Language

The WeRead Case: Discussion on Reasonable Digital Privacy Expectation

Authored by Yingying Zhu

 

March 2021

Each of us leaves a lasting digital footprint on the internet and would expect businesses that we are dealing with could treat our digital privacy with reasonable care and consideration. Can users have a reasonable privacy expectation in the friends made and the books read online? The Beijing Internet Court in its recently released WeRead judgment holds that, friends list and reading data are not eligible for privacy protection in the case under dispute but nevertheless entitled to protection as personal information.

Background

The judgment is in relation to a dispute between an individual, Huang, a user of a book reading app named WeRead, and the digital giant, Tencent, the operator of the most successful social media in China, WeChat, and its sister app WeRead. The WeRead app wishes to set up an app-based reading community, where people who enjoy reading can read & connect. The plaintiff Huang was complaining that WeRead sneaked away her friends list from WeChat and then automatically turned those who are also subscribers of WeRead as her connections. Huang was also complaining that the information regarding the books she read and how she felt about the reading was widely open to all her connections without her permission while she intended to keep such information private. In its defense, the defendant Tencent alleged that users’ friends list and reading data were obtained with a preapproval from users therefore it should not be held liable for the utilization of the data.

Decision of Beijing Internet Court[1]

The Beijing Internet Court (hereinafter the “BIC”), the Court of First Instance, decides that Huang’s friends list and reading data shall not be categorized as private information, hence not eligible for privacy protection.

To define what constitutes private information, the BIC’s reasoning is based on the classification of the following three layers of personal information:

1.     personal information reasonably recognized by the society as private information, such as one’s sextual orientation, sex life, history of disease and unreleased criminal records, etc.

2.     personal information on which one may hold a defensive expectation or a utilization expectation; and

3.     general information that has no traits of privacy at all.

 

The BIC holds, because one’s friends list and reading data do not constitute private information as listed in layer 1 in the above classification, Tencent is not liable for invasion of the plaintiff’s privacy.

 

The BIC goes on to reason that one’s friends list and reading data shall be classified under layer 2 in the above classification, where the information is considered personal but not private and therefore the emphasis of protection is to give the data subject a right to decide whether to hide or to use such information.

 

The BIC further holds that in this case the plaintiff did not get the chance to decide how to deal with her personal information, because Tencent failed to give proper and transparent notices to the plaintiff and failed to obtain her affirmative consent before utilizing the information under dispute. The BIC then decides that Tencent should be held liable for violation of the plaintiff’s legitimate interests in her personal information. The BIC’s decision is majorly based on Article 43 of the Cybersecurity Law of China. [2]

Discussion

1.    What is Privacy?

According to Eric Hughes, an American mathematician, computer programmer, and cypherpunk, “Privacy is the power to selectively reveal oneself to the world.” [3] Broadly speaking, privacy is the right to be let alone, or freedom from interference or intrusion. Information privacy is the right to have some control over how your personal information is collected and used.[4]

 

The Civil Code of China (2021) defines privacy as peace in a person’s private life and the private space, private activities and private information that a person does not intend for others to know.[5]

 

As a governing law, the Civil Code’s definition of privacy is vague. As we know, privacy varies greatly from person to person: while one person may be comfortable with showing his or her diet recipe online, another person may be embarrassed to let others know how little (or how much) he or she eats over a meal. Similarly, while one person may be at ease with disclosing many details of his or her personal life to online social connections, another person may feel ashamed of posting anything personal on the internet. So exactly what kind of privacy does the Civil Code protect? Some guidance from a concurring opinion in a US Supreme Court decision might shed some light on this.

 

2.    Reasonable Expectation of Privacy

To define the right to privacy under the Fourth Amendment, [6]  the US Supreme Court Justice John Marshall Harlan, in his concurring opinion in Katz, [7]  formulated a “reasonable expectation of privacy” test. The test has two prongs:

1)     the person must exhibit an “actual (subjective) expectation of privacy”; and

2)     society recognizes the expectation as “reasonable.”

