Finding out that his avatar photo, an identification photo, in an online alumni directory appeared in search results on Baidu, a Chinese online search engine, the plaintiff surnamed Sun complained to the Beijing Internet Court (BIC) alleging that Baidu infringed his right of privacy and personal information right, claiming 1 yuan ($0.16) as economic losses and 40 yuan as legal expenses. 

Case summary:

Plaintiff: The plaintiff Sun's position was that the search engine used his alumni avatar photo without permission and infringed his right of privacy and the right of personal information.

According to Sun, he searched his name on Baidu website in October 2018 and found out that Baidu had included his avatar photo, which was his ID photo, from an alumni website in its search results. On Oct 23 in the same year, Sun notified the Baidu and asked it to delete the photo, but received no response.

In Sun's opinion, the photo together with his name is private and constitutes personal information. As the alumni website, the source of the photo, had already shut down, Baidu's behavior constituted infringement.

Defendant Baidu company (the operator of Baidu website): Baidu argued that it only provided a neutral search engine technological service that did not constitute infringement

It said that the photo information was stored in a third-party webpage that could be browsed normally. Baidu only took regular site-crawling act and thus did not commit infringement. 

Third-party Sohu company (the operator of the alumni website) claimed that it had nothing to do with the alleged infringement.

Sohu claimed that it no longer operated the website displaying Sun's photo. It had stopped service of the alumni website between 2012 and 2013 and there was no possibility of its authorizing anyone to access any information on that site. 

The BIC confirmed the following findings upon hearing all the evidence. The photo was uploaded to the alumni website by the plaintiff and was saved on its server. Although the portal address of the alumni website was no longer accessible, the photo could still be accessed by the usual search engine crawler technology as the precise server address of the alumni website for storing the photo was still open. When a user sent relevant search instructions on Baidu search, the relevant information was discovered and provided by the Baidu search engine.

The BIC concluded that:

1. The involved name, photo and their associated relationship constitute personal information.

Generally, the determination criterion for personal information is "identifiable". The search keyword plus the search result associated the name of the natural person Sun with the avatar photo showing his facial features. It became information that pointed to the only specific natural person and fell within the criteria of personal information. The owner of that information has the right to choose a more favorable type of claim infringement (in this case, of the right of privacy or of personal information) according to the actual situation.

In this case, the name and photo submitted by Sun could generally be used in normal social occasions for personal identification and social communication. And Sun submitted the involved photo to the social website himself and disclosed them to a certain range of network users at his own will. It means subjectively Sun had no strong intention to conceal the information as privacy, and objectively the information was not kept private. Classifying the information utilized in the scenes involved in the case as personal information (instead of privacy) is therefore more in line with the original intention of relevant legislation and the general social use of such information in today's internet society. 

2. The alleged infringement constituted processing personal information without permission.

The present law clearly stipulates that the collection and processing of personal information shall not be carried out without indicating the scope of use of the information and first obtaining the permission of the natural person to whom the information pertains. 

In this case, neither the plaintiff nor the defendants gave evidence regarding the intended use of the information involved. From the perspective of legislative provisions, information processors should clearly indicate the scope of that use. In terms of evidence collection capability and examples of evidence, since the alumni website storing the involved information had long been closed, objectively Sun was unable to collect related evidence, while Sohu as the manager and information processor of the website storing the evidence, was unclear about its authority over the information. In terms of the probable reason for the alleged infringement, according to the information application scenarios put into evidence the alumni website was mainly used for socialization of the communities within the school.

Thus, the BIC concluded that Sun authorized Sohu to use and disclose the information involved within a certain scope of authority. After Sohu disclosed the information public online, Baidu's search behavior made the information available to all unspecified users which objectively led to the disclosure of the information beyond Sun's authorization, and thus constituted processing of personal information without permission. 

3. Baidu bears corresponding responsibilities based on the rule of deletion upon notification.

In this case, the information involved was not obvious infringement information such as naked photos, or high infringement risk information such as photos with ID numbers. In order to encourage utilization and circulation of network information, it should be presumed that the plaintiff agreed to disclose general personal information. Therefore, it was hard for Baidu to foresee that the disclosure of the information involved was unauthorized. Consequently Baidu did not commit infringement of Sun’s personal information right before it received the notification from Sun to delete the information. 

Upon receiving any such notification, online service providers should take timely and necessary measures to prevent the infringement from expanding. The leaking of personal information on the internet could lead to an indefinite spread and result in irretrievable damages. To timely curb infringement, the legislation requires online service providers to perform reasonable review obligations and take corresponding measures when receiving a notification for deletion, or they will bear the associated risks. In this case, the evidence didn't show that Baidu took any actions upon receiving the notification from Sun, and thus it could not be determined that Baidu performed its corresponding obligations. 

Therefore, Baidu's failure to take any actions upon receiving the notification for deletion when it was capable of taking the necessary measures caused further losses of Sun's rights and interests and constituted an infringement on Sun's personal information right.  

Details of the judgment:

Although the plaintiff did not provide evidence on the amount of property loss caused by the infringement, personal information has a certain proprietary value in the internet economy. In order to curb an infringement, it is necessary that the illegal information user to pay even nominal damages to hedge any gains from the illegal act. The BIC supported the plaintiff's claim of 1 yuan for compensation of losses: within seven days of the judgment, the defendant Baidu was ordered to pay the plaintiff Sun 1 yuan as economic losses and 40 yuan as legal expenses.  

Significance:

This case sets the boundaries for disclosure and circulation of personal information online by clarifying that owners of personal information source should set up effective protection measures to ensure its security, and also that subsequent users have no fault in use of information which they could not foresee was unauthorized. The case not only protects individual rights and interests, but also prevents excessive limitation on subsequent information circulation and utilization.