China's top procuratorate has pledged to intensify efforts to combat the illegal collection, sale, and misuse of personal information, as emerging forms of cybercrime pose growing threats to individual privacy, public safety, and online security. The Supreme People's Procuratorate released eight typical cases on Monday to mark the fifth anniversary of China's Personal Information Protection Law, highlighting offenses ranging from online doxing and the illegal sale of celebrities' whereabouts to personal data theft through fraudulent recruitment and the unauthorized transfer of sensitive medical information overseas.
In one case, a woman surnamed Shu, who worked as a customer service representative for an airline outsourcing company, exploited her access to the airline's internal system to obtain celebrities' flight information and sell it to fans online. Between October 2021 and April 2024, Shu illegally obtained and sold flight details involving more than 30 celebrities and over 100 flights, earning more than 10,000 yuan ($1,500). The leaked information was used by fans to track celebrities, follow them onto flights, or gain access to airport departure areas, disrupting airport operations and posing potential public safety risks.
In February 2025, a Beijing court sentenced Shu to 10 months in prison, suspended for one year, and fined her 30,000 yuan. She was also ordered to pay public-interest damages and issue an apology. Prosecutors subsequently challenged the ruling because it failed to confiscate her illegal earnings. An appellate court ordered the recovery of the proceeds in April 2025.
The SPP stated that flight information, which can identify a person's location at a specific future time, constitutes protected personal movement data under Chinese law. It warned that the illegal collection and sale of celebrities' personal information had fueled disorderly fan activities, including intrusive photography and crowding at airports, threatening privacy and public safety. Prosecutors should pursue criminal charges while also considering public-interest litigation to hold offenders accountable for broader social harm, the SPP said.
Another case involved six defendants who used illegally obtained personal information to target internet users through online doxing, involving the public disclosure of private information without consent. The group hacked into a provincial government service platform and obtained more than 16 million personal information records. Some defendants also stole over 1 billion records from online forums and cloud storage services. The stolen data was used to harass 47 people, including five minors, through online abuse and offline intimidation. Five victims sought medical treatment for depression, while several students experienced difficulties with their studies. In December 2025, a court in Chengdu, Sichuan province, sentenced the six defendants to prison terms ranging from nine months to four years and five months. Their convictions were upheld in April 2026.
The SPP said doxing not only infringes individual rights but also undermines online order and information security, potentially involving multiple offenses, including illegal access to computer systems and harassment-related crimes. It called for tougher punishment across the entire criminal chain, stronger oversight of online platforms, and measures to address security loopholes exposed by such cases.
The remaining cases involved illegal GPS tracking by self-proclaimed private detectives, personal data theft through fraudulent recruitment advertisements, crimes targeting older people, and the illegal collection and overseas transfer of sensitive medical and housing-related information. The SPP said prosecutors would intensify efforts to combat personal information crimes, strengthen coordination with relevant authorities, and improve governance to address the underlying causes of such violations.