The Katz “reasonable expectation of privacy” test, while particularly useful in terms of defining privacy, also provokes further questions: what is reasonable? where to draw the line between “reasonable” expectation and expectation that is “unreasonable”? These questions matter hugely in today’s digital world, because every time a user creates a new account at an online platform, the user provides information with personal details, including name, birthdate, geographic location, and personal interests, etc. Users are entitled to know if they can have a “reasonable expectation of privacy” in such information and if such expectation could be respected by the platform.

 

3.    Exceptions to the Reasonable Expectation of Privacy

 

There are several recognized exceptions to the reasonable expectation of privacy, such as the Third-Party Doctrine, which means once an individual invests a third party with information, and voluntarily agrees to share information with a recipient, the individual loses any reasonable expectation of privacy in that information, [8] and the Voluntary consent Doctrine, which means individuals lose a reasonable expectation of privacy when they consent to a search of private information.[9]Other exceptions include the following: unlawful information is not protectable by the law and therefore there should be no reasonable expectation of privacy,[10] and public disclosure of private information will cause forfeiture of any reasonable expectation of privacy.[11]

 

4.    Where did the Court draw the Line?

 

The BIC obviously referenced the Katz test by reasoning that “the privateness in the information that one does not intend to disclose depends on a subjective intent, however, such subjective intent shall be reasonably recognized by the society.”

 

Then the BIC made the point that the information about one’s social relationship could only invoke reasonable expectation of privacy under the following circumstances: the relationship between the data subject and certain connections would be too intimate to let others know, or the disclosure of some social relationship would negatively affect the data subject’s social image.

 

With respect to the book reading data, the BIC made another similar point that one could only have reasonable expectation of privacy in one’s reading data if certain reading contents fall into some private and secret information region or the reading data, when generated at certain amounts, would reflect negatively on the data subject.

 

Then the BIC commented that the plaintiff’s online social relationship, i.e., the listed friends, is being identified by open-ID, profile and nickname, which should not show the real social relationship or the degree of intimacy between the plaintiff and her social connections. The BIC also went through the contents of the plaintiff’s reading data and found that neither of the two books displayed to her connections would cause any damage to the plaintiff’s social image. The plaintiff’s reading data therefore should not be categorized as private information, hence no reasonable privacy expectation in the data.

 

In a nutshell, the BIC was defining “reasonable expectation of privacy” in the digital world based on the content of certain information. If a piece of information contains nothing intimate or cannot reflect negatively on the data subject, then the data subject should not have a “reasonable expectation of privacy” in the information. The content-based approach is how the BIC drew the line between privacy and non-privacy related information.

 

5.    Content-based Approach is not Fair

 

The BIC’s views on this issue are deeply disturbing. Back to the definition of privacy, broadly speaking, privacy is the right to be “let alone”. It means when a person walks into an isolated space, the person could expect to be in a state in which one is not observed or disturbed by other people,[12] as long as nothing illegal is ongoing under the roof. By applying the Katz test, this person has a reasonable expectation of privacy because the person demonstrates a subjective expectation of privacy by “walking into the isolated space”, which is well recognized by the society as reasonable.  Furthermore, the person’s act does not fall into any of the aforesaid exceptions.

 

 In solitude, a decent citizen could expect the same degree of privacy as much as anyone would. The right to privacy does not depend on whether something shameful is being conducted inside that isolated space. The right to privacy does not depend on the activity happened inside. Instead, it depends on whether one’s demonstration of intent to be let alone could be accepted as reasonable by the society. However, under the content-based approach, a decent citizen would have less expectation of privacy than someone who conducts shameful behaviour in solitude, and this approach apparently leads to unfair results.

 

Here comes the digital world version of the above scenario. When an individual, like the plaintiff Huang, subscribes to open an account at an online platform, like WeRead, and secures it with a password, this would create an isolated space where this person could expect digital privacy. By applying the Katz test, this individual has a reasonable expectation of privacy as he or she demonstrates a subjective expectation of privacy by “creating a password-secured account”, which is well recognized by the society as reasonable.  Likewise, the person’s act does not fall into any of the aforesaid exceptions.

