When Does a Client List Become “Personal Information”? Criminal Red Lines Under China’s Personal Information Crime

Taking a client list to a new employer or buying “precise leads” may already cross the line into China’s personal information crime. This article explains the thresholds, four common misconceptions, defence angles, and a compliance checklist.

1. A Very Common Starting Point: A “Client List”

In consultations I regularly see the same scenarios. A sales manager resigns, takes the client list he has maintained for years, and keeps calling those clients from his new employer. A start-up buys tens of thousands of “high-intent leads” from a third-party “data service provider” to grow quickly. Or an engineer writes a script to scrape merchant contact details from a platform in bulk. When the police summon them, the first reaction is usually: “It was just some phone numbers. I didn’t defraud anyone. How is this a crime?”

The charge is the crime of infringing citizens’ personal information under Article 253A of the Criminal Law. It is not a remote, abstract offence. Since the 2017 judicial interpretation and the Personal Information Protection Law (PIPL) took effect in 2021, it has become one of the most frequently activated criminal provisions in data compliance — and a classic criminal-civil crossover: the same dataset can trigger criminal liability, civil damages, administrative penalties and employment disputes at the same time.

2. What Counts as “Citizens’ Personal Information”

Under Article 1 of the 2017 Judicial Interpretation on Criminal Cases Involving Infringement of Citizens’ Personal Information (Fa Shi [2017] No. 10), “citizens’ personal information” means information recorded electronically or otherwise that, alone or combined with other information, can identify a specific natural person or reflect the activities of a specific natural person. It expressly includes names, ID numbers, communication contact details, addresses, account passwords, financial status and movement trails.

The key words are “identify” and “reflect activities”. A mobile number alone may not identify anyone; a mobile number plus a name, purchase history and address is enough to pinpoint a person. In practice, enforcers tier information by sensitivity. Movement trails, communication content, credit records and financial information are sensitive, with the lowest threshold of 50 items. Accommodation records, communication logs, health and physiological information, and transaction information are important information, with a threshold of 500 items. Other general information — for example a name plus a phone number — requires 5,000 items. Illegal gains of RMB 5,000 or more can also establish the offence on their own.

3. Four Misconceptions That Trip People Up

Misconception one: a client list is a company’s business asset, not “personal information”. That is only half right. Corporate clients are not natural persons, but a client list usually contains the contact person’s name, title, mobile number, WeChat ID and sometimes home address — all of which identify a natural person. A company’s trade-secret interest in the list does not displace its personal-information obligations. Conversely, when an employee diverts clients, the company may sue for trade-secret infringement or pursue occupational embezzlement, while the employee may simultaneously be liable for the personal information crime — precisely the complexity of criminal-civil crossover.

Misconception two: I did not sell it, I only used it or gave it away. “Providing” under the Criminal Law does not require profit; free provision, exchange and sharing can all constitute providing personal information, while “unlawfully obtaining” covers purchasing, receiving and exchanging. A salesperson who forwards a client list to a new colleague, or to a new employer after resignation, may be found to have “provided” it.

Misconception three: it was the employee’s personal conduct, so the company is safe. This is the most dangerous misunderstanding. Article 253A expressly provides for corporate liability: where a unit commits the offences, the unit is fined, and the persons directly in charge and other directly responsible personnel are punished under the same paragraphs. If a company acquiesces in, tolerates or organises the purchase of data, the legal representative, the actual controller, the vice president in charge and the data protection officer can all be pursued. Conversely, a genuinely effective compliance programme, training records, access controls and audit logs are important evidence separating corporate from individual responsibility.

Misconception four: information publicly available online can be scraped freely. The interpretation provides that providing lawfully collected personal information to others without the data subject’s consent counts as “providing”, and that obtaining information by purchase, receipt or exchange — or collecting it in the course of performing duties or providing services — counts as “unlawfully obtaining by other means”. There is indeed limited room for lawfully public information, but “public” does not mean “free to harvest and resell in bulk”, particularly where scraping breaches platform rules, circumvents technical measures, or touches sensitive content.

