---
title: "Five Years of PIPL: The Supreme People's Procuratorate's Eight Typical Cases on Personal Information"
author: "DCC Editorial"
published: 2026-11-03T04:00:00.000Z
url: https://datacompliancechina.com/posts/spp-eight-typical-pi-protection-cases-pipl-fifth-anniversary/
description: "On November 2, 2026, the day after the fifth anniversary of the Personal Information Protection Law taking effect, the Supreme People's Procuratorate (SPP) issued eight typical cases on protecting citizens' personal information. Seven are prosecutions for the crime of infringing upon citizens' personal information (Criminal Law Article 253a); the eighth is a civil public-interest suit. DCC translates the SPP's release in full and maps the eight cases for counsel. Four points stand out. Information that is already public is 'not a public resource': compiling rental listings and selling them abroad, beyond the purpose for which they were posted, is the crime (Case 5). A passenger's upcoming flight is 'whereabouts and tracks' information, the most tightly protected criminal category (Case 6). Three of the eight leaks ran through people with legitimate access: insiders at source units, an airline's outsourced call-center agent, and bribed HR staff (Cases 1, 6, 7). And procuratorates now attach public-interest damages to PI crimes, set by sensitivity, scale, public value and cross-border risk rather than by what the offender earned: RMB 4 million against one recruitment-data seller (Case 7) and RMB 1.5 million against two people who scraped 3.86 million cancer-hospital records and moved them overseas, when their proven profit was RMB 10,800 (Case 8). The full notice and all eight cases are on the DCC law page."
tags: ["spp", "supreme-peoples-procuratorate", "typical-cases", "criminal-liability", "article-253a", "public-interest-litigation", "public-interest-damages", "doxxing", "publicly-available-information", "whereabouts-and-tracks", "insider-threat", "health-data", "pipl-fifth-anniversary"]
laws_cited: ["spp-pi-protection-typical-cases-2026", "pi-infringement-criminal-interpretation", "pipl", "civil-code-personal-info", "spp-pi-crime-reply-letter", "healthcare-institutions-data-security-pi-measures"]
domains: ["enforcement", "personal-information", "health"]
account: "supreme-peoples-procuratorate"
original_title: "最高检发布依法保护公民个人信息典型案例"
original_author: "最高人民检察院 (Supreme People's Procuratorate); reported by the Procuratorial Daily (检察日报社)"
original_publication: "最高人民检察院 WeChat Official Account"
original_url: "https://mp.weixin.qq.com/s/6630OBHat79eFY85UO1uiQ"
source_language: "zh"
---

> **Source: Data Compliance China** — https://datacompliancechina.com/posts/spp-eight-typical-pi-protection-cases-pipl-fifth-anniversary/ · China data law, translated and annotated for overseas counsel. Cite as: Data Compliance China, "Five Years of PIPL: The Supreme People's Procuratorate's Eight Typical Cases on Personal Information", https://datacompliancechina.com/posts/spp-eight-typical-pi-protection-cases-pipl-fifth-anniversary/
> *Editor's Note — DCC.*
>
> The Supreme People's Procuratorate (SPP) is China's national prosecution
> service. It decides how personal-information crimes are charged, and it
> is also the main plaintiff in public-interest litigation. This release
> marks five years of the [Personal Information Protection Law](/laws/pipl/),
> which took effect on November 1, 2021.
>
> **What this brief is.** A full translation of the SPP's release note,
> followed by DCC's case-by-case map and reading. The issuing notice and all
> eight cases, translated in full, are on the
> [law page](/laws/spp-pi-protection-typical-cases-2026/). Typical cases are
> issued "for reference": they guide procuratorates but do not bind courts.
> The criminal thresholds they apply come from the 2017
> [PI Criminal Interpretation](/laws/pi-infringement-criminal-interpretation/).
>
> **Related reading.** The police side of the same offense is in DCC's
> brief on the
> [MPS Cyber Security Bureau's ten typical cases](/posts/mps-ten-typical-pi-crime-cases/)
> (August 2026).

