Taming the “Wild West” in the Far East

Although laws targeting Internet-based content have lagged behind in China, the Chinese government has made sweeping changes over the past two years—most recently last fall—that extend offline legal protections to the virtual world. These developments will require online publishers to change their practices and possibly face greater exposure to privacy and reputational claims.

The changes began in December 2012, when the Chinese government issued the Decision to Enhance the Protection of Information on the Internet (the "Decision"), the principal document outlining privacy and reputational rights online in China. The Decision protects personally identifiable and other private electronic information, requires Internet service providers ("ISPs") to follow certain protocols when collecting and using electronic information, and places primary responsibility on ISPs if such information is compromised.

The Decision does not define specific violations or enforcement mechanisms, but directs the Supreme People's Court ("SPC") and the Supreme People's Procuratorate ("SPS"), China's highest court and prosecutorial office, respectively, to do so. As a result, the SPC and SPS in September 2013 issued the Interpretation of Criminal Liability for Libel on the Internet, and the SPC in October 2014 distributed Rules Concerning Several Issues of the Application of Law in Civil Dispute Cases Where Personal Rights and Interests Are Harmed by Use of the Internet ("Rules"). Together, these documents outline a new regime for policing violations of privacy and reputation rights on the Internet in China. Eight changes are worth noting:

1. Rules defining jurisdiction for online violations

The Rules clarify the correct venue for alleged online violations of personal rights: the defendant's residence or the location of the violation. The latter, in turn, is the location of the terminal (whether a computer or mobile device) that sends the harmful content. Notably, this raises—but does not appear to resolve—the question how the Rules apply to foreign defendants who publish content abroad.

2. Procedures making it easier to sue ISPs

The Rules accomplish this in two ways. First, they allow an ISP to be a defendant if the plaintiff sues it directly or an ISP customer who is sued requests the ISP be added as a co-defendant. Second, an ISP cannot easily defend itself by arguing the allegedly harmful information was released by an unidentifiable customer. Instead, it must identify the customer to add that customer as a codefendant.

3. Revised DMCA-like safe harbor

Before the Rules, China already had a safe harbor similar to the Digital Millennium Copyright Act, 17 U.S.C. § 512(c). Under that rule, an ISP could avoid suit altogether by following a protocol: remove content upon notification it is infringing and notify the poster, and restore the content if the poster disputes the claim. The poster and claimant would then resolve their dispute in court without further involvement of the ISP (unless there was proof the ISP itself knew about the infringement).

A revised rule makes it more likely an ISP will be dragged into court. Now the ISP is immune from liability but not suit, and must prove two elements to be dismissed from suit: (1) it "timely" removed the disputed content and (2) it had no basis to know the content was infringing. Each of these, in turn, is decided according to a set of factors established by the Rules that may involve fact-intensive, time-consuming, and expensive inquiries.

4. Liability for reposting content

The Rules also create a test to decide liability for reposting third-party content, which requires looking at the duty of care owed by the reposter (public figures have a greater duty than others), whether the information appears to be harmful, and whether the reposter changes the information to make it untruthful or misleading.

5. New violation: Black PR

The Rules make it unlawful to engage in "Black PR," the practice of purposefully posting online negative information about a company, and the business of providing this service. Specifically, those who engage in or repost Black PR may be guilty of criminal defamation for fabricating defamatory information or altering information to make it defamatory if (1) the content results in over 5,000 visits or is retransmitted by at least 500 others (within a one-year period) or causes mental disorder, self-mutilation or suicide by the victims or their relatives; or (2) the offenders have been administratively punished for similar offenses in the last two years.

Although the government generally prosecutes criminal defamation only if a victim presses charges, public prosecutors will pursue those who target multiple victims and cause serious harm or those whose conduct causes mass disturbance, public disorder, conflicts among ethnic groups, damage to national image or interests, or serious impact to foreign countries. Violations are punishable by up to three years in prison.

Prosecutors may also charge Black PR offenders with criminal provocation, which is punishable by up to five years' imprisonment, for insulting or intimidating others, fabricating falsified information, knowingly circulating falsified information or abetting others to do so on the Internet, resulting in serious public disorder.

Those who hire, organize, abet or aid others to post or repost harmful content may be held jointly and severally liable.

6. New violation: Blackmail

The Rules make it unlawful to post harmful content or block or alter lawful content and then charge a fee to undo the act. It is also a crime to threaten to delete content, depending on the frequency of the threats and the amount paid (a minimum of RMB 50,000 in revenue or RMB 20,000 in profit for individuals, and RMB 150,000 in revenue or RMB 50,000 in profit for corporate offenders—about $8,000, $3,200, $24,000, and $8,000, respectively). Penalties include up to five years' imprisonment, a multiple of the illegally obtained profits, and forfeiture of assets. If the revenue or profits are five times larger than the above amounts, the penalties increase to up to twenty years in prison

7. New violation: Unauthorized disclosure

The Rules also create a tort for disclosing personal information (including genetic and health information, criminal records, home addresses, and private activities). Exceptions exist where an individual consents, the disclosure is intended and necessary to promote the public interest, non-personally identifiable information is used for education and technical research (although this also requires consent), the individual has already disclosed the information, or the information comes from a lawful channel and the exercise of governmental powers.

It is lawful for ISPs or their customers to disclose information from governmental documents. However, this requires showing (1) the documents are the only source of the information, (2) the defendant did not add insulting and defamatory content, use improper titles for content, or alter the information to be misleading, and (3) the information is currently reflected by the source—meaning the disclosing party must update content if the government makes changes.

8. New civil remedy: Investigative costs and legal fees

Existing law already allows a court to require a tortfeasor to apologize, pay compensatory damages, pay mental distress damages, and restore the plaintiff's reputation. The Rules now allow courts to require compensation to victims for investigative costs and legal fees, up to RMB 500,000 (about $80,000).

The Decision, Rules, and Interpretations represent China's response to growing public demand that the government help individuals protect their personal rights on the Internet. They provide powerful tools to deter or remedy harms caused by online speech. As a result, ISPs should be prepared to defend more lawsuits.