The Legal Bases on Didi's $1.2 Billion Penalty

Didi was fined $1.2 Billion by the Cyberspace Administration of China (CAC) on July 21 after a year-long probe for violating laws on data security and the protection of personal information. The CAC also imposed a personal fine of 1 million yuan ($148,000) each on Cheng Wei, Didi's chairman and CEO, and Liu Qing, the company's president.

The CAC said in a statement that investigators found that Didi had illegally obtained “screenshot information” from users' smartphone photo albums and collected data on facial recognition and family relationships. The CAC also accused Didi of unspecified national security violations in its data processing activities.

The legal basis for imposing fines on Didi and its executives is the Cybersecurity Law, Data Security Law (DSL), Personal Information Protection Law (PIPL), Administrative Punishment Law, and other laws and regulations. Cybersecurity Law, DSL, and PIPL all stipulate the administrative liability of imposing fines for illegal processing of personal information (data). And according to Administrative Punishment Law, If the same act violates several laws and regulations, only one fine which is the highest should be imposed on the act. Considering the sky-high amount of fine, the provision applicable in this case is mainly in Article 66 of the PIPL.

Personal Information Protection Law (PIPL)

Article 66 Where personal information is processed in violation of the provisions hereof, or personal information is processed without fulfilling the personal information protection obligations stipulated in this Law, the departments performing duties of personal information protection shall order the processor to make rectification, give a warning and confiscate its illegal gains, or order the application that illegally processing personal information to suspend or terminate the provision of services; if rectification is refused, a fine of not more than RMB 1 million shall be imposed concurrently on the processor; and a fine of not less than RMB 10,000 but not more than RMB 100,000 shall be imposed on the person directly in charge of the processor and other directly liable persons.

Where an illegal act specified in the preceding paragraph is committed and the circumstances are serious, the departments performing duties of personal information protection at or above the provincial level shall order the processor to make rectification, confiscate its illegal gains and impose a fine of not more than RMB 50 million or not more than 5% of its turnover of the previous year on the processor, and may also order the processor to suspend relevant business or to suspend business for rectification, and notify the relevant competent departments to revoke the relevant business permit or business license; and a fine of not less than RMB 100,000 but not more than RMB 1 million shall be imposed on the persons directly in charge and other directly liable persons, and such persons may also be prohibited from serving as directors, supervisors, senior managers, and persons in charge of personal information protection of relevant enterprises for a certain period.