 

This person is fully entitled to assert a digital privacy right to be “let alone”. One can choose not to have any improper friends, and not to read any obscene books, but can still enjoy full privacy rights over one’s personal information. It literally means that being a decent netizen should not compromise one’s digital privacy rights. The content of the information stored in a password-secured account, if it is nothing unlawful, should not dictate if and how the person would enjoy the right to privacy.

 

The above scenario shows that the content-based approach taken by the BIC is not fair because it makes users’ digital privacy rights conditional on the content of personal information, i.e., if the information includes any embarrassing content or not. This approach leads to the unfair conclusion that being a decent netizen, one has nothing shameful to hide and therefore would not have reasonable expectation of digital privacy.

 

Conclusion

 

With the storage and processing of exabytes of data, social media users’ concerns about their privacy have been on the rise in recent years. Incidents of illegal use of data and data breaches have alerted many users and caused them to reconsider their interaction with social media and the security of their personal data.

The disputes caused by unauthorized use of personal information over the internet have spiked in the privacy law landscape. The Beijing Internet Court’s present decision, which echoes with the same court’s decision on the “Dou Yin (Tik Tok Chinese version) collection of personal information” case, [13] is among the first few decisions made by Chinese courts on this controversial issue. Significantly, the decision might impact ongoing litigation stemming from similar disputes. Other courts around the country might follow suit. Therefore, it is imperative to have a more clear and fair approach towards defining reasonable digital privacy expectation.

In the era of big data, defining privacy is under pressure in the digital world. As Bill Gates put it: “whether it’s digital cameras or satellites or just what you click on, we need to have more explicit rules — not just for governments but for private companies.” [14]

 

 




[1] Beijing Internet Court, (2019) Jing 0491Min Chu Zi No. 16142.

[2]  China Cybersecurity Law, Article 43, provides, “Where an individual finds that any network operator collects or uses his or her personal information in violation of the provisions of any law, administrative regulation or the agreement of both parties, the individual shall be entitled to request the network operator to delete his or her personal information. If the individual finds that his or her personal information collected or stored by the network operator has any error, he or she shall be entitled to request the network operator to make corrections. The network operator shall take measures to delete the information or correct the error.”

[3] Eric Hughes, The Cypherpunk Manifesto (1993), see https://www.activism.net/cypherpunk/manifesto.html.

[4] See https://iapp.org/about/what-is-privacy/.

[5] Article 1032, China Civil Code (2021).

[6] The Fourth Amendment of the US Constitution, ratified on December 15, 1791, protects the right of people “to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.”

[7]See Katz v. United States, 389 U.S. 347 (1967). Concurring opinion written by Justice Harlan.

[8] See Smith v. Maryland, 442 U.S. 735, 743-44 (1979).

[9] See Katz v. United States, 389 U.S. 347 (1967).

[10] See https://civillaw.com.cn/bo/t/?id=37410.

[11] Ibid.

[12] See https://www.igi-global.com/dictionary/privacy-data-protection-towards-elderly/23405.

[13]See Beijing Internet Court, (2019) Jing 0491Min Chu Zi No. 6694.

[14] See https://www.oipc.bc.ca/news/quote-of-the-day-bill-gates/.


