---
title: "One Signature, Two Documents: A Beijing Financial Court Ruling and the Case for Asking for Less Consent"
author: "DCC Editorial"
published: 2026-10-26T13:00:00.000Z
url: https://datacompliancechina.com/posts/beijing-financial-court-bond-signature-consent-not-formed/
description: "A bank customer buying RMB 100,000 of savings bonds signed electronically three times; the bank applied the first signature both to the bond slip and to a 'Personal Information Authorization Letter'. The courts held the authorization was never formed, at first instance and on appeal, where the Beijing Financial Court ruled on December 30, 2024 ((2024)京74民终1694号). The bank had not drawn attention to the document, the customer did not stop to read it, and there was no sign of the separate tick-box step the letter itself required. 数据何规 (What Rules for Data) agrees with the courts' scrutiny of what the customer knew. It parts company with their reasoning, which treats PI consent as contractual mutual assent. Following Cheng Xiao and Gao Fuping, the author argues that consent under the PIPL is not a declaration of intent, and that withdrawing consent is not rescinding a contract. The practical point is the larger one: where PIPL Article 13 supplies another legal basis, such as performing the contract or a statutory obligation, don't ask for consent at all. Proper notice is then enough."
tags: ["consent", "separate-consent", "legal-basis", "banking", "case-law", "beijing-financial-court", "pipl-article-13"]
laws_cited: ["pipl", "network-data-security-regulations", "app-necessary-pi-scope-provisions"]
domains: ["personal-information", "enforcement", "finance"]
account: "data-he-gui"
original_title: "少弹窗、少勾选、少用同意"
original_author: "数据何规"
original_publication: "数据何规 WeChat Official Account"
original_url: "https://mp.weixin.qq.com/s/5aMU1gGfM5Hk5z1_wUPi3g"
source_language: "zh"
---

> **Source: Data Compliance China** — https://datacompliancechina.com/posts/beijing-financial-court-bond-signature-consent-not-formed/ · China data law, translated and annotated for overseas counsel. Cite as: Data Compliance China, "One Signature, Two Documents: A Beijing Financial Court Ruling and the Case for Asking for Less Consent", https://datacompliancechina.com/posts/beijing-financial-court-bond-signature-consent-not-formed/
> *Editor's Note — DCC.*
>
> This brief translates 数据何规 (What Rules for Data)'s commentary on a
> civil judgment of the **Beijing Financial Court**,
> **(2024)京74民终1694号**, decided **December 30, 2024**. The post appeared
> on October 20, 2026, and names no author; "I" below is the post's author.
> The facts are as the author reads them from the second-instance judgment.
> DCC has not independently obtained the judgment text.
>
> Two pieces of background help. First, the courts relied on Articles 14,
> 17, and 23 of the [Personal Information Protection Law](/laws/pipl/).
> Respectively, these cover consent that is informed, voluntary, and
> explicit; the content of the notice; and separate consent for providing
> personal information to another handler. The courts also relied on
> Article 134 of the Civil Code, under which a civil juristic act is formed
> by the parties' mutual declarations of intent. Second, the author's main
> argument rests on PIPL Article 13(2): where one of the non-consent grounds
> in Article 13(1)(2)–(7) applies, such as performing a contract or a
> statutory obligation, no consent is required. For a related argument about
> one-click "authorization", see DCC's
> [AI Agents and the Limits of Consent](/posts/ai-agents-and-the-limits-of-consent/).

The original title is "Fewer Pop-ups, Fewer Tick-boxes, Less Consent".

I recently came across a judgment of the Beijing Financial Court,
(2024)京74民终1694号. When a customer bought government bonds, a single
electronic signature was applied both to a business slip and to a
*Personal Information Authorization Letter*. The court ultimately held that
the authorization letter was never formed.

The more important question, though, comes before any of that. Before
asking a customer to sign, tick, or click "agree", did anyone check whether
the processing actually needs consent?

## I. The facts and the judgment

On June 10, 2023, a customer surnamed Wang (王某某) went to a bank to buy
RMB 100,000 of savings government bonds and signed electronically three
times during the transaction. The bank admitted that the first signature
was applied both to the *Bond Business Slip* and to the *Personal
Information Authorization Letter*. The letter covered the collection,
storage, use, and transmission of customer information, and the provision
of information to the bond registration and custody institution.

