Shanghai court rules against employer in personal data violation

The Shanghai High People’s Court recently published a case in which an employer was found to have committed infringement in using a former employee’s information. The case has set off alarm bells for employers, as using employee information beyond reasonable bounds may result in the employee suing for damages.

The facts

A person surnamed Liu (full name was not disclosed by the court) was formerly an employee of company A. After leaving the company, Liu discovered that the 2021 annual report disclosed by company A used Liu’s telephone number as its “enterprise contact number”.

Liu held that company A’s act would cause the public to mistakenly believe that they were Company A’s legal representative (company A’s legal representative coincidentally also happened to be surnamed Liu) and had an adverse impact on Liu’s life and work. Accordingly, Liu instituted a legal action against company A, demanding that it halt the infringement, apologise and pay emotional and reputational damages in the amount of RMB50,000 (USD7,024).

Following the trial, the Shanghai Jiading District People’s Court rendered a judgment ordering company A to correct the disclosed information, remove Liu’s telephone number and apologise in writing, while simultaneously dismissing Liu’s other claims.

Perspective of the court

In terms of the characterisation of the case, the court held that regardless of whether it is analysed from the perspective of lawfulness, legitimacy or necessity, the inescapable conclusion was that the employer had committed infringement.

Analysis from lawfulness perspective. That company A had previously made Liu’s cell phone number public was due to the fact that it was related to his/her work. Accordingly, it had used the same based on Liu’s implied consent. After leaving the company, Liu had not consented to company A’s continued use of the number, and registration of an enterprise’s annual report does not fall within those circumstances where “personal information can be used without securing the individual’s consent”. Accordingly, company A’s act of processing personal information lacked a legal basis.

Analysis from legitimacy perspective. When preparing its annual report, company A failed to inform Liu that it needed to use his/her personal information. Accordingly, company A’s act of processing personal information failed to comply with the principle of legitimacy.

Analysis from necessity perspective. The purpose of disclosing annual reports is to resolve information asymmetry in trading and allow credit oversight. However, company A’s disclosure of the former employee’s cell phone number as its contact information made achievement of the purpose of the system impossible. Accordingly, company A’s act of processing personal information failed to comply with the principle of necessity.

Based on the above-mentioned, the court found that company A had infringed Liu’s personal information and, taking into account the manner of infringement, the degree of fault and the scope of harm, rendered a judgment ordering company A to correct its disclosed information, remove Liu’s telephone number and apologise in writing.

Key points

When processing employee information, an employer is advised to comply with the principles of lawfulness, legitimacy and necessity. If it still needs to continue using an employee’s personal information after he or she has left the company, it should seek his or her consent.

If the former employee does not give such consent, the employer should immediately cease using his or her personal information, otherwise the same will constitute infringement. Furthermore, once the judgment in such a case is released, it could have an adverse impact on the image and credit of the enterprise.

An employer that infringes personal information may also be liable for damages. Although the court did not uphold the claim for damages in the above-mentioned case, the reason it did not do so was that Liu failed to adduce sufficient evidence to show that he/she had incurred actual economic losses, or had suffered serious emotional distress.

If a similar lawsuit were to occur and the employee were to prepare sufficient evidence substantiating his or her losses, there would be nothing stopping the court from awarding damages.

Business Law Digest is compiled with the assistance of Baker McKenzie. Readers should not act on this information without seeking professional legal advice. You can contact Baker McKenzie by e-mailing Howard Wu (Shanghai) at [email protected]