The triple legal risks of enterprise data leakage

Author | Lawyer Ye He

introduction

ZHIHENG

Enterprise data leakage security incidents occur frequently. In May and June this year, Cartier and Dior sensitive data leakage incidents occurred one after another. Such incidents are often just the beginning of the enterprise credit crisis, and the situation often detonates secondary crises. Therefore, enterprises have a real urgency for the institutional arrangement and compliance deployment of data leakage prevention. This article will combine recent domestic cases, closely follow the triple legal risks of data leakage, and sort out the key points of enterprise risk prevention.

one

Legal risks of data breaches

Once a data breach security incident occurs, an enterprise is confronted with the issue of administrative, civil, and criminal liability.

(I) Administrative responsibilities

Law enforcement work in the field of data security has become increasingly in-depth, mainly targeting enterprises that "fail to fulfill their data security protection obligations in accordance with the law." Typical cases include the existence of weak passwords in enterprise-related systems or databases, servers, unauthorized access, and failure to take necessary safeguard measures. Most of the penalties are based on Articles 27 and 45 of the Data Security Law (hereinafter referred to as the Data Security Law).

For example, the first case of Guangdong public security applying the number of security law [1]: a company's driving school training students' names, ID numbers, mobile phone numbers, personal photos and other information stored in its "driving training platform" did not establish a data security management system and operating procedures, did not take de-identification and encryption measures, and was fined 50,000 yuan by the public security organs in 2022.

In data leakage incidents, administrative penalties for corporate executives and even related parties (such as Party A units, etc.) are becoming more and more common, which is related to the shift in the focus of regulatory law enforcement from the early focus on technical vulnerabilities to the review of management system defects.

In 2023, when a technology company developed an operation and maintenance information management system for a county-level municipal government department in Zhejiang, it uploaded the sensitive data collected by the unit to the self-leased public Cloud as a Service without consent, and failed to take security protection measures, resulting in serious data leakage. The public security organs fined the company and the project supervisors and directly responsible personnel 1 million, 80,000 and 60,000 yuan respectively.

The construction unit of Party A was also held accountable by the Commission for Discipline Inspection and Supervision in accordance with the relevant rules of the local party committee for its failure to observe and perform data security protection duties.

(2) Civil liability

The issue of data verification rights has been controversial, and there are many gaps in the legal system of the data element market. Therefore, the current basis for claiming rights in civil lawsuits caused by corporate data leakage is not uniform. Some cases involving the Personal Information Protection Law (hereinafter referred to as the Personal Protection Law) and intellectual property rights have attracted attention. Please refer to two cases:

One is the first case of civil public welfare proceedings involving face information protection issued by the Guangdong Provincial High Court in 2023 [3]: the defendant in this case sold a large amount of citizenship information for the production of false face dynamic recognition videos, unblocked WeChat accounts, verified real-name authentication of government apps such as industry and commerce, and used "Burn After Reading" software to delete relevant information and transaction records.

The court held that the face information involved in the case was biometric information in sensitive personal information, which "contains personal rights and property interests. Without authorization and consent, it illegally collected, sold, and used the face information of the unspecified public, which infringed the right of information self-determination of the unspecified public and damaged the public interest.", and ruled that the defendant immediately stopped the infringement, paid 103,000 yuan in compensation for public welfare damages, and compensated through volunteer services and other means.

Similar cases are gradually increasing: unauthorized use of other people's voices by AI constitutes infringement of personality rights, unauthorized use of other people's portraits for others to "change faces" constitutes infringement of portrait rights, and "hanging people" online atrocities constitutes liability for reputation rights infringement... There is also a problem of dividing the liability boundaries of multiple parties in this kind of personal insurance infringement case: In 2024, the First Intermediate Court of Shanghai demarcated the identification criteria for "co-processors" of personal information in the case of a property insurance company, an information technology company, etc., and held that the core identification standard is that different subjects jointly decide the purpose and method of processing personal information Participants are not required to directly commit or be aware of the actions of others.

The author believes that the issue of responsibility demarcation will follow the intensive data security legislative steps to form more systematic and scenario-based adjudication rules.

In 2025, the Nanjing Intermediate Court found that the defendant's parasitic software crawled and sold massive data on e-commerce platforms such as Taobao, infringing on the platform's trade secrets and data rights and interests, and determined that the defendant stopped infringement and jointly and severally compensated about 30 million yuan.

Cases of intellectual property infringement of data rights have become commonplace in recent years.

