Putting IT companies' power in cage of law

In the WeChat case, the personal information given by the users could also contain facts about their family, business, profession or other sensitive matters. In the Alipay case, the annual consumption record of a user might also contain private information. And as developers of the two apps, Tencent and Alibaba are obliged to protect such information.

Yet in both cases, there is risk of information leak. Especially in the Alipay case, the users' consumption records can be passed on to Sesame Credit of Ant Financial Services Group, which is an affiliate of Alibaba. Some argue Alipay has made that clear in its electronic agreement with users, but the sentence authorizing it to analyze users' data appeared in smaller fonts and was buried under innumerable other words. Worse, its default choice was "I agree", giving Alibaba automatic authorization to analyze users' personal information.

The two cases reflect the risks personal information face in this age of mobile internet. The Constitution, the criminal law, civil law, and the tort law all have articles on this issue. The Cyber Security Law, which came into effect on June 1, 2017, also stresses that people's personal information should be protected.

Still the legislature and judiciary have to take measures to better protect people's private information. Perhaps we need a special law or amend the existing laws to regulate the internet service providers and prevent them for misusing users' data. Because of the technologies at their disposal, IT companies wield immense power, and power of any kind should be put in the cage of law.

Guo Jun, a lawyer dealing in civil and commercial cases at Jintai Law Firm