Wang later discovered the authorization and asked the bank to revoke it.
The bank refused, saying the account still held bonds and its system could
not process the request. According to the second-instance judgment, Wang
first sued to have the documents rescinded. At the first-instance hearing,
Wang expressly asked the court to confirm that the authorization letter was
never formed. Wang also asked the court to hold the bank liable for any
related harm in the future.

On the evidence, including video recordings, the first-instance court
found three things. The bank had not adequately drawn attention to the
content of the document. Wang had not paused to read it. And there was no
sign of the separate tick-box step that the letter itself required. Citing
PIPL Articles 14, 17, and 23 and Civil Code Article 134, the court
confirmed that the authorization letter was not formed and dismissed Wang's
other claims. Wang appealed anyway. On December 30, 2024, the Beijing
Financial Court dismissed the appeal and upheld the original judgment.

## II. Consent to processing is not contractual assent

Both the bank and the court may have conflated the formation of a contract
with consent to the processing of personal information.

I agree with the court's examination of what the customer knew. I have
reservations about its reasoning, which judges the consent by asking
whether the parties reached mutual assent. Professor Cheng Xiao (程啸)
argues expressly that consent in personal information processing "is not a
declaration of intent and is not a civil juristic act". Nor do the
individual and the handler reach mutual assent to create, change, or
terminate a civil legal relationship. Consent to the processing should
still be examined under PIPL Article 14, which asks whether it was fully
informed, voluntary, and explicit. It cannot be made to depend, across the
board, on the parties having reached contractual assent. So the judgment's
long discussion of whether the parties' declarations of intent met, and of
whether a contract was formed, struck me as deeply awkward. This is not a
bilateral contract at all.

Rescinding a contract and withdrawing consent should also be kept apart.
The appeal court said the authorization letter was never formed and so
could not be rescinded. That answered Wang's claim to rescind the
documents, but the reasoning does not fully address the difference between
the two. An individual can withdraw valid consent as the law allows,
without having to prove a ground for rescinding a contract, such as fraud
or gross misunderstanding. If valid consent was never obtained, the bank
cannot rely on the signature as consent, and it cannot require the customer
to "withdraw" first before the error is corrected.

Professor Gao Fuping (高富平) puts it as "consent ≠ authorization". Obtaining
consent does not give a handler freedom to use the information
unconstrained by law. Consent to processing is not a blanket authorization
on a piece of paper, and it cannot replace review of whether the processing
itself is lawful and reasonable. What the bank really needs to sort out is
which processing requires consent, what consent it actually obtained, and
what happens when a customer refuses or withdraws. That is also why it is
debatable whether the document in this case should have been called a
"Personal Information Authorization Letter" at all. More on that below.

## III. Before the pop-up, ask whether it is needed at all

My core view is this: if there is another legal basis, never use consent
or separate consent. The notice can then go into the privacy policy or the
contract, and you don't have to worry about consent being withdrawn.
Collecting consent indiscriminately through pop-ups and tick-boxes is
unwise, commercially and for compliance.

PIPL Article 13(2) provides that in the circumstances in items (2) to (7)
of Article 13(1), the individual's consent is not required. That includes
separate consent. Where the processing really is necessary to perform a
contract, fulfil a statutory obligation, or the like, separate consent does
not become necessary merely because sensitive personal information is
involved or information is provided to another personal information
handler.

I have argued this at length before, in "Can separate consent really be
waived?" (单独同意真的可以被豁免). Article 22 of the
[Regulation on Network Data Security Management](/laws/network-data-security-regulations/)
also places the separate-consent requirement for sensitive personal
information under the premise of "processing based on the individual's
consent".

In this case, the necessary processing (subscription, debiting the funds,
interest payment and redemption) should first be tested against the
contract-performance basis. The *Administrative Measures for Savings
Government Bonds (Electronic)* also set requirements for business records,
reconciliation of custody balances, and transmission of business data. Those
provisions let you check further whether specific processing can rest on a
statutory obligation.

If those bases cover every data field and every scenario, you do not need
a separate authorization letter at all. Proper notice is enough. Notice can
usually go into the business contract or the transaction page; it does not
need to be a stand-alone document.