4. Where the Defence Lies

Defending these cases is rarely about denying that something happened. It is a granular exercise along four dimensions: quantity, nature, intent and role.

First, quantity. The item count is the central sentencing variable, and investigators often count broadly. Defence counsel should check item by item: duplicates, disconnected or inactive numbers, non-natural-person data, publicly registered corporate information, and data that has been de-identified or anonymised. Does the forensic count explain its de-duplication method and criteria? Where the same dataset passed through several downstream buyers, was it counted more than once? Moving from “especially serious” to “serious” can take the sentence from three years or more down to under three years.

Second, the nature of the information. The threshold for sensitive information is one hundredth of that for general information. Misclassifying movement or financial data as general information — or inflating general information into sensitive information — materially affects conviction and sentence.

Third, the precondition of “violating State regulations”. The offence requires a violation of State regulations, which should be limited to laws, administrative regulations and departmental rules. If the charge rests only on industry standards, platform terms or internal company policies, there is room to argue.

Fourth, knowledge and purpose. Whether the actor knew the source was unlawful or unauthorised directly affects the finding of intent. Processing information as necessary for ordinary business and contract performance is very different from bulk acquisition for resale and profit. Article 6 of the interpretation is particularly important: for general information unlawfully purchased or received “for lawful business operations”, the threshold differs from Article 5 — the conduct is “serious” only where the information is used to profit by RMB 50,000 or more, or where there is a prior criminal record or an administrative penalty within two years, and the “especially serious” tier does not apply. For companies that bought lists for their own marketing, this is often the key defence entry point.

Fifth, separating corporate from individual liability, and assessing each person’s role. An ordinary salesperson or engineer is situated differently from the decision-maker. Accessory status, candid confession, disgorgement, acceptance of leniency, deletion of data and remediation are all mitigating factors to pursue. For an indicted company, it is also worth assessing eligibility for compliance-based non-prosecution or a corporate compliance remediation programme.

5. A Compliance Checklist for Companies and Individuals

Advice to companies must be concrete, not a vague instruction to “strengthen management”. First, source due diligence: before buying data from a third party, require an explanation of its origin, how it was obtained and the authorisation chain, and include legality warranties and indemnities in the contract. Second, minimum necessity and informed consent: collect only what the business purpose requires, make the privacy policy truthful, specific and traceable, and obtain separate consent for sensitive information. Third, access control and audit trails: grant least privilege by role, and require approval plus logging for exports and bulk queries. Fourth, departure management: clarify ownership of and handover duties for client information, sign confidentiality and non-compete agreements, and promptly disable accounts. Fifth, entrusted processing: sign processing agreements with outsourced customer service, SMS and data vendors that comply with Article 21 of the PIPL, specifying purpose, duration, method and each side’s obligations. Sixth, incident response: on a leak, take remedial action promptly and report as required, to prevent escalation of both loss and criminal exposure.

For individuals: do not buy “client resources” of unknown origin; do not take the former employer’s client materials when you leave; do not forward contact lists or query results “as a favour to a friend”; and if you have already been summoned or a case has been opened, preserve at once the evidence showing a lawful source and a complete authorisation chain, and make a truthful statement with counsel’s guidance. In these cases, being unable to explain where the data came from is often more damaging than having used it.

6. Conclusion

Data is an asset, and a liability. The personal information crime recurs because it usually arrives dressed as “industry practice”, “normal business” or “everyone does it”. But a criminal risk does not disappear because it is widespread. For a company, the real moat is not how much customer data it holds, but whether it can explain, for every dataset, where it came from, on what authority it is used, and how it is handled afterwards. For an individual, the cheapest risk control is to ask one question before acting: am I entitled to this information at all?

This article provides general legal information only and does not constitute legal advice on any specific case. Facts, evidence and circumstances differ from case to case; the appropriate strategy should be determined by the client and defence counsel on the actual record.

※ This article is general legal information, not legal advice on any specific matter. For your individual case, please consult a lawyer.