Case summary

According to the plaintiff surnamed Luo, the app run by the defendant required users to fill in information including name, occupation, learning purposes and English language level before they could log onto the app, without disclosing its privacy policies, which constituted forcibly collecting user profile information. In addition, the defendant sent marketing messages and shared Luo's information with related apps without Luo's approval, which infringed upon Luo's personal information right. Luo sued the defendant at the Beijing Internet Court (BIC), claiming disclosure of Luo's personal information from the app operator, cessation of the infringement, deletion of Luo's personal information from the app, an apology and compensation for losses.

The app operator argued that, due to the nature of the defendant's service which was recommending contents matching users' different needs, it was necessary to collect related information, which is in line with the principle of necessity in collecting personal information. Also, the information is filled by the users themselves, which means that when they do so they agree to the defendant's information collection.After investigation, the BIC found that in order to log on to the app, the plaintiff is required to first input a username and password. After clicking the "log on" button, a questionnaire including user's occupation, learning purposes and English level appeared. After that, a page to fill in basic personal information including Chinese and English names appeared. All those questions needed to be answered for a successful registration. Throughout the whole process, there was no options to skip any questions, nor prompts concerning agreement on the information collected. The plaintiff also submitted evidence that for new users of the app, before the questionnaire started, a page on personal information collection authorization appeared. Without clicking the "agree" button, the user could not proceed.   

After trial, the court concluded that:

According to related industrial regulations, information pushing based on personalized choices should not be indispensable or the only push mode. Other options such as a non-targeting kind or rejection of the personalized choice mode should be provided. Therefore, the defendant could not claim that collecting user profile information is a precondition of their services.

In terms of functional setting of the app, the necessary criteria in fulfilling the contract should be the basic services provided by the app operator, or the additional services based on the user's own choices. The defendant's argument of pushing personalized notification based on users' different needs can be deemed as an action to enhance user experiences. It cannot be deemed as a basic or necessary service to fulfill the contract.

The registration process of the app did not provide "skip" or "reject" options for the information collecting, which made filling in all information the only way to log on and use the app. Users had to agree to submit all the information in order to use the app. Such agreement was forcible and could not be deemed as valid.To sum up, the defendant's collecting unauthorized user profile information was not necessary to fulfill the contract. The defendant thus committed infringement. Also, the defendant's sending marketing messages and sharing the user's information with other apps constituted infringement. The BIC thus supported the plaintiff's right to approve any information submission and to prevent any copying of the information submitted.

Details of the judgement:

The BIC ordered the defendant to provide a copy of the plaintiff Luo's personal information on the app, delete it from and stop processing it on the app. The defendant was also ordered to apologize and compensate Luo with 2,900 yuan ($418.6) as costs for protecting his rights.

Expert comments:

Liu Xiaochun, executive director of the internet judiciary research center of the University of Chinese Academy of Social Sciences, commented on the judgment of the case.

According to her, in the digital era, the utilization, flow and protection of data as a production factor, has become important in building the cyberspace governance order. The establishment and improvement of rules for protection and handling of user profile information as typical personal information, has key regulatory significance to the development of the mobile internet industry.

In this case, the court confirmed the legal attribute of user profile information as personal information, and clarified two key rules in its collecting and processing. One is whether the user's approval is needed for the information collection. The court held that if personalized recommendation is not the basic service of the app involved, the collection of user portrait information is not indispensable for the performance of the contract, and thus requires the approval of users. The other is how to determine "valid approval". In this case, the defendant's information collecting was forcible, and the user's approval should not be deemed valid. The court's judgment established clear standards for the application of legal rules for the industrial application of user profile information, and can provide clear guidance for processing personal information including the user profile information, which is conducive to the standardized, orderly and healthy development of the digital economy industry. 

This article is taken from the Internet Court and we would like to express our gratitude.