You are here
More personal information up for sale in China
WHEN William Zhang's car insurance was about to expire in March, he didn't need to look far for renewal options.
In the two months before the policy was up, he received calls almost daily from insurers trying to sell him a new one. Since his initial policy was from Ping An Insurance Group, it was natural the company had been in touch.
"What confuses me is how other insurance companies knew about it," said the 26-year-old government employee from Shandong.
Three other car owners told Reuters that they had experienced the same problem. Personal data has become widely available in China and can be scooped up for pennies by insurance companies, banks, loan sharks, and scammers alike, said sellers and financiers interviewed by Reuters.
In May, China introduced its most comprehensive data-protection laws to date, tightening restrictions on the sharing of private data held by financial institutions and other firms.
Susan Ning, a partner at the law firm King & Wood Mallesons in Beijing, said: "Personal information leaks are risky. Such information can facilitate other crimes."
Insurers often buy numbers from shadowy online data sellers, who themselves have acquired the information illegally, said people in the industry.
Some companies illegally buy information from the Department of Motor Vehicles, car licensing authorities, car sellers, or from police stations, said Michelle Hu, a partner at Boston Consulting Group who has been a consultant on insurance deals.
By entering keywords like "personal data" or "cellphone data", in Chinese, Reuters found more than 30 groups created for the purpose of selling and buying personal information on Tencent's instant messaging service QQ and Baidu Inc's forum site Tieba.
Baidu declined comment; in a statement emailed to Reuters, Tencent said it was "committed to the protection of user privacy and maintaining data security".
Information sellers post ads in the online groups and negotiate with buyers through private messages on QQ or WeChat. Five sellers offered to sell Reuters lists from financial institutions of "people who need loans", "people who need insurance", and "Shanghainese men aged between 30 to 50".
The price of such information varied among sellers, ranging from 300 yuan (US$43.64) to 2,800 yuan for 100,000 people. A sample list included individuals' birth dates, car and home ownership status and mortgage information, in addition to names and telephone numbers.
Reuters was unable to verify the authenticity of the information. Three loan agents, who sell mortgages for three leading Chinese lenders, said customer information was often sold by bank employees.
Some Internet companies also provide access to sensitive personal information for a fee, according to Reuters' communications with two such platforms. Duoku Technology, a Wuhan-based firm, for example, operates a personal information search platform.
For five yuan, it returns the ID picture of any Chinese citizen whose name and ID number are provided; for three yuan, the site returns data about a person's cellphone usage.
Reuters verified that both services worked. The person whose ID picture was requested did not know how the services obtained his photo or telephone bills.
When asked where Duoku collected or purchased the information, a spokesman at Duoku Technology who identified herself as Ms Li, said much of the data was bought from online merchants and sold to banks and insurance companies.
"Financial institutions use our service for risk-management purposes only," she said.
Data privacy has also become a major issue around the world, with companies like Facebook criticised for harvesting and selling users' personal data without their explicit consent.
Online scammers are also common in other countries. In China, a proliferation of online financial platforms and users has led to a surge in the sharing of personal data, despite legislative efforts to protect consumers in recent years, experts say.
Under current laws, personal information sellers can face up to seven years in prison and a fine, while buying personal data can be punished by fines and up to three years in prison. Corporations are subject to similar legal punishments.
Despite the penalties, around 90 per cent of phone scams stem from personal information breaches, said a Union Pay report in May.
"Central to this problem is the high economic benefits associated with personal information trade and the low costs of violating relevant laws," said Ms Ning. "For some individuals with authorisation, others' personal information is just a few clicks away."
Other reasons behind personal data breaches include a lack of security measures on some websites, and ambiguous terms in certain contracts regarding the use of personal information, she said.
"China has a large population and data-privacy cases cover a broad range, so it can be quite difficult to investigate." REUTERS