## The SPP's release (translated)

**The Supreme People's Procuratorate Issues Typical Cases on Protecting
Citizens' Personal Information in Accordance with Law**

*Focusing on new features of unlawful and criminal infringement of citizens'
personal information. Integrating its functions to safeguard citizens'
rights and interests in their personal information with full force.*

November 1 marked the fifth anniversary of the implementation of the
*Personal Information Protection Law of the People's Republic of China*. On
this occasion, the Supreme People's Procuratorate has issued a batch of
typical cases on protecting citizens' personal information in accordance
with law. The cases focus on the new features and new trends of current
unlawful and criminal infringement of citizens' personal information, and
reveal the serious harm it causes. They guide procuratorates in all
localities to punish such conduct in accordance with law, to keep deepening
the integrated performance of their functions, and to safeguard citizens'
rights and interests in their personal information in accordance with law.

The batch reportedly contains 8 cases. They are typical and exemplary in
respects such as applying the law accurately, punishing crime strictly
along the whole chain, protecting the public interest, and integrating
procuratorial functions to promote social governance.

- **Case 1** makes clear that the black and grey industry chains of
  personal-information crime are to be punished along the whole chain, and
  that procuratorates actively promote governance at the source in response
  to the gaps in information oversight that cases expose.
- **Case 2** stresses punishing, in accordance with law, crimes that abuse
  GPS location technology under the name of "private detectives" to obtain
  citizens' personal information illegally, and that infringe citizens'
  personal and property rights.
- **Case 3** makes clear that crimes exploiting some elderly people's weak
  understanding of the internet and low guard are to be punished severely
  in accordance with law. Procuratorates work with the units concerned to
  remove the effects of the crime, and run legal publicity to help elderly
  people become more aware of risks and better able to guard against them.
- **Case 4** focuses on doxxing ("box-opening") and online-abuse crimes. It
  exposes in full the harm done at each stage and the offenses each stage
  may involve. Procuratorates punish the whole chain and build firm
  defenses for information protection by issuing procuratorial
  recommendations.
- **Case 5** makes clear that illegally obtaining the housing rental and
  sale information posted by a specific group in China, and selling it
  abroad, giving rise to telecom fraud and other crimes, is to be punished
  severely in accordance with law.
- **Case 6** focuses on "fan circle" (饭圈) disorder. For crimes in which
  offenders illegally obtain and sell celebrities' whereabouts and tracks
  information, procuratorates pursue criminal liability in accordance with
  law and also file incidental civil public-interest litigation to pursue
  the corresponding civil liability.
- **Case 7** makes clear that unlawful and criminal infringement of
  citizens' personal information through online recruitment platforms,
  under the pretext of hiring, is to be punished severely in accordance
  with law. Procuratorates file incidental civil public-interest litigation
  in accordance with law to safeguard the public interest in full.
- **Case 8** focuses on illegally obtaining medical and health information.
  The personal information stolen was large in volume and wide in reach,
  the harm was serious, and the cross-border transfer disrupted public
  order. The procuratorate fixed the amount of public-interest damages by
  combining factors such as the sensitivity of the information, the value
  of the data in use, and cross-border risk, and filed civil public-interest
  litigation in accordance with law.

The heads of the SPP's Ordinary Crimes Procuratorial Department and Public
Interest Litigation Procuratorial Department said that in recent years
procuratorates nationwide have grasped accurately the new features and
trends of unlawful and criminal infringement of citizens' personal
information. They have punished prominent offenses in this field in
accordance with law, safeguarded citizens' rights and interests in their
personal information with full force, and pushed comprehensive online
governance deeper and further. Next, procuratorates will continue to
implement Xi Jinping Thought on the Rule of Law in depth and adhere to the
holistic approach to national security. While punishing unlawful and
criminal infringement of citizens' personal information in accordance with
law, they will deepen coordination and comprehensive governance, work to
root out the conditions in which such crime breeds, and provide solid
judicial safeguards for the protection of citizens' personal information
through high-quality, high-efficiency procuratorial work.