Previously, the Hangzhou court found that the network operator's behavior of using other people's data products as a tool to obtain commercial benefits without permission constituted unfair competition [6]. Recently, the Shenzhen court also included algorithms [7] into the category of trade secrets for the first time, thus finding that the defendant infringed. For enterprise executives and related responsible persons, they will also face the civil legal risk of being claimed or recovered for joint and several liability or violation of the duty of loyalty and diligence due to the Company Law.

(III) Criminal responsibility

Although the criminal law does not add special crimes for data crimes, the criminal liability caused by corporate data leakage is still within the scope of criminal law regulation. Based on the "multiple protection attributes" of data rights and interests, its "objects of rights are diverse", and "the protection of its criminal law is necessarily complicated" [8]. For ease of explanation, this article divides the criminal liability caused by corporate data leakage into four categories: one is the type of network and data crime in a broad sense, the other is the type involving state secrets, the third is the type of intellectual property rights, and the fourth is the type of data networking of traditional crimes.

1. Cyber and data crimes

Data crimes and network crimes are not strictly distinguished in practice, including crimes against citizens' personal information, crimes against computer information systems (crimes against computer information systems, etc.), and crimes of refusing to fulfill information cyber security management obligations. The commonality of such crimes is concealment, convenience, long chain, many people, and uncontrollable harm. For the case of data leakage, conviction and sentencing mostly need to clarify the relationship between data rights and social order, and put forward practical torture on the compliance obligations and bottom-line effects of enterprises.

In a case of illegal intrusion into a computer information system [10], the defendant downloads the data without permission and copies it to the Baidu Cloud as a Service purchased by his company, which constitutes the crime of illegal intrusion into a computer information system (similar to the behavioral characteristics in the cases cited in the administrative liability section of this article).

2. Criminal liability for data involving state secrets

On the 10th anniversary of the promulgation of the *****, data, as a carrier of sensitive information such as state secrets, has increasingly become the focus of relevant criminal accountability, such as the illegal transfer of geographic information mapping data out of the country [11], even if the data involved does not constitute the "Guarding State Secrets Law" and "Anti-Espionage Law" clearly protected by the category of state secrets, but also belong to the number of security law and including "Data Exit Security Evaluation Measures" and "Critical Information Infrastructure Security Protection Regulations" and other provisions of important or sensitive data, such data can only be exported through clear declaration approval, review and evaluation.

In the first cross-border transaction case in which the data involved was identified as intelligence, the person in charge of the company involved failed to resist the lucrative temptation and chose to ignore the company's legal doubts about the legitimacy of the transaction, collecting and providing high-speed rail signal data for overseas companies. The data involved was identified as intelligence, and the relevant personnel constituted the crime of overseas spying and illegally providing intelligence.

3. Criminal liability for data related to intellectual property rights

Types represented by data-related intellectual property rights include the crime of infringing trade secrets by leaking the source code of a company's online games, and the crime of copyright infringement by compiling the source code of a game into a private server game software for profit. As a new type of production factor, although data is similar to the object and limitation of rights and institutional goals of traditional intellectual property rights, its non-originality and non-competition are distinct from the latter. Therefore, if relevant data crimes are to be regulated by the intellectual property system, they still need to meet the substantive characteristics of the system.

4. Networking of data on traditional crime types

This is a type that is currently widespread and easily overlooked in corporate compliance, namely the "cyber alienation" of traditional crimes discussed in the academic community [13].

Some researchers believe that "the essence of data security legal interests is the pre-protection of information legal interests" [14], and some studies point out that there is an intersection of legal interests infringement between various types of cybercrimes [15], and the discussion in the sense of criminology cannot limit the rapid progress of judicial practice: in practice, "information legal interests" can directly correspond to Article 161 of the Criminal Law, the crime of disclosing important information in violation of regulations, the crime of leaking inside information, and the crime of disclosing case information that should not be disclosed in 308. The legal interests of information bearing or intersection can also cover almost all aspects of digital economic life, whether it is personal rights, public interests, or Social order.

Therefore, enterprises should not adhere to the existing provisions of departmental laws, but should make corresponding arrangements for the legal liability system under the overall national security concept.

two

Legislative trends to prevent data leakage

This year's legislative work is more frequent than in previous years, complementing the already normalized law enforcement status quo.

It can be seen from the cyber security law (exposure draft again) that the administrative penalties faced by data leakage are stricter and more detailed. Network and data security will also pay more attention to the connection and implementation between departmental laws and triple legal responsibilities.

three

epilogue

Data breaches often begin with vulnerabilities and are attributed to top-level design. The basic work that enterprises can do in terms of access control and responsibility attribution is not a high-hanging castle, and some enterprises' prevention and control measures in terms of authority abuse and management negligence are useless... Feeling the danger of the situation, this article is posted.