  • 相关资讯 More
  • 点击次数: 1000003
    2024 - 10 - 28
    作者:杨秀芸2020年修订的《企业名称登记管理规定》首次确认了企业名称争议可以通过行政裁决的形式处理。随后2023年10月1日起施行的《企业名称登记管理规定实施办法》进一步细化了企业名称争议裁决制度的相关规定,包括处理原则、流程时限、考虑因素等。部分省份也紧跟步伐,相继颁布与企业名称登记与争议处理相关的地方性规定,如广西壮族自治区市场监督管理局印发《广西壮族自治区企业名称争议处理办法》,云南省市场监督管理局印发了《云南省企业名称争议裁决办法(试行)》等等。尽管这些规定的出台为企业名称争议的解决提供了更为明确的处理路径,但在实践中,适用企业名称争议裁决程序仍面临诸多挑战。以下是本人在处理企业名称争议裁决中遇到的难题以及对解决策略的初步想法。一、企业名称争议处理分割化的困境与思考(一)困境描述笔者在进行企业名称投诉的实践中,观察到一种普遍现象,如果他人登记的企业字号与在先企业字号、注册商标都高度近似的情形下,在先权利人在投诉或争议裁决申请文件中,会将企业名称侵权、商标侵权及不正当竞争纠纷一并提出,请求行政机关综合考虑,从而给出一个公正的处理决定。但是行政登记机关往往在收到文件后,会将企业名称侵权、商标侵权及不正当竞争等纠纷划分至不同科室或部门处理,如:注册许可科聚焦于企业名称登记的合规性审查,注重形式审查,而知识产权科或商标科或不正当竞争科会专注于商标侵权与不正当竞争,注重实质审查。这种“各自为政”的处理模式,虽在一定程度上体现了专业分工,却也因信息孤岛效应而难以形成对案件全面、系统的认知,从而导致许多企业名称争议案件难以获得公正、合理的裁决。(二)探讨企业字号和商标均是现代企业重要的商业标识,企业字号是用来区别生产经营者的,代表企业的信誉,须与商品的生产者或经营者相联系而存在。商标是用来区别商品或服务来源的,须与其所依附的特定商品或服务相联系而存在,代表着商品或服务的信誉、质...
  • 点击次数: 1000002
    2024 - 10 - 18
    作者:赵丹青 在药品反假冒的案件中,很重要的一项内容就是打击假药和回流药。本篇文章浅显地梳理一下几个重点罪名的适用。 1、“假药”界定的变化 对于“假药”的界定《药品管理法》在2019年发生重大变化。 2015年修正的《药品管理法》第四十八条中规定“依照本法必须批准而未经批准生产、进口,或者依照本法必须检验而未经检验即销售的”药品,按假药论处。也就是,未经批准进口的药品,即使有疗效也按假药论处。但在2019年修订的《药品管理法》第九十八条关于假药的定义中,删除了以药品是否批准来界定假药这一条款。 《药品管理法》(2019年修订)第九十八条 禁止生产(包括配制,下同)、销售、使用假药、劣药。  有下列情形之一的,为假药:  (一)药品所含成份与国家药品标准规定的成份不符;  (二)以非药品冒充药品或者以他种药品冒充此种药品;  (三)变质的药品;  (四)药品所标明的适应症或者功能主治超出规定范围。 电影《我不是药神》中徐峥扮演的角色从印度购买未经批准进口的仿制药,如果按照修改前的《药品管理法》应当视为假药。但按照修改后的法律,印度仿制药并不属于应当被认定为假药的情形。现实中,徐峥扮演的角色陆勇因检察院撤回起诉而被无罪释放。主要的依据是2014 年 11 月,最高人民法院与最高人民检察院联合发布的《关于办理危害药品安全刑事案件适用法律若干问题的解释》(已失效),其中提到“销售少量未经批准进口的国外、境外药品,没有造成他人伤害后果或者延误诊治,情节显著轻微危害不大的,不认为是犯罪”。 后在《药品管理法》(2019年修订)第一百二十四条第三款亦明确规定“未经批准进口少量境外已合法上市的药品,情节较轻的,可以依法减轻或者免予处罚。”  2、生产、销售假药罪 VS 妨害药品管理罪...
  • 点击次数: 1000010
    2024 - 09 - 13