## The eight cases at a glance

*DCC's map. Amounts and sentences are as published; full facts and
reasoning are on the [law page](/laws/spp-pi-protection-typical-cases-2026/).*

| Case | Where | Scheme | Charges and outcome | What the SPP draws from it |
|---|---|---|---|---|
| 1. Wang X and 10 others | Jinhua, Zhejiang | A "studio" bought household-registration, property and whereabouts data from overseas "social-engineering databases", paid in virtual currency, and resold it in China; over RMB 1.98 million involved. | Art. 253a; 3 years 6 months to 8 months, with fines (November 2025). | Punish the whole chain, upstream to secondary resale; trace funds through every layer; push the source units of the data to inspect themselves and deal with insiders who leaked. |
| 2. Zhou X-xu and 8 others | Longnan, Jiangxi | "Private detective" consulting company sold "marriage investigations": whereabouts, property and hotel records bought online, plus GPS trackers and covert photography; 18,000+ items, RMB 160,000+; extortion on top. | Art. 253a and extortion; lead defendant 4 years and RMB 200,000 fine (August 2024). | No business model is a license; dig out the upstream suppliers and related crimes; a recommendation led to a clean-up of "private detective" ads online. |
| 3. Pan X and 24 others | Mengzhou, Henan | A "village promotion" gang in 500+ villages "helped" 20,000+ elderly people activate electronic medical insurance credentials, took their IDs and face images, and sold real-name-verified Alipay accounts; RMB 1.8 million+. | Art. 253a; 3 years 9 months to 9 months, with fines; 11 omitted offenders added during review. | Prosecute omitted offenders; sort principals from accessories; those below the criminal threshold get administrative penalties; the platform was asked to flag and restrict the accounts. |
| 4. Chen X-cheng and 5 others | Chengdu, Sichuan | Doxxing. Script intrusion into a provincial affairs platform (16 million+ records), scraping of forums and cloud storage (1 billion+), then doxxing and harassment of 47 people, 5 of them minors. | Illegal intrusion, Art. 253a and picking quarrels; 4 years 5 months to 9 months; upheld on appeal (April 2026). | How to charge doxxing: intrusion plus PI infringement is a notional concurrence (punish the heavier); online abuse is a separate crime. Recommendation to the forum operator on weak privacy and moderation. |
| 5. Liu X | Wuxi, Jiangsu | Set up a real-estate agency to collect rental and sale listings posted directly by women landlords, picked the better-off, and sold 24,000+ records abroad; RMB 190,000+; one victim lost RMB 290,000+ to fraud. | Art. 253a, particularly serious; 3 years 6 months and RMB 200,000 fine (July 2025). | Public information is "not a public resource". Providing lawfully collected PI without consent violates "state provisions"; going beyond the purpose and reasonable use of publication, then selling, is the crime. |
| 6. Shu X-ping | Beijing (Chaoyang) | An airline's outsourced call-center agent looked up celebrities' upcoming flights and sold them in fan groups: 30+ people, 100+ flights, RMB 10,000+. | Art. 253a; 10 months suspended for 1 year, RMB 30,000 fine; public-interest damages and apology; gains recovered on protest (April 2025). | An upcoming flight that pins a person to a future place and time is whereabouts and tracks information. Procuratorates protest judgments that fail to recover illegal gains, and attach civil public-interest claims. |
| 7. Lin X-feng and 20 others | Fuzhou, Fujian | Fake job ads, then a front-end team that bribed other companies' HR staff to pull applicants' data; 870,000+ records sold abroad, settled in virtual currency (RMB 7.46 million+). | Art. 253a and aiding information network criminal activities; 5 years 3 months to 6 months; RMB 4 million and RMB 10,000 public-interest damages, deletion and national apology. | HR staff who misuse recruiting access are "accomplices" and were prosecuted too. Recruitment data harms an unspecified public, so public-interest damages follow. |
| 8. Yuexiu Procuratorate v. Wang XX and Lin XX | Guangzhou, Guangdong | A crawler intruded into a cancer hospital's servers and took 3,858,671 records, moved them to overseas servers for half a year, and sold some; proven profit RMB 10,800. | Civil public-interest suit in the Guangzhou Internet Court; RMB 1.5 million public-interest damages and public apology (August 2026), after a criminal conviction (November 2024). | Forensic examination showed that prescription data linked by an ID-card field is sensitive medical-health PI. Damages were set by sensitivity, volume, public value, fault and cross-border risk, not by profit. |

## What it means for companies

*DCC's reading.* Typical cases do not change the law. They show where
China's prosecution service is pointing procuratorates, and five points
carry beyond the individual offenders.