[1] On July 26, 2022, the Information Office of the Guangzhou Municipal Public Security Bureau held a press conference to inform the 2022 Guangzhou people's livelihood facts "personal information beyond the scope of collection and rectification" special project work and "net 2022" special project action, the whole chain to crack down on violations of citizens' personal information and other prominent network crimes related to the situation and typical cases.

[2] "Zhejiang Public Security Network Security Department Apply the Data Security Law to Fine Units 1 million Yuan", WeChat official account "Ministry of Public Security Network Security Bureau", June 16, 2023, https://mp.weixin.qq.com/s/MmAWdyoNQFfbBDzexX-qAA

[3] Higher People's Court of Guangdong Province: "Typical Cases of Personal Information Protection in Guangdong Courts", WeChat official account "Higher People's Court of Guangdong Province", October 31, 2023, https://mp.weixin.qq.com/s/0VVqrfHu9t75Tb6NGkTKzg

[4] Shanghai Pudong New Area People's Court: (2023) Shanghai 0115 Minchu No. 42087 civil court verdict; Shanghai First Intermediate People's Court (2024) Shanghai 01 Minchu No. 410 civil court verdict.

[5] Nanjing Intermediate People's Court of Jiangsu Province (2023) Su 01 Minchu No. 4082 civil court verdict.

[6] Hangzhou Railway Transportation Court Judgment: (2019) Zhejiang 8601 Minchu 1987, Hangzhou Intermediate People's Court Judgment: (2020) Zhejiang 01 Minzhuan 5889.

[7] Judgment of the Intermediate People's Court of Shenzhen City, Guangdong Province: (2021) No. 3843, Minchu, Guangdong 03.

[8] See Yu Haisong: "Analysis of the Current Situation and Future Prospects of the Criminal Law Regulation Model of Data Crimes", Journal of Law, No. 5, 2023 "Special Topics of Criminal Law Response in the Digital Age"

[9] Ye He: "Data Criminal Compliance Implementation Points", WeChat official account "Numerical Intelligence Security Action Plan", April 17, 2024, https://mp.weixin.qq.com/s/_J7gY5pkupnTsCY3I3owRg

[10] Donghu District Court, Nanchang City, Jiangxi Province: (2020) Criminal court verdict No. 967 at the beginning of Gan 0102, Intermediate court verdict of Nanchang City, Jiangxi Province: (2021) Criminal court verdict No. 104 at the end of Gan 01.

[11] The Disclosure of Hidden Surveying and Mapping Secrets, WeChat official account "Ministry of State Security", October 16, 2024, https://mp.weixin.qq.com/s/R7d0-O3mbDndUIyfl5p6lg

The case was broadcast on the National Security Education Day on April 15, 2022 through the CCTV "Focus Interview" program.

[13] See Guo Yandong and Ma Zongliang: "The background, changes, ideas and boundaries of the criminalization of cybercrime in our country", in the collection of Shanghai Legal Research, Volume 19, 2021 (Network Governance and Data Information Law Research Society).

[14] Zhang Gaoyue: "The Basic Structure and Judicial Application of Data Security Legal Interests", in Jiangxi Social Sciences, No. 6, 2025.

[15] Gao Lei: "The Substantial Identification of Criminal Law Causality: The" Algorithmic Imputation "of Cybercrime", in Ouyang Benqi et al., "The Basic Position and Method of Substantive Criminal Law", Chapter 5, Law Press 2021.

Digital Intelligence Security Action Plan

author

brief introduction

leaf lotus

Member of the Criminal Crime Prevention Professional Committee of Shenzhen Lawyers Association

Full-time lawyer of

Lawyer Ye He has extensive practical experience in compliance risk control, commercial litigation, etc.; is a cryptographic security engineer, deeply cultivating network data security and governance; has senior operation and management experience of Fortune 500 companies, and is good at medium and long-term strategy formulation and implementation, major dispute coordination and negotiation, administrative and criminal risk prevention. He concurrently serves as the Guangdong-Hong Kong-Macao Greater Bay Area Innovation and Entrepreneurship Incubation Base and Shenzhen Luohu District Entrepreneurship Mentor, and the mediator of several commercial mediation institutes in Shenzhen.

Past Review

Zhiheng general law·Zhiheng precipitation·Zhiheng explained doubts·Wonderful case