If you do produce a separate document and it only gives notice, I suggest
calling it a *Personal Information Processing Notice*. If consent is
genuinely needed, call it a *Personal Information Processing Notice and
Consent Form*, and spell out the matters on which the customer has a real
choice.

While I'm at it, a gripe about app and mini-program splash screens. The
moment you open one, you are asked to tick the privacy policy, sensitive
personal information, provision to third parties, cross-border transfer,
minors, and more, and you cannot get in if you miss a single box. Splitting
the matters into several boxes does not by itself mean the user has a real
choice.

If a processing activity happens only when a particular feature is used,
the notice and consent can usually be handled when the user turns that
feature on, before processing starts. There is no need to ask, at the
splash screen, for consent covering every future scenario at once.

Where the personal information of minors under 14 is involved, guardian
consent and the dedicated processing rules must also be implemented. Having
every user tick a children's clause does not amount to guardian consent.

Necessary processing that by law does not rely on consent cannot be
withdrawn. Processing that does rely on consent should come with a
convenient way to withdraw. Tying every activity to a single
"authorization" switch, and then refusing all withdrawals because the
account still has a balance, creates needless conflict over problems that
could have been handled separately.

Pop-ups, tick-boxes, and signatures are not free. They take up customers'
time and add friction. Combined with blanket authorizations nobody can
understand, and with service cut off for anyone who refuses, they can also
trigger complaints, erode trust, and even drive customers away.

Before compliance staff ask the business to add a step, they should weigh
what legal problem it solves, whether it is really necessary, and what it
does to customers and the business.

Privacy compliance is not done once the splash screen has popped up every
option for sensitive personal information, provision to third parties, and
children's personal information.

Real problem-solving means mapping the processing activities and their
legal bases first. Only then decide whether to obtain consent, when to
obtain it, and which feature a refusal affects.

Where a process is legally unnecessary and also hurts the user experience,
compliance staff should push to simplify it, not keep adding pop-ups and
tick-boxes.

Anything else is ineffective, lazy compliance, and it deserves to be
scorned.

## References

1. Beijing Financial Court, Civil Judgment (2024)京74民终1694号, December 30, 2024; see "the first-instance court held", "this court holds", and the operative part. The facts follow the second-instance judgment's account of the first-instance proceedings and facts; this article uses the judgment's own wording.
2. Cheng Xiao (程啸), "On Individual Consent in the Processing of Personal Information" (论个人信息处理中的个人同意), *Global Law Review* (环球法律评论), 2021 No. 6, Part I, "The nature of individual consent". Quoted from the text published on the journal's WeChat account.
3. *Personal Information Protection Law of the People's Republic of China*, Articles 6, 13–18, 23, 28–31, 50, and 55–56. https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm
4. Gao Fuping (高富平), "Consent ≠ Authorization: Analysis of the Core Issue in Personal Information Processing" (同意≠授权——个人信息处理的核心问题辨析), *Exploration and Free Views* (探索与争鸣), 2021 No. 4, pp. 87–94; see "The private-law effect of the information subject's consent in China" and "Conclusion". Quoted from the text published on WeChat.
5. 数据何规, "Can Separate Consent Really Be Waived?" (单独同意真的可以被豁免).
6. *Regulation on Network Data Security Management*, Article 22. https://app.www.gov.cn/govdata/gov/202409/30/520076/article.html
7. Ministry of Finance and People's Bank of China, *Administrative Measures for Savings Government Bonds (Electronic)*, 财库〔2013〕7号, Articles 22, 25, 26, and 37. https://www.mof.gov.cn/gkml/caizhengwengao/wg2013/wg201302/201304/t20130415_824929.htm
8. *Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications*, Articles 3–5. https://www.cac.gov.cn/2021-03/22/c_1617990997054277.htm

---

— *数据何规 (What Rules for Data), 少弹窗、少勾选、少用同意 (Fewer Pop-ups,
Fewer Tick-boxes, Less Consent), October 20, 2026.
[Original (Chinese).](https://mp.weixin.qq.com/s/5aMU1gGfM5Hk5z1_wUPi3g)*

— Not legal advice.