**1. Public is not free.** Case 5 is the clearest statement yet from the
SPP on reselling publicly available personal information. Its typical
significance says that information already made public is "not a 'public
resource' that may be resold at will". It also says that providing lawfully
collected personal information to others without the consent of the person
it was collected from is "providing citizens' personal information in
violation of state provisions", an element of the Article 253a offense.
And changing the scope, purpose and use for which the information was made
public, beyond reasonable use, then selling it, is the crime where the
circumstances are serious. This tracks the civil rule in
[PIPL Article 27](/laws/pipl/), which allows handling of public information
only "within a reasonable scope". It matters to anyone whose product or
data supply compiles listings, profiles or contact details scraped from
public pages. The facts were bad: Liu targeted women landlords by wealth
and sold abroad to fraudsters. But the stated rule is general.

**2. Insiders and vendors are the leak.** In three of the eight cases the
data left through people with legitimate access. In Case 1 the SPP pushed
the "source units" of the information to inspect themselves and deal with
staff who had leaked. In Case 6 the seller was a call-center agent at an
airline's outsourcing company, using the airline's system. In Case 7, other
companies' HR staff were bribed to pull applicants' data through their
employers' recruitment-platform accounts, and were prosecuted themselves.
The 2017 Interpretation already halves the thresholds for information
"obtained in the course of performing duties or providing services"
(Article 5, item (VIII)). The MPS's August batch showed the same pattern
from the police side. Access controls, logging and vendor oversight are
where a company's exposure sits.

**3. Some data is in the highest tier.** Case 6 holds that a passenger's
flight information for a trip not yet taken is "whereabouts and tracks"
information when it can pinpoint where a specific person will be at a
specific future time. That category carries the lowest criminal threshold:
50 items for "serious circumstances", 25 for insiders. Case 8 holds that
prescription records carrying a patient ID-card field are sensitive
medical-health personal information, because they can be linked to the
patient register and traced to individuals. Travel, booking, health and
other datasets that look operational may sit in the most protected
category.

**4. Public-interest damages are now part of the bill.** Three cases
attach civil public-interest claims: Cases 6 and 7 inside the criminal
case, Case 8 as a separate civil suit. In Case 8 the procuratorate refused
to set damages by the RMB 10,800 the defendants were proved to have earned.
It started from the sensitivity of the information and scaled up by volume
and reach. It added the data's public value, the defendants' fault, and
the cost to governance of the data going abroad, and reached RMB 1.5
million. In Case 7 the court ordered RMB 4 million against one defendant,
plus deletion of the data and an apology in national media. The method in
Case 8, sensitivity first, then volume, then cross-border risk, is the
SPP's model for quantifying harm when profit is small. Selling abroad
features in Cases 5 and 7, and in Case 8 the outbound transfer was an
express factor in the damages.

**5. Platforms get recommendations even when they are not defendants.**
Procuratorial recommendations (检察建议) went to a forum operator over weak
privacy protection and content moderation (Case 4). Others went to the
departments overseeing "private detective" ads (Case 2) and the promotion
of medical insurance credentials (Case 3), and to real-estate agencies on
reviewing listings (Case 5). Alipay was asked to flag and restrict the
accounts in Case 3. A recommendation is not a penalty, but Case 4's
operator responded by upgrading its models, content review and security
protections. Platforms that host the means or the market for these crimes
should expect to be drawn in.

Case 4 also settles, for procuratorates, how doxxing is charged. Intruding
into a system to harvest data and the PI offense are a notional
concurrence, punished as the heavier of the two. The online abuse is a
separate count of picking quarrels and provoking trouble.

---

— *最高人民检察院 (Supreme People's Procuratorate), 最高检发布依法保护公民个人信息典型案例
(The Supreme People's Procuratorate Issues Typical Cases on Protecting
Citizens' Personal Information in Accordance with Law), November 2, 2026,
reported by the Procuratorial Daily. Release note translated in full by DCC;
case map and commentary are DCC's.
[Original (Chinese).](https://mp.weixin.qq.com/s/6630OBHat79eFY85UO1uiQ)*

— Not legal advice.