August 8, 2014, a Chinese court convicted British fraud investigator Peter Humphrey and his wife, Yu Yingzeng, a naturalized US citizen, of illegally obtaining personal information.  Mr. Humphrey was sentenced to two and a half years in prison and fined RMB 200,000 (about US $32,000); Ms. Yu was sentenced to two years in prison and fined RMB 150,000 (US $24,000).  For more information on the original arrests and Mr. Humphrey’s subsequent confession on state-owned TV, please see our earlier blog post. 

The husband and wife team ran a China-based consulting firm, ChinaWhys Co., that specialized in providing risk advisory services to multinational companies doing business in China.  Under China’s Criminal Law, companies and individuals are subject to criminal penalties for illegally selling or obtaining the personal information of others where such violation is “serious.”  Prosecutors alleged that the couple violated the law’s prohibition on illegal obtainment by collecting 256 personal information records, including hukou (city residential permit) information, family information, and travel and phone records.  According to prosecutors, ChinaWhys purchased this information for RMB 800 to RMB 2000 (about US $130 to $325) per record and used it in background investigation reports prepared for ChinaWhys’ clients.

The allegations set forth in court transcripts focus on several reports that ChinaWhys had prepared for German and Finnish clients that allegedly included personal information purchased from Chinese companies.  In their defense, Mr. Humphrey and Ms. Yu claimed that (i) ChinaWhys purchased a service rather than the information itself; (ii) most of the information was available through public records; (iii) ChinaWhys provided an overall report and not specific personal information records; and (iv) any personal information contained in the reports was limited and therefore did not constitute a violation “serious” enough to constitute a violation of the Criminal Law.  In their closing address, Mr. Humphrey and Ms. Yu noted that they carried out their investigations to help companies avoid corruption and fraud, and that they were unaware that some aspects of their investigations were not permitted by law. 

The Humphrey/Yu case is part of a recent uptrend in data privacy-related criminal proceedings in China, but rumors that political factors may have contributed to the couple’s prosecution suggest that this case may not serve as a typical example of such actions (for perhaps a more representative example, see this earlier decision against Dun & Bradstreet).  The verdict also follows a recent wave of government enforcement actions against foreign companies in China, most recently in the anti-corruption and antitrust contexts, and reflects the growing concern that foreign companies are being unfairly targeted in such investigations.    

For those responsible for data privacy in China, the case indicates that prosecutors can establish a “serious” case of illegally obtaining personal information with a relatively modest showing of facts.  Companies with operations in China should check their treatment of personal information to ensure that their collection, use, and transfer of personal information comply with China’s numerous data privacy laws and regulations.