    作者:金涟伊为确保药品在生产、销售和使用过程中的安全性,国家市场监督管理总局发布了药品生产监督管理办法、药品经营和使用质量监督管理办法等一系列法规、规章,设立了药品生产质量管理规范、药品溯源制度等配套制度,同时,对于违反相关法律法规部门规章的行为,国家依法予以处罚,确保落实药品安全。处罚手段中,“没收违法所得”是最常见的处罚方式。 实践中,药品案件的违法所得应当如何确定? 对于该问题,国家食品药品监督管理局曾于2007年2月8日作出《国家食品药品监督管理局关于“违法所得”问题的批复》(国食药监法[2007]74号),批复称,一般情况下,《药品管理法》、《药品管理法实施条例》中的“违法所得”,是指“实施违法行为的全部经营收入”。《药品管理法》第八十二条、第八十七条(对应2019年修订后的第一百二十二条、第一百三十八条)规定的“违法所得”是指“实施违法行为中收取的费用”。《药品管理法实施条例》第八十一条(对应2019年修订后的第七十五条)规定的“违法所得”是指“售出价格与购入价格的差价”。 如参考以上批复,对于药品案件的违法所得可以有两种计算方式。第一种即以全额计算。此种计算方式可称之为“全额说”,是将违法所得等同为涉案产品的销售收入,计算违法所得时不扣除合法成本或税收。此种计算方式带有惩罚性,当事人应当承担超过其获利的处罚责任,其投入成本越高,惩罚性越明显。 第二种是对于《药品管理法实施条例》第七十五条的情况,即“药品经营企业、医疗机构未违反《药品管理法》和本条例的有关规定,并有充分证据证明其不知道所销售或者使用的药品是假药、劣药的”,此种情况药品经营企业、医疗机构无主观违法恶意,适用惩罚性处罚手段显失公平,因此违法所得以售出价格与购入价格的差价进行计算。 此外,不论以何种方式计算违法所得,都应当排除应退赔的部分。行政处罚法第...
  • 点击次数: 1000024
    2024 - 08 - 30
    作者:陈巴特朋友张先生今年年初入职一家科技公司,担任技术主管一职,因工作需要,常常受公司安排出差,而且通常在周末夜间乘坐夕发朝至的火车卧铺,出差时间也通常连续长达十天半月,期间必然经过双休日,有时甚至经过法定节假日。但是,公司从未向其支付加班工资。张先生百思不得其解,其始终认为,被安排到外地出差的在途时间,以及双休日仍出差在外,属于自己的时间却不能由自己支配,因此应视为加班。近日,张先生约我“喝茶”,我义务为其解答后,张先生释然,果断放弃了申请仲裁的计划。张先生的疑虑,或许正是很多劳动者困扰的问题。那么,当出差遇到休息日,究竟算不算加班呢?一、加班是什么?根据《中华人民共和国劳动法》第四十四条,加班是指劳动者在正常工作时间之外,按照用人单位的安排进行的工作。包括正常工作日延长工作时间,或者双休日或国家法定假期期间工作。认定加班需要有特定的工作内容为支撑。对加班的劳动者,用人单位应当依法支付高于正常工作时间工资的工资报酬。在竞争激烈的当今社会,加班司空见惯,已然形成“加班文化”。适当的加班,对用人单位的经营发展及劳动者收入的提高,有一定积极意义。但超时加班与体面劳动、舒心工作、全面发展不相符,与国家提倡的提升人民生活品质也脱节。如果劳动者加班后不能获得相应的报酬,则其合法权益将会受到侵害,用人单位也违反了法律规定。 二、休息日出差在途,算不算加班?加班的本质是在正常工作时间之外进行额外的工作,需要以特定的工作作为内容支撑,并非单纯的时间经过。出差在路上的时间,主要是乘坐交通工具,如同正常上下班在路上的耗时,都是为下一步工作而进行准备的时间。期间劳动者如未实际进行工作任务的执行,也没有产生具体的工作成果,仅有时间的消逝,则并不满足加班的这一认定条件。况且,出差在途期间,劳动者虽然不能自由支配时间,但仍可以照常休息,如乘坐高铁、飞机等交通工具时,可以休息或从事个人活动,...
× 扫一扫,关注微信公众号
北京市铭盾律师事务所 www.mdlaw.cn
Copyright© 2008 - 2020北京市铭盾律师事务所京ICP备09063742号-1犀牛云提供企业云服务
X
1

QQ设置

3

SKYPE 设置

4

阿里旺旺设置

5

电话号码管理

6

二维码管理

展开